In short
- SPHERE.ART LLC, which operates Sphere Cinema, is responsible for your Personal Data. Write to privacy@sphere.art about anything in this policy.
- We collect what you give us, what you create, what other Users add about you and technical data such as logs, to run the Service, keep it safe and meet the law. We do not sell it.
- Other Users and the public see what you publish. Uploaded files sit at web addresses that anyone with the link can open. Providers in the United Kingdom, Germany and the United States process data for us.
- To see, correct, delete, block or get a copy of your data, write to privacy@sphere.art. We answer within 10 working days.
- You can complain to the State Audit Office of Georgia.
1. Who is responsible for your data
Sphere Cinema is a service operated by SPHERE.ART LLC, a limited liability company registered in Georgia under identification code 416396983, with its legal address at 14 Megobroba Avenue, 8th floor, apartment 27, Rustavi, Georgia.
SPHERE.ART LLC ("we", "us") is the Controller of the Personal Data described in this Privacy Policy: we decide why and how it is processed, and we answer for that processing under the Law of Georgia on Personal Data Protection (2023). Capitalised terms are defined in the Terms of Service, section 2 "Definitions".
Write to privacy@sphere.art or to our legal address about your data. Our data protection officer is Aleksandr Ivanov, director, who can be reached at privacy@sphere.art.
The following are independent Controllers, each answering for its own use of the data:
- Producers, for what they choose to record about other people in their Projects and for any use of Applications and Project data outside the Service; how the Service itself stores and processes that data is our responsibility (Casting and Hiring Terms, section 8 "Producer duties toward applicants");
- Festivals, for the Submissions they receive, once Festival submissions open (Festival Submission Terms, section 9 "Festival duties");
- Sellers, for the Buyer data they receive with an Order, once paid features open (Creator and Organizer Terms, section 11 "Buyer data and messages to Buyers");
- Flitt, a payment service of Tpay LLC (TBC Group, Georgia), for the payment details you enter on its payment page;
- YouTube, Vimeo and the other external media services listed in the Cookie Policy, section 4 "Embedded players from YouTube and Vimeo", for what their players collect when you load them.
Once paid features open, the checkout asks you to confirm that you have read this Privacy Policy. That confirmation only records that you have read it; the legal bases for processing are in section 3.
2. Data we collect
Most data comes from you. Some comes from other Users (section 2.2), from our systems when you use the Service, from SPHERIK (the Memory Profile) and, once payments open, from the Payment Processor.
| Category | What it includes |
|---|---|
| Account | Name, email address, password (stored as a hash), role, profile picture, settings, two-factor sign-in data (backup codes stored as hashes), and the Terms of Service version you accepted at sign-up, with the time |
| Profile | Stage name, crafts, genres, city and country, bio, experience, education, skills, languages, budget range, photos, showreels, audio, links, outside credits, press kit, and optional physical details (height, eye colour, hair colour) |
| Availability, rates and contacts | Availability calendar, rate cards and the contacts you add, including names and email addresses of agents, managers, press or booking contacts |
| Applications | Your pitch, link and status history, and a Producer team's internal notes on it; older self-tapes, headshots, CVs and cover letters in our archive database |
| Uploaded files | Photos, videos, audio, documents (such as scripts and contract files) and subtitles. Images up to 1.5 MB keep any metadata inside them, such as the date, camera details or a location your device added; larger images are converted, which removes it |
| Messages | Direct messages, Application threads, Project and department chats, attachments, reactions, read receipts, and the people you block or hide |
| Offers and Engagements | Inquiries, Offers and Engagement Terms (pay, dates, tasks and other terms), contract files, and the Signature Record of each signature (who signed, when, which version, a digital fingerprint of the text; no IP address or device data) |
