Privacy Policy
Effective date: 18 July 2026
indstry (“we”, “us”, “our”) operates a platform connecting creative professionals with work and with each other. This privacy policy explains how we collect, use, store, and share your personal data when you use our website, applications, and services (collectively, the “Platform”).
We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. What We Collect
- Account data: your email address, password (stored only as a secure hash by our authentication provider), and, if you add one for notifications, your phone number.
- Profile and portfolio data: your name, photo, professional roles, location, biography, links, and the images, showreel videos, and other work you choose to upload.
- Professional network data: connections you make, recommendations and vouches you give or receive, and referrals when you join via another member’s shared link. This information is visible to other members according to the Platform’s trust and visibility rules.
- Jobs and work data: job posts you create, applications you make, messages you exchange with other members, and the terms of engagements you record on the Platform.
- Location search data: when you type a location into a location field, the text you type is sent to Google’s Places service (via our server) to suggest matching places.
- Technical data: IP address and basic request information, used for security, rate limiting, and error diagnosis; and, only if you consent, product analytics events (see section 4).
2. How We Use Your Data
- To operate the Platform: showing your profile and work to other members, powering search and discovery, delivering messages, and recording engagements (performance of our contract with you).
- To send you service emails such as new-message notifications and reminders about items awaiting your action. You can change or switch off notifications in your account settings.
- To keep the Platform secure and diagnose errors (our legitimate interest in running a reliable, safe service).
- To understand how the Platform is used, only if you consent to analytics (see section 4).
We do not sell your personal data, and we do not share it with advertisers. We do not use automated decision-making that produces legal or similarly significant effects about you.
3. Third-Party Data Processors
We share personal data with the following processors, each providing a specific service to us:
| Processor | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage — holds your account, profile, network, jobs, and messages data |
| Vercel | Application hosting and delivery (served from London, UK) |
| Cloudflare | Image storage, resizing, and delivery for photos and other images you upload |
| Mux | Video hosting, encoding, and streaming for showreels you upload; when a showreel plays, the viewer’s browser fetches the stream directly from Mux |
| Postmark | Transactional email delivery (e.g. message notifications, reminders) |
| Sentry | Error monitoring and diagnostics |
| Upstash | Rate limiting to protect the Platform from abuse — briefly processes request identifiers (such as IP address) in counters that expire automatically within minutes |
| PostHog (EU) | Product analytics — only after you accept analytics via our consent banner, and only pseudonymous event data (never your name, email, or phone) |
| Google (Places) | Location autocomplete — receives only the location text you type, relayed via our server |
| Google (Sign-in) | Optional “Sign in with Google” — used only if you choose to sign in with a Google account |
| Meta (WhatsApp) | WhatsApp notifications — only if you opt in to WhatsApp as your notification channel; receives your phone number and the notifying message’s sender name |
Our public pages load fonts from Google Fonts, which means your browser requests those font files directly from Google and Google receives your IP address as part of that request.
Some of these providers process data outside the UK. Where that happens, transfers rely on UK adequacy decisions or appropriate safeguards such as the UK International Data Transfer Agreement / Addendum.
4. Analytics and Consent
We use PostHog (hosted in the EU) to understand how the Platform is used. Analytics runs only after you accept it through our consent banner — nothing is tracked, and no analytics cookie is set, before you choose. Declining has no effect on your use of the Platform.
When enabled, analytics events carry a pseudonymous account identifier only. We do not send your name, email address, phone number, or free-text content to analytics.
Your choice is stored for six months, after which the banner will ask again. To change your choice sooner, contact us at privacy@indstry.id or clear this site’s cookies in your browser, which resets the banner.
5. Cookies
We use the following cookies:
| Cookie | Type | Duration | Purpose |
|---|---|---|---|
| sb-* | Essential | Session | Authentication and session management (Supabase Auth) — keeps you signed in |
| aw_consent | Essential | 6 months | Remembers your analytics consent choice (accept or decline) |
| aw_ref | Essential | 30 days | Referral attribution — when you arrive via a member’s shared card, records which member shared it so joining can credit them |
| aw_ref_rec | Essential | 30 days | Recommendation token — set only when you follow a member’s explicit “recommend to join” link |
| ph_* | Analytics | Up to 12 months | PostHog product analytics — set only after you accept analytics via the consent banner |
6. Data Retention
We retain your personal data for the following periods:
| Data Category | Retention Period |
|---|---|
| Account and profile data | For as long as your account exists; removed within 30 days of a verified deletion request |
| Portfolio content and media | Until you delete it, or removed as part of account deletion |
| Jobs, applications, and engagement records | For as long as your account exists; removed or anonymised on account deletion |
| Messages | Retained in the conversation for as long as the thread exists; your identity is removed from threads on account deletion |
| Early-access waitlist data | Held while the early-access programme remains open; deleted on request at any time |
| Analytics data | Held in PostHog per its standard retention; events are pseudonymous |
| Error logs and diagnostics | 90 days |
Some data may be retained beyond these periods where required by law or to establish, exercise, or defend legal claims.
7. Your Rights
Under the UK GDPR, you have the right to:
- Access your personal data and request a copy of it.
- Rectify inaccurate or incomplete personal data. You can edit your profile and portfolio directly in the app at any time.
- Erase your personal data (“right to be forgotten”). To delete your account, email privacy@indstry.id from your account email address; we will verify the request and complete deletion within 30 days.
- Restrict processing of your personal data in certain circumstances.
- Object to processing based on legitimate interests.
- Data portability — receive your data in a structured, commonly used format.
To exercise any of these rights, contact us at privacy@indstry.id. We aim to respond within one month.
Contact Us
If you have questions about this privacy policy or wish to exercise your data protection rights, please contact us at privacy@indstry.id.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been violated.