Privacy Policy

1. Who we are

The Site is operated by Umbra Models, based in Ohio, United States (“Umbra”, “we”, “us”). We are the controller of the personal information described in this policy. We are an OnlyFans management agency. Our public Site does one thing: it lets a creator apply to work with us, or subscribe to our newsletter. There is no call booking on the Site. If a call makes sense, we arrange it by email after we have replied to an application.

Words that start with a capital letter here, such as Site, Portal, Talent, Applicant, and Content, have the meaning given to them in our terms of service.

For anything in this policy, write to team@umbramodels.com. We do not publish a postal address. If you need one for a formal notice, ask and we will provide it.

2. Notice at collection

This is the summary the California Consumer Privacy Act, as amended by the CPRA, requires us to give at or before the point we collect anything. It covers every category we collect, why, who we hand it to, and how long we keep it. The sections after it give the same information in more detail.

Every provider referred to in that table is based in the United States. Section 5 says what each one does for us and how to find out who it is.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not collect sensitive personal information through the Site. We do not knowingly collect personal information from anyone under 18, and we do not sell or share the personal information of anyone under 16. There is no advertising pixel, ad-network tag, or third-party tracker anywhere on the Site.

3. What we collect

There is no shop, no payment page, and no public sign-up on the Site. We only hold what you type into a form, plus a small amount of technical data that every web server sees.

When you apply

Your name, email address, Instagram handle if you give one, a rough figure for your current monthly earnings if you give one, the message you write, and an optional photo you choose to upload. A photo is held by our file storage provider at a long, unguessable web address. We never publish that address and nothing on the Site links to it, but the file itself is not password protected, so anyone who is given the address can open it.

The form will not submit until you tick a required box confirming that you are 18 or older, that any photo you upload is of you, and that you accept our terms of service and this policy. Ticking it is the point at which you accept both documents.

When you subscribe to the newsletter

Your email address and which page you subscribed from.

Alongside either of those

Your IP address, your browser’s user agent string, the time of submission, whether our notification email to ourselves was delivered, and, if it failed, the error the mail provider returned. Every record also carries a short status we set by hand as we work through it: new, contacted, signed, rejected, or spam. We keep these to answer you, to stop automated abuse of the forms, and to prove what happened if a submission is disputed.

When you simply read the Site

We run our own first-party page counter. It records the page path, the referring page, a country code supplied by our host, whether the request looked like a bot, and a visitor identifier that is a salted hash of your IP address and user agent. The salt rotates every day, so the identifier cannot be tied back to you and cannot be linked across days. We never store your raw IP address in the analytics table, and there is no third-party analytics or advertising tag anywhere on the Site. See our cookie notice.

That statement is about the analytics table specifically, and we would rather be precise than flattering. We do keep raw IP addresses in two other places, both described below: attached to a form submission, and in our security records.

Security records

We keep short-lived rate-limit counters keyed to your IP address, and a security event log that records things such as a blocked or repeated form submission, an upload we refused, or a sign-in problem. Those entries hold the IP address the request came from, the route it hit, the account involved if you were signed in, and a short technical note.

If an address is blocked, either automatically after sustained abuse or by hand, we also keep it in a block list along with the reason and when the block lifts. IP addresses in these records are stored as they are, not hashed.

If you are Talent using the Portal

The Portal at /portal is invite only and closed to the public. For the people we invite, we hold an account record (email address, name, role, and an optional avatar image) and progress against the training courses, which means which lessons you have started or completed and when. Our authentication provider additionally holds the sign-in records for your account, such as your password if you set one, the invitation and sign-in links we issue, and the times you signed in. Access requires a session cookie, which is described in the cookie notice.

4. Why we use it, and our lawful bases

Under the UK and EU General Data Protection Regulation we must have a lawful basis for every use. Where that regulation applies to a piece of processing, ours are:

• Steps taken at your request before a contract (Article 6(1)(b)). Reviewing your application, replying to you, and arranging and holding a call if we take it further.
• Performance of a contract (Article 6(1)(b)). Running the Portal and delivering the Services for Talent we have signed.
• Consent (Article 6(1)(a)). Sending you the newsletter. You can withdraw consent at any time and the withdrawal is effective immediately going forward.
• Legitimate interests (Article 6(1)(f)). Keeping the Site up and free of abuse, measuring in aggregate how many people read what, and keeping records of enquiries. We have weighed these against your interests and use the least identifying method we can, which is why analytics is hashed and salted rather than cookie based.
• Legal obligation (Article 6(1)(c)). Retaining records where the law requires it, and responding to lawful requests.

