Privacy Notice

Railex Technology OÜ, an Estonian company, is the controller for Modacast account administration, platform security, service operation and our own subscription relationship with agencies. You can contact us at info@modacast.co.

This notice applies to agency users, models, clients, showroom recipients and other people whose professional information is handled in Modacast. It does not replace an agency's own privacy notice where that agency decides why and how it processes personal data.

Agencies use Modacast to manage their rosters, calendars, placements, portfolios and booking enquiries. An agency normally acts as an independent controller for model, client and contact data it chooses to enter, share or act upon. Railex provides the platform and processes that agency content to deliver the service.

Controller roles can depend on the specific activity. If your question concerns data entered by an agency, contact that agency as well as us. We will cooperate with the relevant agency when a request concerns data under its control.

• Account and identity data: name, email, profile image, OAuth identifier, authentication events and agency membership or role, received from you and from Google or Apple when you sign in.
• Agency and professional data: agency profile, markets, connections, team membership and professional contact details, supplied by agency users.
• Model data: identity and stage name, date of birth for the 18+ gate, measurements, appearance, location, nationality, portfolio images, credits, representation, placement and availability information, supplied by the model or an authorised agency.
• Client and recipient data: name, business contact details, showroom access email, booking dates, requested model and enquiry message, supplied by the person or by an agency.
• Operational data: calendars, booking and placement records, packages, showrooms, status changes and audit events created when users operate the service.
• Technical data: IP address, device and browser information, timestamps, security logs and essential cookie identifiers generated when the service is used.

• Contract (GDPR Article 6(1)(b)): creating and operating user accounts, providing agency workspaces and administering an agency's Modacast subscription.
• Contract performance and legitimate interests (Article 6(1)(b) and 6(1)(f)): enabling agencies to manage professional model and client relationships, calendars, portfolios, placements and enquiries. Our legitimate interest is providing a secure B2B talent-operations service; agencies must establish their own lawful basis for data they control.
• Legitimate interests (Article 6(1)(f)): protecting accounts, preventing misuse, maintaining auditability, diagnosing faults and improving service reliability. We balance these interests against the rights and expectations of affected people.
• Legal obligation (Article 6(1)(c)): complying with applicable accounting, company, regulatory, law-enforcement and data-protection duties.
• Consent (Article 6(1)(a)): where a specific optional activity legally requires consent. Consent may be withdrawn at any time without affecting prior lawful processing.

Access is limited according to workspace membership, role and the sharing choices made by the responsible agency. We do not sell personal data and do not use advertising or analytics trackers.

• Supabase, for EU-hosted database, storage and authentication services in Frankfurt.
• Vercel, for application hosting and content delivery.
• Google and Apple, only when their OAuth sign-in service is used.
• Stripe, to process an agency's own Modacast subscription billing (the agency's contact and payment details).
• The European Commission's VIES service, to validate an agency's VAT number for the EU business-eligibility check.
• Resend, to send transactional emails such as team invitations and notifications.
• Twilio, to send one-time security codes by WhatsApp or SMS where two-factor authentication is enabled (planned).
• Authorised members of relevant agencies and authenticated recipients with whom an agency intentionally shares a placement, package or showroom.
• Professional advisers, authorities or courts where disclosure is legally required or necessary to establish, exercise or defend legal claims.
• A successor in a merger, financing, reorganisation or sale, subject to appropriate confidentiality and data-protection safeguards.

Modacast's core database, authentication data and uploaded files are hosted by Supabase in Frankfurt, Germany (eu-central-1). Modacast is configured for EU data residency and does not intentionally move hosted customer content outside the EU.

Google and Apple separately process the authentication data needed for OAuth sign-in under their own privacy terms. If a provider's processing involves an international transfer, that provider is responsible for the applicable transfer mechanism. We assess our processors and use contractual safeguards where required.

We retain account and workspace data while the service relationship remains active and thereafter only as long as needed for account closure, security, dispute resolution and legal obligations. Agency-controlled professional records remain until the agency or authorised user deletes them, the workspace is closed, or continued retention is no longer justified.

Security and audit records are retained for a proportionate period based on risk. Deleted data may remain temporarily in restricted backups until normal backup rotation completes. Short-lived flow cookies expire within 600 seconds; the cookie-notice acknowledgement lasts six months.

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or a copy of your data, and you may object to processing based on legitimate interests. You may withdraw consent where processing relies on consent.

Send requests to info@modacast.co and identify the relevant agency or workspace. We may need to verify your identity. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority where you live or work.

An agency may add professional information about a model, client or contact who did not provide it directly to Railex. The categories, sources, purposes, lawful bases, recipients and retention criteria are described above. The source is normally the agency that manages the professional relationship, another connected agency, or publicly supplied professional material provided by an authorised user.

The agency remains responsible for having authority and a lawful basis to enter that data and for giving any notice it is required to provide. Contact us if you want us to identify the relevant workspace or route a rights request.

Account email and authentication data are required to sign in. Certain professional fields may be required to use a specific feature or to satisfy the platform's 18+ rule. If required data is not supplied, the relevant account, sharing or booking function may be unavailable.

Modacast does not make decisions producing legal or similarly significant effects solely by automated means and does not profile people for advertising.

We use access controls, tenant-level database policies, private storage, authentication safeguards, logging and organisational controls designed to protect confidentiality, integrity and availability. No online service can guarantee absolute security. Users must protect their sign-in account and promptly report suspected unauthorised access.

Modacast is strictly for people aged 18 or over. Agencies and users must not create profiles for, upload information about, or invite anyone under 18. This restriction is a safeguarding measure and is enforced independently of any local age-of-majority exception.

We may update this notice when the service, processors or law changes. We will change the date above and provide additional notice where a change materially affects people. Questions and rights requests can be sent to info@modacast.co.

Photographs of identifiable models, and appearance attributes such as hair and eye colour or nationality, may reveal information capable of constituting special-category data under Article 9 GDPR. Certain images (intimate, lingerie or implied-nude) are flagged sensitive and receive heightened handling.

Where such data is special category, we rely on your explicit consent under Article 9(2)(a) — obtained and recorded separately, and separately required for sensitive imagery — and, for data you have manifestly made public yourself, Article 9(2)(e). Sensitive images are kept out of the public discovery feed and require an explicit, separate authorisation before being shared with a client. You may withdraw explicit consent at any time.