| Project Workspace | Briefs, scripts and their original files, scenes, locations with addresses, shifts and call times, timesheets, shift cash entries (amount, method, who paid), route sheets with vehicles and drivers' names and phone numbers, passenger lists, budgets, post-production materials, tasks and comments |
| Credits and reputation | Credits on Projects, peer reviews (stars and text), endorsements, follows |
| Viewing | Where you stopped in each Film, completed views, timecoded notes and, once private Screenings open, who was invited to one and when they watched |
| Forum | Threads, posts, reactions, subscriptions and what you last read |
| SPHERIK | Your SPHERIK conversations (your messages, SPHERIK's answers and the names of attached files) and your Memory Profile |
| Notifications and email | Notifications, your email settings and copies of the emails we send you (recipient, subject and text) |
| Support, safety and Verification | Messages to our addresses and our replies; Reports; copyright Notices and Counter-notices, with the identity and contact details they contain; Moderation decisions and reasons, staff notes and action logs; Verification evidence (text, links, social media handles and posts) |
| Technical data | Server logs with your IP address, the page address and browser details; short-lived counters that limit sign-in attempts by IP address or email; error reports; and your searches, stored with your Account |
| Invitations | The email address of a person invited to a Project or Organization, who invited them, for which role, and whether they accepted |
| Seller details (once paid features open) | Legal or company name and form, registration or personal number, address, contacts, bank account and tax status, checked with the Payment Processor, including sanctions screening |
| Orders (once paid features open) | What was bought, when, the price, currency and Seller, the payment status, and the Buyer's name, address and phone number, which the Payment Processor requires (Payment Policy, section 2 "Payment Processor and payment methods") |
| Archive database | Data from before the 2026 rebuild of the Service: watchlists, fan profiles, comments and ratings, old chats, old festival submissions, past payment and referral records |
Card payments are processed by Flitt, a payment service of Tpay LLC (TBC Group, Georgia). You enter card details only on Flitt's payment page; Sphere Cinema never receives or stores full card numbers or security codes.
2.1 What you must provide
To create an Account you give your name, email address, a password and your role, and you tick a box confirming that you are 16 or older, that a Guardian agrees if you are under 18, and that you accept the Terms of Service and have read this Privacy Policy. Without these we cannot open an Account. Some features need more, such as a pitch and a link for an Application, or the details the Payment Processor asks for at checkout. Everything else, such as most profile fields, physical details, availability, rates, contacts and SPHERIK, is optional; without it, the related feature shows less or is unavailable.
2.2 Data that other Users add about you
Other Users can add data about you, for example when they credit you, invite you, review your work or put you on a call sheet. If you have an Account, you see these entries in the Service, and invitations and credits wait for you to accept them. If you have no Account, the first email from the Service, such as an invitation, says who invited you and to which Project or Organization; a link to this Privacy Policy in those emails is planned. Where we can reach you, we tell you about data others added within 10 working days, or at our first contact if that is sooner. We do not contact people who do not use the Service, such as drivers, passengers or location owners: the Producer who records their details knows them and must tell them (Casting and Hiring Terms, section 8 "Producer duties toward applicants").
3. Why we use data and our legal bases
We use Personal Data only for the purposes below, each with a legal basis under the Law of Georgia on Personal Data Protection; the same bases exist in the EU General Data Protection Regulation (GDPR).