We do not collect special category data through the Site, and we ask you not to send it. Do not include health, sexual orientation, or biometric details in a form message. If you send them anyway, we will delete them.

5. Who else sees it

A small set of service providers process data on our instructions and are contractually bound to protect it and to use it only to perform services for us. We describe them by the function they perform rather than by brand name. Each of them is based in the United States.

• Our cloud database and authentication provider, which stores the records described above, holds the Portal accounts, and keeps the sign-in records for them.
• Our transactional email provider, which delivers our notification, confirmation and newsletter email, manages the newsletter unsubscribe list, and carries the Portal invitation and sign-in emails our authentication provider sends.
• Our file storage provider, which stores an application photo if you upload one.
• Our website hosting and DNS provider, which hosts and serves the Site and runs our DNS.
• Our business email provider, which runs the mailbox that receives everything sent to our team address, including your application and anything you write to us.

Naming a category rather than a company is what Article 13(1)(e) of the GDPR and the CCPA both allow, and it is not a way of keeping you in the dark: if you are exercising a right under Section 7 or Section 12, or you simply want to know, email team@umbramodels.com and we will tell you the identity of any provider on this list.

Beyond those providers, we disclose personal information only when we are legally compelled, when we need to establish or defend a legal claim, or in connection with a merger or sale of the business, in which case you will be told. We do not sell your personal information and we do not share it for cross-context behavioural advertising.

6. How long we keep it

A scheduled job runs against our database every day and enforces the first four periods below without anyone touching it. The rest are deletions we carry out by hand, and we say so rather than implying an automation that does not exist.

• Rate limiting counters: 1 day. Deleted automatically.
• Security event logs: 90 days. Deleted automatically.
• Page view records: 13 months. Deleted automatically. These contain no raw IP address and no name.
• Blocked IP addresses: a block with an end date is deleted automatically once it lapses. A block we set with no end date stays until we lift it by hand.
• Applications and the photo attached to an application: our target is 24 months after our last contact with you, unless we sign you and the record becomes part of your client file. Nothing deletes these on a timer. We review and clear them by hand, and if you ask us to delete yours we do it on request rather than waiting for that review.
• Newsletter subscriptions: until you unsubscribe, after which our email provider keeps a suppression record of your address so that we do not mail you again by accident. The original signup record in our own database is kept and cleared on the same manual basis as an application.
• Portal accounts: for the duration of the engagement and 12 months afterwards, or longer where tax or contractual record keeping requires it. These are closed by hand.

7. Your rights

If you are in the UK, the European Economic Area, or Switzerland, you have all of the following rights. We honour them for everyone who asks, wherever they live.

• Access. Get a copy of the personal information we hold about you, and an explanation of how we use it.
• Rectification. Have inaccurate information corrected and incomplete information completed.
• Erasure. Have your information deleted where we no longer need it, where you withdraw the consent it relied on, or where you successfully object to our use of it.
• Restriction. Have us pause our use of your information while a dispute about its accuracy or our lawful basis is resolved.
• Portability. Receive the information you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where that is technically feasible.
• Objection. Object to processing we base on legitimate interests. If you object to direct marketing, we will stop with no questions asked.
• Withdraw consent. Withdraw any consent you have given, at any time, without affecting the lawfulness of what we did before you withdrew it.
• Complain. Lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner’s Office. In the EEA it is the authority for your country of residence. We would rather you came to us first so we can fix it.

8. How to exercise your rights

Email team@umbramodels.com from the address you used with us, and tell us which right you are exercising. If you write from a different address we will ask you a question only the account holder could answer, because handing your data to an impostor would be worse than a slow reply.

We respond within 30 days. If a request is unusually complex we may extend that by up to two further months and will tell you why inside the first month. Exercising a right is free. We charge nothing, and we will never treat you differently for asking.

