Privacy Policy

This policy explains how Not The Plan collects and uses personal information when you use our website and store. We are the controller of the information described here. For any privacy question, contact contact@not-the-plan.com.

We collect the email address and any name you provide when you create an account or place an order; your order and download history; and limited technical data such as your IP address and server logs, which help us keep the site secure. When you pay, your card details go directly to Stripe — we receive confirmation of the payment and the last few digits of the card, never the full number.

For privacy-friendly, cookieless analytics we record aggregate page views and derive an approximate country from your IP address at the moment of the visit; we store only the country, never the IP itself. IP-to-country data is provided by DB-IP under CC-BY-4.0.

If you apply to a job or casting call posted on our site, we collect the details you submit. For a casting call this includes your name, email, photos you upload, and the social and featured-work links you provide; uploaded photos are stored privately and are visible only to our team, never published. For a job opportunity it includes your name, email, links to your work, any social links, and the references you supply. If you provide a reference's email or phone number, please make sure they are happy to be contacted about your application.

We use this information solely to review your application and contact you (or your references) about the opportunity. We keep applications only as long as needed for the relevant hiring or casting decision and then delete them. Providing this information is voluntary, but we cannot consider an application without the required fields.

We use your information to process orders and deliver digital downloads, to send transactional emails such as receipts, address verification, and password resets, to provide support, to keep the site secure and prevent fraud, and to meet our legal obligations. Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running the store securely, and consent where applicable.

We share information only with the service providers that run the store on our behalf: Stripe (payment processing), Resend (transactional email), Cloudflare (file storage and delivery of your purchases), and Fly.io (hosting and database). We do not sell your personal information. We may disclose information where required by law.

We use a single essential cookie to keep you signed in; we do not use advertising or cross-site tracking cookies. Pages with embedded videos load them from YouTube's privacy-enhanced (no-cookie) domain, and YouTube may set its own cookies only once you choose to play a video.

We keep account and order records for as long as your account is active and for as long as we need them to meet legal, accounting, and tax requirements. You can ask us to close your account and delete data we are not required to retain.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email us at the address above. You also have the right to complain to your local data-protection authority.

Our service providers may process data in countries other than your own. Where that happens, we rely on those providers' safeguards for international transfers, such as standard contractual clauses.

We take reasonable technical and organizational measures to protect your information, including encrypted connections and hashed passwords. No method of transmission or storage is completely secure, but we work to keep your data safe.

The store is not directed at children, and we do not knowingly collect personal information from anyone under the age required for consent in their country. If you believe a child has provided us information, contact us and we will remove it.

We may update this policy from time to time. The version posted here, with the date shown above, is the current one.