| Purpose | Legal basis |
|---|---|
| Running your Account and profile, publishing, casting, Applications, Offers, signing, Projects and the Project Workspace, messages, the forum, watching Films, and answers from SPHERIK | Contract |
| Keeping the Memory Profile | Legitimate interests: SPHERIK's answers build on what you told it before |
| Orders, payments, receipts and Refunds, once paid features open | Contract; legal duty for tax and accounting records |
| Service emails (section 11) | Contract |
| Security, fraud prevention, sign-in limits, logs and error reports | Legitimate interests: protecting Users, Accounts and the Service |
| Checking Sellers and Festivals, sanctions screening and fraud review, once paid features open | Legal duty; legitimate interests in preventing fraud and meeting the Payment Processor's rules |
| Support, Moderation, Reports, Verification and enforcing the Legal Documents | Legitimate interests: helping you and keeping the community safe and honest; legal duty where the law requires action |
| Reporting sexual content involving Minors, threats to life and suspicious transactions to the competent authorities | Legal duty where the law requires a report; otherwise legitimate interests in protecting people from serious harm |
| Promoting the Service with public profiles, Films and trailers, including names and images (Terms of Service, section 6.2 "The licence") | Legitimate interests; you can object at any time (section 10) |
| Search logs | Legitimate interests: improving search and finding faults in it |
| Showing your Account name to a Producer who enters your exact email address | Legitimate interests: helping Producers build their team |
| Telling people about data others added, answering data requests, and handling copyright Notices and Counter-notices | Legal duty |
| Keeping records, answering courts and authorities, and establishing or defending legal claims | Legal duty; legitimate interests in legal claims |
| Marketing emails and the weekly digest (section 11), external media players (Cookie Policy), any optional field for special category data (section 4), and a transfer to the United States where Georgian law makes consent the route (section 8) | Consent |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 10).
The Memory Profile is profiling, used only to personalise SPHERIK's answers (SPHERIK AI Assistant Terms, section 3 "The Memory Profile").
We take no decision about you that is based solely on automated processing and has legal or similarly significant effects. People take Moderation, Verification and Account decisions; the forum's word filter and posting limits only hide listed words, flag posts for a moderator and slow down posting (Community Guidelines, section 8 "How we moderate").
We do not sell Personal Data and do not share it with advertising networks.
4. Sensitive data
We do not ask for special category data, such as data about health, ethnic origin, religion or beliefs, political views, trade-union membership or sex life, genetic or biometric data, or criminal records. Photos, videos, voice recordings and texts you upload can still reveal such data, so share only what you are comfortable making visible. Physical details on a Talent profile are optional. We do not use face or voice recognition to identify anyone.
Any optional field for special category data that we add will need your explicit consent in the Service, with its purpose stated, and you can withdraw that consent at any time; for a Minor, it needs a Guardian's written consent (section 5).
5. Data of minors
You must be 16 or older to have an Account, and a User aged 16 or 17 needs a Guardian's agreement; the full rules are in the Terms of Service, section 3 "Who can use the Service". People aged 16 or older can consent to the processing of their own data.
At sign-up you confirm your age and, if you are under 18, that your Guardian agrees. We do not check ages. We may ask for proof of the Guardian's agreement, for example before you take part in casting or use paid features. Accounts of people under 16 are closed when we learn of them, and their data is deleted except what we must keep.
For Minors:
- special category data is processed only with a Guardian's written consent;
- we send no direct marketing, including the weekly digest, and do no profiling for marketing. The Service does not record exact ages, so if you are under 18, tell privacy@sphere.art and we switch these emails off for your Account;
- the Minor or the Guardian can have the Memory Profile deleted at any time by writing to privacy@sphere.art;
- a Guardian can make data requests for a Minor where the law allows; for a User aged 16 or 17 we ask for the User's agreement first, unless the law provides otherwise.
Children under 16 take part in casting only through a Guardian's own Account, and the Guardian provides the child's data and consents for the child (Casting and Hiring Terms, section 11 "Minors in casting and production").
6. What other Users and the public can see
- Anyone, without signing in: published profiles, résumés and press kits (photos, showreels, credits, skills, languages, physical details you filled in, and city and country unless you hide them); your availability calendar from the start of the current month; your budget range, also shown on discovery cards; published Projects and their open roles; peer reviews (1 to 5 stars and text), which appear at once and which only moderators can hide; endorsements, follows and forum posts.
- Signed-in Users who have their own Talent profile or belong to an Organization in the Service: your rate cards.
- Your direct contacts (email addresses, phone numbers and messenger contacts): only Users you have replied to while the setting that hides them is on, as it is by default, and every visitor when it is off (Casting and Hiring Terms, section 2 "Talent profiles and contact details").