One limit worth stating plainly: our page-view records are keyed to a daily-rotating salted hash, so we genuinely cannot locate your rows in that table. There is nothing there to return or erase, which is the point of collecting it that way.

Using an authorised agent

You may appoint someone to make a request for you. The agent must send us written permission, signed by you, that names them and says what they may ask for. Before we act on it we will do two things: ask you to confirm directly that you gave the permission, and verify your identity the same way we would for a request you made yourself. If the agent holds a power of attorney granted under California Probate Code sections 4000 to 4465, that is enough on its own and we will not ask you to confirm separately. We refuse a request from an agent who cannot produce that permission, and we tell you why.

9. Whether the GDPR applies to us

We would rather state a position than leave you to guess at one.

We are based in the United States and we market to creators in the United States. We do not target the EU, the EEA, or the UK. We do not advertise there, we do not quote prices in euros or pounds, we do not translate the Site, we do not ship or serve anything to those markets by design, and we do not monitor anyone’s behaviour there.

A public website is readable from anywhere, so we do sometimes receive an application or a newsletter signup from someone in the UK or the EEA. Our position is that receiving an unsolicited enquiry does not by itself bring us inside Article 3(2) of the GDPR. On that basis we have not appointed a representative under Article 27, and we are not claiming to have one.

That is a scope position, not a refusal of responsibility. We apply every right in Section 7 to anyone who asks, wherever they live, and we hold information submitted from the UK and the EEA to the standards described in this policy. If we start targeting those markets, we will appoint an Article 27 representative and name them here before we do.

10. International transfers

We operate from the United States and our service providers are based principally in the United States. If you are in the UK or the EEA, your information will be transferred outside your country. Where that happens, the transfer is covered by the UK International Data Transfer Addendum or the European Commission’s Standard Contractual Clauses in our contracts with those providers, together with the technical measures described in this policy. You can ask us for a copy of the relevant safeguard by emailing team@umbramodels.com.

11. Automated decision making

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you for that purpose. Every application is read and decided by a person. See where we use AI for the detail.

12. California privacy rights

This section is for California residents and uses the terms of the California Consumer Privacy Act as amended by the CPRA, at California Civil Code § 1798.100 and following. The notice at collection above is part of it.

What we collected in the last 12 months

In the 12 months before the last updated date at the top of this page we collected the categories set out in the notice at collection: identifiers, commercial information, internet or network activity, coarse geolocation, visual information, and professional information. We collected them from two sources only: directly from you when you fill in a form or write to us, and automatically from your device when you load a page. We used them for the business and commercial purposes stated in that table, and we kept them for the periods stated there.

What we disclosed in the last 12 months

In the same period we disclosed identifiers, commercial information, internet activity, coarse geolocation, visual information, and professional information for a business purpose to the categories of service provider described in Section 5. Each of them may use that information only to perform services for us. We disclosed nothing to anyone else except where we were legally compelled.

Sale and sharing

We have not sold personal information and we have not shared it for cross-context behavioural advertising in the last 12 months, and we do not do so today. The Site carries no advertising pixels, no ad-network tags, and no third-party trackers. Because there is nothing to opt out of, we do not display a “Do Not Sell or Share My Personal Information” link. If that ever changes we will add one before it does, not after. We do not knowingly sell or share the personal information of anyone under 16.

Sensitive personal information

We do not collect sensitive personal information as the statute defines it, and we do not use or disclose any for a purpose that would give you a right to limit its use. If you send us something in that category anyway, we delete it.

Your California rights

• Know. Request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the parties we disclosed it to.
• Delete. Request deletion, subject to the exceptions the statute allows.
• Correct. Request correction of inaccurate personal information.
• Opt out of sale or sharing. Available on request, although as stated we do neither.
• Limit use of sensitive personal information. We do not collect sensitive personal information through the Site, so there is nothing to limit.
• Non-discrimination. We will not deny you service, charge you a different price, or give you a lesser standard of service because you exercised a privacy right.

Submit any of these to team@umbramodels.com. We verify your identity by matching the request to the email address on the record. If you want someone to act for you, read using an authorised agent above. If we refuse a request, we tell you which statutory exception we are relying on, and you may appeal by replying to us.

