Privacy policy

1. Who we are

PrePro Selects is a client gallery, review and delivery platform for production companies. This policy explains what we do with personal data, in the sense the General Data Protection Regulation (EU) 2016/679 gives that term.

The controller for the personal data this policy describes is PrePro Selects, Calle Provenza 326, 3-2, 08037 Barcelona, Spain. PrePro Selects is established in Spain, so the Spanish data protection authority (AEPD) is its lead supervisory authority and no representative in the EU is needed under Article 27 of the GDPR. No data protection officer has been appointed: Article 37 of the GDPR and Article 34 of the Spanish data protection act (LOPDGDD) do not require one for this processing.

For anything covered by this policy, write to privacy@preproselects.com.

2. Controller or processor

Two different relationships run through this platform, and the answer to "who is responsible for this data" is different in each.

We are the controller for the data of the people who buy and administer PrePro Selects: the producers and heads of production who hold an account, the people who contact us through the website, by email or through the help box when it is on, the people at production companies we email about the product, and the billing contacts on a subscription. We decide why and how that data is processed.

We are the processor for everything a customer puts into their workspace: the photographs, video, call sheets and casting material they upload, what people send through their casting links, the names of their projects and clients, the gallery logins they create for their clients, and the record of what those clients looked at and liked. The customer is the controller for all of it. We process it on their documented instructions, which are the actions they take in the product plus the data processing agreement.

If you were given a login to look at a gallery and you want to know what is held about you, the production company that invited you is the controller and is the right first contact. Write to us anyway if you cannot reach them and we will pass the request on and tell you we have.

3. Data we hold as controller

We do not enrich an account holder's record from third-party data brokers, and we do not profile our users. There is no automated decision-making that produces legal or similarly significant effects.

The help box. It is switched off at the moment. When it is on, what you type in the help box on this site, in the app and in client galleries reaches our team together with the details listed above, and we reply there or by email. Please do not type passwords or anything you would not put in an email.

If we emailed you about PrePro Selects

We write to some people at production, casting and location companies to tell them about PrePro Selects. If you received one of those emails, we hold your name, work email address, job title, company and company website, where we found them, and any reply you send. The contact details come from the published member directories of trade associations and from the companies' own websites. The emails are sent from hello@preproselects.com through our own email provider, IONOS, in the European Union (see section 7). The basis is our legitimate interest in telling businesses about a product made for their work (Art. 6(1)(f)).

You can object at any time, without giving a reason: reply "stop" to any of our emails, or write to privacy@preproselects.com, and we stop at once.

We keep a prospect's name, work email and company for up to 12 months after our last email, unless they become a customer. If they ask us to stop, we keep only the email address on a do-not-contact list, so we never write again.

4. Data we hold as processor

On behalf of our customers, and only on their instructions, the platform holds:

• Uploaded material — stills, video, PDFs and the derivatives generated from them. Photographs of identifiable people are personal data, and on this platform they are frequently the whole point: casting portraits, crew stills, scouting images with passers-by in frame.
• Project metadata — project, client, category and folder names, notes and file names.
• Gallery logins — the username, display name, email address if the customer or the client adds one, password hash, permissions and expiry of each client login the customer creates.
• Viewing records — each sign-in and when it happened, how long the gallery was open on screen, which images were opened, liked, annotated or downloaded, a coarse device class, the browser user agent, and a salted hash of the viewer's IP address rather than the address itself.

The salted hash is deliberate. Counting sessions requires knowing whether two visits came from the same place; it does not require knowing where that place is. The hash supports the first and cannot answer the second, so no raw viewer IP address is written to the database at any point.

Our own team. To run the service for our customers, a small number of named people on our team can see, in our own tools, a workspace's gallery logins, their email addresses, when they signed in and how long they spent in the gallery. We look at this only to answer a support request, to fix a fault, to keep the service secure or stop abuse, and to count use of the platform in totals that identify no one. Every such access is logged. We never use a client's email address or activity to contact them about PrePro Selects, or for any other purpose of our own.

We do not use this material for our own purposes. We do not scan it for content beyond generating thumbnails and poster frames, and we do not disclose it to anyone except the sub-processors listed below and where the law compels us.

Casting links

On the casting accounts (Casting Director Essential, Casting Director and Casting Director Personalized), a casting company can send street-casting and self-tape links. A person who fills one in sends their answers, photos and videos straight into that company's casting project. The casting company is the controller of all of it, and we are its processor, as for anything else in a workspace.

The questions are the casting company's. A form always asks for a name and a date of birth, and usually for an email, a phone, a city, Instagram, gender, height, sizes, languages, skills, availability, an agency, photos (face, profile, full body), videos and a signature. For an under-18 it also asks for the parent's or guardian's name, email and phone, and their agreement. When an agent sends it, the agent's name, agency, email and phone. We also keep which form it came from, when, and who sent it: the person, a parent or guardian, an agent or the casting company.