- Producers and Team Members with access: your Applications; their internal notes stay within their team. Team Members see Project Workspace data according to the access the Producer gives for each stage.
- Other participants: the inquiries, Offers, Engagement Terms and Signature Records you share, and the messages in your conversations.
- Producers building a team: the name on your Account, when they enter your exact email address, even if your profile is not published. Invitations they send by email expire after 14 days.
- Creators: view counts of their Films; once private Screenings open, the owner of a private Screening sees who was invited and who watched.
Files you upload (photos, videos, audio, documents and attachments) are stored at web addresses that anyone who has the link can open. Do not upload anything that must stay secret. To have a file removed from storage, write to privacy@sphere.art.
This covers self-tapes, headshots, contract files, chat attachments, script originals and post-production files. Deleting Content removes it from pages; the stored file stays at its address until we remove it on request.
Support and moderation staff see Account details (name, email address, sign-up date) and the Content, Reports and records they review, including copies of emails we send; every staff action is logged. Developers work with logs and a database view in which email addresses are masked, and do not sign in to the production server. Our internal test environments, on the same server, still hold copies of production data. The developers and testers who use them are bound to confidentiality, and we plan to replace these copies with test data.
7. Service providers and other recipients
These providers process Personal Data for us as Processors, on our instructions and under written terms that oblige them to keep it confidential and protected.
| Provider and location | What it does for us | Data involved |
|---|---|---|
| HOSTKEY B.V., server located in the United Kingdom | Hosts our server: the application, databases, uploaded files, logs and backups | All data in section 2 |
| Hetzner Online GmbH, Germany | Keeps an off-site copy of our database | A full database copy |
| Vercel Inc., United States | Stores and delivers media files uploaded before 4 August 2026 | Those files, and the IP address of anyone who loads them |
| OpenRouter, Inc. and OpenAI, United States | Run SPHERIK: OpenRouter passes requests to an OpenAI model | What SPHERIK sends (SPHERIK AI Assistant Terms, section 2 "AI providers and what SPHERIK sends them"); training and retention: OpenAI does not use API requests to train its models and keeps them for up to 30 days to detect abuse; OpenRouter does not keep the text of requests, because prompt logging is off in our account |
| Email delivery provider (SMTP service) | Delivers our emails | Recipient's address and name, subject and text of each email |
| Cloudflare, Inc., United States | Runs our domain name system, carries the connection to our internal log viewer and, once private Screenings open, delivers their video | Technical data, log entries that staff view, and for private Screenings the video and the viewer's IP address |
| Functional Software, Inc. (Sentry), United States | Collects error reports from our server and from your browser | IP address, page address, browser details and the details of the error |
As an independent Controller (section 1), Flitt receives payment details, the Order amount and the Buyer's name, address and phone number once paid features open. The services listed in the Cookie Policy, section 4 "Embedded players from YouTube and Vimeo" receive your IP address when their content loads: players only after you allow external media or click "Load video", and the images and tools in its section 4.2 "Content that still loads from other sites" without asking.
We also disclose Personal Data to:
- other Users, as described in section 6;
- the other side of a copyright Notice or Counter-notice, which receives the sender's name, identification number, addresses and contact details, as the Copyright and IP Complaints policy, sections 2 "How to send a Notice" and 4 "Counter-notice and restoration" set out;
- courts, law enforcement and other competent authorities when a lawful request or order requires it or the law obliges us to report, and on our own initiative to report sexual content involving Minors or a threat to someone's life or safety; we share only what that purpose needs (Legal Compliance Policy, section 5 "Cooperation with authorities and payment partners");
- our professional advisers, such as lawyers, accountants and auditors, who are bound to confidentiality;
- a company that takes over the Service, which must keep protecting the data under this Privacy Policy; we tell you before this happens.
