Legal

Privacy Policy

Last updated: September 9, 2026. This Privacy Policy should be read together with our Terms & Conditions.

This Privacy Policy describes how OFM Agencies ("we," "us," or "our"), acting as data controller, collects, uses, discloses, and retains personal data in connection with your registration and use of the verification platform located at ofmagencies.com (the "Platform"). By submitting personal data to the Platform, you acknowledge that you have read and understood this Policy. Capitalized terms not defined herein have the meaning given to them in our Terms & Conditions.

1. Categories of Personal Data We Collect

1.1 Identity and Verification Data

When you initiate identity verification, our processor, Didit, collects and processes government-issued identification documents, a live biometric (facial liveness) capture, and the resulting match, authenticity, and liveness determinations. This data is generated and primarily retained by Didit under its own privacy practices; we retain only the resulting status (approved, declined, or pending), a session identifier, and associated timestamps.

1.2 Registration and Contact Data

Legal or trade name, representative full name, country of residence, languages spoken, Telegram username, WhatsApp number, Instagram handles (personal and agency-affiliated, with any privacy preferences you configure), and, where applicable, corporate registration details (legal company name, jurisdiction of incorporation, registered address).

1.3 Financial Self-Disclosures

Self-reported gross-earnings range for the preceding month, self-selected traffic-source categories, and the date such disclosures were last updated. We do not collect bank account numbers, payment-card data, or tax identification numbers through the onboarding wizard.

1.4 Evidence Materials

The video recording you upload as proof of reported earnings, together with its upload timestamp and any rejection determination and stated reason recorded by an administrator.

1.5 Technical and Account Data

Authentication events (one-time email codes and their issuance/verification timestamps), account identifiers, IP address and coarse device/browser metadata captured by our hosting and security infrastructure, and records of administrative actions taken on your Account (approvals, rejections, resubmission requests, and internal notes).

2. Sources of Personal Data

We collect personal data directly from you through the onboarding wizard and your ongoing use of the Platform, from our identity-verification processor as described in Section 1.1, and, in connection with a Dispute, from a reporting Model, Creator, or their representative (which may include personal data about you that you did not yourself submit, such as screenshots of communications or payment records).

3. Purposes and Legal Bases for Processing

Depending on your jurisdiction, we process your personal data on the following legal bases:

• Performance of a contract — to create and administer your Account, perform identity verification, and operate your Public Profile, as necessary to provide the Platform to you.
• Legitimate interests — to prevent and investigate fraud, misrepresentation, and abuse of the Platform; to respond to and facilitate the resolution of Disputes reported by Models or Creators, including through the disclosures described in Section 5; to secure our infrastructure; and to enforce our Terms & Conditions. Where we rely on legitimate interests, we have considered and balanced this interest against your data protection rights, and consider that the protection of Models and Creators from potential fraud, and the integrity of the verification directory as a whole, justifies this processing.
• Legal obligation — to comply with applicable law, respond to lawful requests from public authorities, and retain records as required by law.
• Consent — for optional disclosures you configure yourself, such as displaying an unobscured personal Instagram handle, and for any processing for which we are required by applicable law to obtain your specific consent.

4. Public Disclosure Through the Verification Profile

Certain categories of your data — including your Public Profile handle, verification status, self-reported earnings range and its as-of date, submitted traffic sources, agency-affiliated Instagram handle, Telegram username, WhatsApp number, and, unless you elect to obscure it, your personal Instagram handle — are displayed on a publicly accessible Public Profile as described in Section 3.4 of our Terms & Conditions. This disclosure occurs automatically upon completion of the relevant onboarding step and is a core, non-optional feature of the Platform; if you do not wish for this data to be publicly disclosed, you should not complete registration.

5. Disclosure to Models and Creators in Connection with Disputes or Suspected Fraud

Beyond the Public Profile, and as a distinct and material processing activity that you specifically acknowledge by accepting our Terms & Conditions, we may disclose your Registration Data, Verification Data, Evidence Materials, contact information, and Account history to a Model, Creator, or their authorized representative who reports a Dispute concerning you, and to law enforcement, regulators, payment processors, or our professional advisors, on the terms and for the purposes set out in Section 7 of our Terms & Conditions, which is incorporated into this Policy by reference. We consider this disclosure necessary for our legitimate interest, and that of the Model or Creator community the Platform is designed to protect, in enabling victims of suspected fraud or contractual breach to pursue recourse. This processing activity is not conditioned on, and is not precluded by, any prior request you may have made to restrict, object to, or delete your data, except to the extent such restriction, objection, or deletion request is upheld by a competent supervisory authority or court with binding effect on us.

6. Service Providers and Other Recipients

We share personal data with the following categories of recipients, acting as processors or independent controllers as indicated:

• Identity verification. Didit, which performs document and liveness verification as an independent controller with respect to the identity documents and biometric data it processes, subject to its own privacy notice.
• Hosting, database, and file storage. Supabase, which stores Registration Data, Verification Data status, and Evidence Materials on our behalf as a processor.
• Application hosting. Vercel, which hosts the Platform's web application and processes technical/log data as a processor.
• Transactional email. Resend, which delivers one-time authentication codes and status-notification emails on our behalf as a processor.

We do not sell personal data, as that term is defined under applicable law, and we do not share personal data with third parties for their own independent marketing purposes.

7. International Data Transfers

Our service providers may process personal data in countries other than your country of residence, including the United States. Where required by applicable law, we rely on appropriate safeguards, such as standard contractual clauses or an adequacy determination, to govern such transfers.

8. Data Retention

1. We retain Registration Data, Verification Data status, and Evidence Materials for as long as your Account remains active.
2. Following account deletion, we retain a minimum record set — comprising, at minimum, your Registration Data, the final Verification Data status, and any Evidence Materials relevant to a reported or reasonably anticipated Dispute — for as long as necessary to comply with a legal obligation, resolve a Dispute, or defend a legal claim.
3. Deletion of your Account removes your Public Profile from public accessibility but does not, by itself, trigger deletion of the minimum record set described above.

9. Data Security

We employ administrative, technical, and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls restricting Evidence Materials to your own Account and to administrative personnel on a need-to-know basis, and reliance on infrastructure providers that maintain independent security certifications. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your Rights

Subject to applicable law and the exceptions described in Sections 5 and 8, you may have the right to: request access to the personal data we hold about you; request correction of inaccurate data (which you may generally do directly through your Account while your profile remains editable); request erasure of your data; request restriction of, or object to, certain processing; request portability of data you have provided to us; and withdraw any consent you have given, without affecting the lawfulness of processing before withdrawal. Where you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority. Where you are a California resident, you have rights under the California Consumer Privacy Act, as amended, including the right to know, delete, and correct your personal information and to opt out of any "sale" or "sharing" of personal information, to the extent applicable to our processing. To exercise any of these rights, contact us as described in Section 13.

11. Children's Privacy

The Platform is not directed to, and we do not knowingly collect personal data from, individuals under the age of eighteen (18). If we become aware that we have collected personal data from a person under eighteen (18), we will take reasonable steps to delete such data.

12. Changes to This Policy

We may update this Privacy Policy from time to time by posting the revised version at this URL and updating the "Last updated" date above. Material changes will, where practicable, be communicated to registered Agencies and Managers by email.

13. Contact

Questions regarding this Policy, or requests to exercise your data protection rights, may be directed to privacy@ofmagencies.com.