Under every casting form, the person agrees to this, word for word, with the casting company's name in it:

I agree that [the casting company] may use my details, photos and videos for this casting. PrePro Selects handles them for the casting company. More: preproselects.com/legal/privacy

and for an under-18, the parent or guardian agrees to:

I am the parent or legal guardian and I agree that [the casting company] may use the child's details, photos and videos for this casting.

• Light files. Every photo and video is compressed when it arrives, and once the light copy has passed its checks the original is deleted. The light copy of a photo carries no location data or other metadata. A file that is already light, or whose copy fails a check, is kept as it was sent.
• Sixty days. A casting project created from 22 October 2026 is deleted 60 days after it is created. The casting company gets reminders and can keep it 14 more days once, so 74 days at most. A casting project created earlier keeps the date it was given.
• The short card. When a casting is deleted, PrePro Selects keeps a short card of each person who applied: name, contact, answers and one headshot. The casting company cannot see it; only the PrePro Selects team can. We keep it to answer questions or claims about the casting, and delete it when the person asks (privacy@preproselects.com) or at the latest 3 years after the casting.

5. Lawful bases

Language. This site and our emails are in English unless you pick another language (Spanish, French or German) with the language switch, or open a link that asks for one. When you pick a language we keep only that choice (en, es, fr or de) with your account, your name in a gallery, your waiting-list entry or your support conversation, so that our emails to you use it too. We do not work out your language from your IP address or from anything else. The basis is our legitimate interest in communicating with you in the language you chose (Art. 6(1)(f)), and you can change it at any time.

Where we rely on legitimate interests we have weighed those interests against your rights and freedoms, and you can object at any time — see section 9.

6. How long we keep it

Deleting something in the product removes it from every view immediately and queues the bytes for removal from disk. It remains in the nightly backups until those backups age out, at most 35 days later, which is the honest description of what "deleted" means for any system that keeps backups at all. If you need a deletion confirmed earlier than that, tell us and we will handle it individually.

7. Sub-processors

These are the only third parties that can touch personal data held on this platform. Customers on a signed data processing agreement are notified before a sub-processor is added or replaced, and may object.

Card details are held by Stripe and never by us. No analytics, advertising or tracking provider is used. Emails to prospects (section 3) go out from our own hello@ mailbox at IONOS; no other provider handles them.

Visitor statistics. We count visits from our own web server logs. To tell countries and networks apart, our server looks each address up in a local copy of DB-IP's free database; no address is sent to anyone for this, and only the totals are kept. IP geolocation by DB-IP, licensed under CC BY 4.0.

Single sign-on. If your organisation signs in with its own identity provider, such as Google or Microsoft, that provider sends us your name and email address when you sign in. It acts for your organisation, not for us, so it is not our sub-processor.

Google Sheets export. A team member can choose to open their feedback export in Google Sheets. Google then asks them to allow one permission, drive.file, which lets the page create that one file in their own Google Drive and nothing more: it cannot open, list or change anything else in their Drive. For this step only, the app loads Google's sign-in script from Google. The file goes straight from their browser to Google. We never receive or store a Google token or any other Google account data, and we keep no copy of what was sent. The Sheet belongs to them under their agreement with Google, so Google is not our sub-processor for it.

PrePro Selects' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. International transfers

Our servers, the database, the backups and project media are in the European Union. The database and the local backups are in Germany, on infrastructure operated by IONOS SE. Project media — the photos, video and documents our customers upload, and their thumbnails — is stored in a private Cloudflare R2 bucket restricted to the European Union jurisdiction, the encrypted off-site copies of the backups are in a second bucket restricted the same way, and a cache of recently viewed media is kept on our servers in Germany. A browser never fetches anything from Cloudflare directly: every request is authorised on our servers first, and they fetch the file on the viewer's behalf. There is no US region, no replication outside the EU and no public CDN.

Cloudflare. Cloudflare, Inc. is established in the United States. The media it stores for us stays in the EU, but as a US company Cloudflare could receive a request from a US authority for data it holds, so we treat storing media with it as a transfer. It is covered by Cloudflare's certification under the EU-US Data Privacy Framework, with the European Commission's Standard Contractual Clauses in Cloudflare's data processing addendum as a fallback. Cloudflare publishes how it handles such requests, and lists its own sub-processors, on its website.

Payment processing is another routine transfer. Stripe Payments Europe, Ltd. is established in Ireland and transfers some data onward to its parent in the United States, under the EU-US Data Privacy Framework and the Standard Contractual Clauses together with Stripe's own transfer safeguards. No project media is ever sent to Stripe — only the billing contact, the amount and the subscription state.

Anthropic. Support requests, and the details listed for them in section 3, are sent to Anthropic in the United States for the tools our team uses to handle them. No project media is ever sent. The transfer is covered by the European Commission's Standard Contractual Clauses in Anthropic's data processing terms. Under its commercial terms Anthropic does not use this data for its own purposes and keeps it only for a limited period.