8. Transfers outside Georgia
All live data is stored on our server in the United Kingdom, so your data leaves Georgia when you use the Service. It goes to:
- United Kingdom: our server (HOSTKEY B.V.);
- Germany: the off-site database copy (Hetzner Online GmbH);
- United States: SPHERIK requests (OpenRouter, Inc. and OpenAI), media files uploaded before 4 August 2026 (Vercel Inc.), domain name services and, when they open, private Screening videos (Cloudflare, Inc.), and error reports (Sentry);
- the country of our email provider, shown in section 7.
Transfers to countries that the State Audit Office of Georgia recognises as protecting Personal Data adequately need no further safeguard; we rely on this for the United Kingdom and Germany.
The United States is not recognised in this way. Public authorities there may be able to access data held by companies, and you may have fewer ways to enforce your rights than in Georgia or the European Union. For our providers in the United States, we rely on the data protection terms in our contracts with them, which include standard contractual safeguards. Where Georgian law makes your consent the route for a transfer, we will ask for it before the transfer and explain the risks first. You can ask privacy@sphere.art for a copy of the safeguards that apply to your data.
Using SPHERIK is your choice: the notice next to its input tells you, before you send anything, that your messages and attached files are processed by OpenAI via OpenRouter in the United States.
9. How long we keep data
We keep Personal Data only as long as we need it for the purposes in section 3:
| Data | How long we keep it |
|---|---|
| Account and profile data | While the Account exists; deleted or anonymised within 30 days after the Account is closed, except the data in the rows below |
| Messages, SPHERIK conversations, the Memory Profile and search queries | While the Account exists, or until you ask us to delete them |
| Applications and the notes on them | Until 12 months after the Casting Call closes, then deleted, unless they led to an Engagement |
| Signature Records and signed terms | For the life of the Engagement plus the limitation period for claims under Georgian law, also after the Account is closed |
| Order and payment records | As long as Georgian tax and accounting law requires |
| Buyer name, address and phone collected at checkout | At least 6 months, then as accounting law requires |
| Order history shown in the Account | At least 120 days |
| Server and access logs (IP address, URL, browser) | 30 days |
| Backups | Overwritten within 30 days |
| Marketing consent records | For the campaign plus 1 year |
| Submission data at a Festival | Until the end of that edition, at most 2 years |
| Moderation, Report, support and verification records | As long as needed for safety, Appeals and legal claims |
| Copies of emails we send | With the Account records they belong to |
| Archive database from before the 2026 rebuild (watchlists, fan profiles, comments and ratings, old chats, old festival submissions, past payment and referral records) | Deleted or anonymised by 31 March 2027, except payment records that tax and accounting law require us to keep; earlier on request |
Good to know:
- Apart from logs and backups, our staff carry out these deletions, and those you request (section 10), by hand; nothing in the second row expires on its own. Data tied to other Users' records, such as a shared Project or a signed Engagement, is anonymised.
- Nobody can edit or delete a Signature Record (Electronic Agreements and Signatures, section 7 "Copies, storage and evidence").
- Uploaded files stay at their address until removed on request (section 6); closing your Account counts as such a request, except for files other Users must keep, such as signed contract copies. Backups keep deleted data until they are overwritten.
10. Your rights
Under the Law of Georgia on Personal Data Protection you have the right to:
- Access: learn what we hold about you, why, where it came from, who receives it and for how long, and get a copy;
- Correction: have inaccurate or incomplete data corrected; you can change most profile data yourself;
- Erasure: have data deleted that we no longer need, process unlawfully or hold on a consent you withdrew, unless the law or a legal claim requires us to keep it (section 9);
- Blocking: have us stop using data, apart from storing it, while its accuracy or lawfulness is checked;
- Portability: get the data you gave us in a structured, commonly used electronic format, or have it sent to another controller where technically possible;
- Objection: object to processing based on legitimate interests, including the Memory Profile and promotion with your public profile, and to direct marketing at any time;
- Withdrawal of consent: at any time, as easily as you gave it; processing before the withdrawal stays lawful;
- Human review: have a person review any decision based solely on automated processing, and give your view and contest it.