13. If there is a data breach

No system is immune, so here is what we commit to if personal information we hold is lost, stolen, or accessed by someone who should not have it.

• We investigate immediately, and we take the affected system offline if that is what it takes to stop it.
• Where the GDPR applies to the affected processing, we notify the competent supervisory authority within 72 hours of becoming aware of the breach unless it is unlikely to result in a risk to people, as Article 33 requires. Where it is likely to result in a high risk to you, we tell you without undue delay, as Article 34 requires.
• For residents of Ohio, we notify affected individuals in the most expedient time possible and no later than 45 days after discovery, as Ohio Rev. Code § 1349.19 requires, subject to the delay that section allows where law enforcement asks for it.
• Other states set their own deadlines. We follow whichever one applies to you, and where more than one applies we follow the shortest.
• We tell you what happened, what information was involved, what we have done about it, and what you can do. We do not hold a notification back waiting for certainty about the cause.
• We keep a written record of every breach and of how we decided whether to notify, whether or not notification turned out to be required.

If you think you have found a vulnerability or a leak, email team@umbramodels.com. See Section 16.

14. Marketing email

We are not currently operating marketing sends. If you have subscribed, your address is stored and no campaign is going out to it at the moment. We are telling you that rather than describing a mailing programme that is not running.

When we do start sending, every marketing message will carry a working unsubscribe link and a valid postal address, as the CAN-SPAM Act requires at 15 U.S.C. § 7704(a)(5). Unsubscribing will take one click, we will honour it within 10 business days at the outside and in practice within minutes, and we will never charge you, require you to log in, or ask for a reason. You can also unsubscribe at any time by emailing team@umbramodels.com with “unsubscribe” in the subject line.

On the postal address. We do not publish one. This is a small business run from a home, and printing that address on a public page would put a person at risk. We will provide a postal address on request, for a CAN-SPAM notice, a privacy request, or formal legal service. Email us and you will get it.

Unsubscribing from marketing does not stop transactional email, for example a reply to your application or a confirmation of something you asked for. Those messages carry no unsubscribe link because they are not marketing and are only ever sent in answer to something you did.

15. Where we use AI

We use AI tools in two places, and we would rather tell you than have you guess.

• Drafting marketing and editorial copy. Some of the writing on the Site, including articles in Insights, starts as an AI-assisted draft. A member of our team edits, fact checks, and approves everything before it is published. The claims, figures, and opinions are ours.
• Internal tooling. We use AI assistants for ordinary internal work such as summarising notes, drafting internal documents, and building our own software.

Just as importantly, here is what AI does not do. It does not decide whether we accept your application. It does not score, rank, or filter Applicants. It does not send you an automated reply pretending to be a person. If we ever publish an image or video generated by AI, we will label it as such.

16. Security

Form submissions are validated and rate limited. Lead records, security logs, and analytics tables are locked to server-side access only and are not reachable from a browser. Portal data is protected by database-enforced row level security, so one account cannot read another’s. No system is perfect, and we do not claim ours is. If you believe you have found a vulnerability, email team@umbramodels.com and we will work with you in good faith.

17. Age requirement

The Site and the Services are for adults. You must be at least 18 to apply, to subscribe, or to hold a Portal account, which is the same requirement as Section 3 of our terms. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information to us, email team@umbramodels.com and we will delete it.

18. Changes to this policy

When we change this policy we replace it here and update both dates at the top of the page. The last updated date is when the text changed. The effective date is when the version you are reading starts to govern. Where a change carries the notice period described below, the effective date is later than the last updated date, and the version published before it continues to govern until that day.

If a change materially affects how we use information you have already given us, the dates alone are not enough and we do not rely on them. We give at least 14 days’ notice before the change takes effect, by email to everyone who holds a Portal account and to newsletter subscribers at the address we hold, and by a notice on the Site.

A material change does not apply retrospectively to information we already hold unless you agree to it or the law requires it. If a change would mean using your information for a genuinely new purpose that the original lawful basis does not cover, we ask for your consent rather than announcing it.

If you want a copy of an earlier version of this policy, email us and we will send it.

19. Contact us

Privacy questions, rights requests, and anything else legal: team@umbramodels.com. We answer from the same address. There is no separate privacy team to be routed to, and no ticket queue to be lost in.