Telegram. Our team's alerts go through Telegram, which is established outside the EU. Since 28 September 2026 an alert carries no personal data: it says that a help-box message needs a person, with its ticket number, its category and the workspace's short name. The conversation itself stays on our servers.

We will not move hosting outside the EU without notifying customers in advance and giving anyone who objects the opportunity to terminate.

9. Your rights

Under the GDPR you have the right to:

• Access — a copy of the personal data we hold about you, and an explanation of what we do with it.
• Rectification — correction of anything inaccurate. Most account fields you can edit yourself in the app.
• Erasure — deletion, where we have no overriding obligation to keep it. Invoices are the usual exception.
• Restriction — a pause on processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — your data in a structured, machine-readable format. In practice: a full export of your workspace, which you can also trigger yourself at any time.
• Objection — to any processing we base on legitimate interests, and at any time and without reason to direct marketing.
• Withdrawal of consent — where consent was the basis, withdrawable at any time without affecting what was lawful beforehand.

Send requests to privacy@preproselects.com. We answer within one month and will tell you if we need the extension the regulation allows for a complicated request. We may ask you to confirm your identity first — not to obstruct you, but because handing an account's data to whoever asks would be the very failure this section exists to prevent. Exercising these rights is free.

If your request concerns material inside a customer's workspace — a gallery you were given access to, a photograph of you in a casting folder — we will forward it to that customer, who is the controller, and confirm to you that we have. We do not delete a customer's material on a third party's instruction.

If you applied through a casting link, the casting company that sent it is the controller of what you sent and the right first contact; we pass your request on if you cannot reach them.

If you are in the United States. We do not sell personal information. We do not share personal information for cross-context behavioural advertising, and we do not use it for profiling that produces legal or similarly significant effects — so there is nothing to opt out of, and the rights listed above are available to you in the same way, by writing to the same address. No page on this site tracks anyone across other websites, so a browser's Do Not Track or Global Privacy Control signal changes nothing: every visitor is treated as though it were set. No third party collects personal information about your activity over time and across different websites through this service. We do not collect biometric identifiers: photographs and video are stored and shown to people, never scanned for face geometry.

10. Cookies

PrePro Selects sets three sign-in cookies — sl_staff for the admin app, sl_guest for a client gallery and sl_preview for a staff member previewing a gallery as a client — plus sl_sso_state for the few minutes a single sign-on takes, and keeps a few entries in your browser's local storage for the same purpose: your session token and the name you typed. All of them are strictly necessary for a service you asked for, which is why there is no consent banner: there is nothing to consent to. The rest only remember your choices and unfinished work on your own device: your language (a pps_lang cookie and a matching local storage entry, when you pick one with the language switch), the currency you chose for prices, your help-box conversation, uploads still in progress, and whether the home page intro has already played during this visit. None of them tracks you. Names, lifetimes and how to remove them are on the cookie policy page.

Where the gallery runs embedded inside a customer's own website, no cookie is set; the embedded session is a token held by the page and passed with each request.

There is no analytics cookie, no advertising cookie, no tag manager, no pixel and no session recording. No page of this site or the product loads third-party JavaScript, with one exception: when a team member chooses "Open in Google Sheets", the app loads Google's sign-in script for that step (see section 7).

11. Security

Passwords and session tokens are stored only in hashed form. Each workspace's data is kept separate, files are served through short-lived private links, and every connection is encrypted. A summary is on the security page, and Annex II of the data processing agreement lists the measures.

If a personal data breach occurs we notify the competent supervisory authority within 72 hours where the regulation requires it, and affected customers without undue delay. When we act as processor, we notify the customer without undue delay so that they can meet their own deadline.

12. Children

PrePro Selects is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 16, and we do not knowingly collect personal data from a child under 13 through this website. If we learn that we have, we delete it.

Children often apply to castings. Through a casting link an under-18 applies with a parent or guardian, who gives their own details and agreement on the form; the casting company is the controller of what is sent.

Material uploaded by a customer may depict minors — child casting is ordinary production work — and where it does, the customer is the controller and is responsible for holding the consents the law requires: for the processing of a child's data, a parent's or guardian's consent below the age of 14 in Spain (Article 7 LOPDGDD); for the use of a minor's image, the consent that Organic Law 1/1982 requires, with its formalities. We show such material only to the people the customer has authorised and never use it for anything of our own.

13. Changes

When this policy changes we update the date at the top of the page. If a change materially affects how we handle personal data, we email account holders at least 30 days before it takes effect. Previous versions are available on request.

14. Complaints

Tell us first — privacy@preproselects.com — and we will try to put it right. You also have the right to complain to a data protection supervisory authority, either in the EU member state where you live or work, or where the alleged infringement took place.

For most of the people who use this platform that is the Spanish authority, the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, aepd.es, which accepts complaints online. If you are in the United Kingdom, it is the Information Commissioner's Office, ico.org.uk.

The AEPD is also our lead supervisory authority, because PrePro Selects is established in Spain.

Last updated 30 October 2026. See also the terms of service and the data processing agreement.