We answer within 10 working days (Monday to Friday, except public holidays in Georgia). For a complex request we may extend this once by 10 working days and tell you why. We decide on a request to block data within 3 working days. When you withdraw consent, we stop the processing without delay, at the latest within 10 working days.
Requests are free, except that we may charge a cost-based fee for a clearly excessive request, such as repeated requests for the same copy, after telling you. If we refuse a request, we explain why in writing and tell you that you can complain to the State Audit Office of Georgia or go to court.
10.1 How to make a request
You can delete your Account yourself in Settings, Account (Terms of Service, section 4.3 "Closing your Account"). There is no self-service tool for downloading your data yet: write to privacy@sphere.art from the email address of your Account, and we answer within 10 working days.
Our staff handle each request by hand: they confirm that it comes from you (a message from your Account email usually does; otherwise we ask only for what we need to confirm the Account is yours), collect the data from our systems and reply by email, with any copy attached. A representative can act for you with your written authority, and a Guardian can act for a Minor as section 5 describes. To close your Account, follow the Terms of Service, section 4 "Your Account".
Requests about data that a Producer, Festival, Seller or Flitt holds as an independent Controller go to them; if you cannot reach them, tell us and we pass your request on. Complaints that someone used your image, voice or name without consent also go to privacy@sphere.art (Copyright and IP Complaints, section 7 "Trademarks, likeness and other rights").
11. Marketing and service emails
Service emails. We send the emails needed to run your Account: sign-up confirmation, password resets, security alerts, invitations and notices about activity that concerns you, such as new messages. You cannot switch them off while you have an Account. An email about a new direct message includes its first 240 characters, so anyone who can read your inbox can read that part, and a copy stays in our email records.
Weekly digest and marketing. We send the weekly digest of newly published Projects only to Users who switch it on, and other marketing emails, such as news about features or Sphere Paid Services, only with opt-in consent. Each of these emails names SPHERE.ART LLC as the sender, with our address, and has an unsubscribe link. Unsubscribing is free, works through that link or by writing to privacy@sphere.art, and takes effect within 7 working days. We keep consent records for the campaign plus 1 year. Advertising and Promotion in the Service are labelled (Community Guidelines, section 6 "Advertising and Promotion").
12. Security and data breaches
We protect Personal Data with technical and organisational measures suited to the risk. Account protections are described in the Transaction Security Policy, section 3 "Account protection".
Messages are encrypted while stored on our servers. The Service holds the key and decrypts messages to deliver and show them, so this encryption protects stored copies and backups. Remember that anyone who has the link to an uploaded file can open it (section 6).
If a personal data breach occurs, we report it to the State Audit Office of Georgia within 72 hours of becoming aware of it, unless it is unlikely to cause significant harm. If a breach is likely to put you at high risk, we tell you without undue delay what happened and what you can do. Sellers and Festivals must report incidents to us within 48 hours (Creator and Organizer Terms, section 11 "Buyer data and messages to Buyers"). To report a suspected breach, write to privacy@sphere.art.
13. Cookies
We use only the cookies and browser storage needed for sign-in, security and your settings, and players from YouTube and Vimeo load only after you allow them. The Cookie Policy lists each item and explains how to change your choice.
14. Complaints to the State Audit Office
You can first write to privacy@sphere.art, and we will try to put things right. You can also complain to the State Audit Office of Georgia, which supervises personal data protection, or go to court. If you live in the European Union, you can also contact the data protection authority of your country.
15. Changes and contact
We may update this document. We tell you about material changes by email and in the Service at least 14 days before they take effect, and at least 30 days before for changes to Seller fees, Payouts or selling rules, as set out in the Terms of Service, section 15 "Changes to the Service and the Legal Documents". Earlier versions of this document are available on request at legal@sphere.art.
Contact: privacy@sphere.art, or by post to SPHERE.ART LLC, 14 Megobroba Avenue, 8th floor, apartment 27, Rustavi, Georgia. Company details: Company Details.