Privacy Policy

Version 1.0. Effective upon acceptance.

This Privacy Policy explains how mjonesone, LLC, a California limited liability company doing business as ICONS ("ICONS", "we", "us", "our"), collects, uses, discloses, retains and protects personal information when you use the ICONS marketplace at iconsai.com and our related apps and APIs (the "Service"). It applies to every User, including Talent, Authorized Users of a Brand or Agency, and visitors who do not create an account.

This Privacy Policy is part of the Terms of Service. Capitalized terms not defined here have the meanings given in the Terms. Identity verification is also covered by the more specific Identity and Biometric Privacy Notice and Consent, which controls if it conflicts with this Privacy Policy on identity or biometric data.

1. Summary

• We collect what we need to build your profile, verify that you are an adult who controls the accounts and Likeness you offer, run Bookings, pay people and keep the Service safe.
• Public social data is imported through a third-party provider, Apify, from public sources only. Imported data is treated as unverified until you confirm it.
• Identity and biometric data (your identity challenge video and government ID) are collected only when you activate paid work, only with your written consent, through a specialist identity provider, and are destroyed on a published schedule.
• Payment card and bank details are handled by our payment Processors. We do not store raw card numbers or bank account numbers.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• We do not use your Likeness, photographs or voice to train general AI models.
• The Service is for adults only. We do not knowingly collect personal information from anyone under 18.

2. Information we collect

We collect the categories of personal information below. Not every category applies to every User; for example, a Brand's Authorized User will not provide identity video.

2.1 Account and contact information

Your email address, which is your sign-in identity. We sign you in with a single-use link or a six-digit code that expires after 10 minutes; we do not use passwords. If you choose to sign in with Google, we receive your name, email address, Google account identifier and profile image. We also collect any display name, phone number or contact details you add, and your communication preferences.

2.2 Social account and public profile information

When you paste social links at signup or later, we record the links and handles you submit and the attestation you accept. We then import publicly available information about those accounts through Apify, a third-party data extraction provider, using approved tools for each platform. This can include display name, public handle and account identifier, public biography, avatar, public website links, public category, public follower and post counts, public post counters (such as views, likes and comments on recent public posts) and candidate public images. We record where each value came from, which tool and provider run produced it and when it was observed.

We import only public information. We never ask for your social media passwords or cookies, and we do not collect private messages, subscriber lists, paywalled content, contact lists or login-only analytics. Some platforms, including OnlyFans, are imported only on a best-effort basis where public access is permitted. If you connect an account through a platform's official authorization, we receive only the data that platform authorization covers, and we store the access token encrypted.

Imported data is an observation, not proof. It does not verify your identity, your ownership of an account, copyright in an image or private reach.

2.3 Profile, rates and business settings

Information you add or confirm in your profile: biography, category, country, languages, services, production modes, rate card, restrictions (for example, excluded categories or limits on voice or body depiction), approval preferences, agency representation and availability. For Organizations, we collect legal business name, display name, website, business email, address, category, authorized signatory, agency license information where applicable, and the members and roles of the Organization.

2.4 Images, video and other content

Portfolio images you select or upload for public display; private reference photographs you upload for a specific production Booking; scripts, storyboards, previews, Deliverables and Approved Final Assets; Brand materials such as logos, product images and music; messages and comments in campaign rooms; and posting evidence such as publication URLs, screenshots, captions and disclosures. We remove image metadata (such as location data embedded in photos) during processing.

2.5 Identity and biometric information

When you activate paid work as Talent (or earlier if we reasonably suspect fraud or misuse), we ask you to complete identity verification. This involves a single-use challenge code valid for 10 minutes, a 20 to 45 second video of you saying or showing the code, and an image of a government-issued photo ID. Our identity provider may extract a facial geometry template from the video and ID photo to compare them and check liveness ("Biometric Data"). We, or the provider, also receive your legal name, date of birth, ID document details and the verification result. This information is "sensitive personal information" under California law and may be "biometric information" or a "biometric identifier" under the laws of Illinois, Texas, Washington and other states. Section 7 explains how we handle it.

2.6 Payment, payout and tax information

Brands pay through our Processors. Talent and Agencies receive payouts through connected accounts with our Processors. Processors collect card numbers, bank account details, tax identification numbers, identity documents required for know-your-customer checks, and tax forms. We do not store raw card or bank account numbers. We receive from Processors limited information such as account status, the last four digits of a card or account, payout eligibility, transaction identifiers, amounts and dispute status. We keep our own ledger of charges, allocations, transfers, refunds and disputes.

2.7 Booking and transaction information

Requests, proposals and counteroffers, Quotes and Quote Hashes, Contract Packets, typed-name signatures and acceptance evidence (time, IP address, user agent, the checkbox text you accepted and the version and fingerprint of each document), approvals, change orders, Rights Manifests, distribution orders and outcomes.

2.8 Usage, device and log information

When you use the Service we automatically collect IP address, browser and device type, operating system, pages and actions, timestamps, referring URLs, request identifiers, error logs and approximate location derived from IP address. We use a first-party session cookie that keeps you signed in and protects your session. We do not use third-party advertising cookies or cross-site tracking pixels.

2.9 Communications

Emails and in-app notifications we send and receive, support requests, complaints, takedown requests and feedback.

2.10 Inferences

We derive limited inferences such as recommended rates, audience estimates based on public post history, and fraud or risk signals. We do not infer your age, ethnicity, health, sexual orientation or other sensitive characteristics from your appearance or from imported data.

3. Sources of information

• You, when you sign up, build your profile, upload content, communicate or transact.
• Public sources, through Apify, when you submit social links.
• Social platforms, if you connect an account through official authorization.
• Other Users: an Agency may draft a roster entry with your name, email and handles before you claim it (it remains unpublished until you verify and consent); a Brand may upload materials or enter information about a Booking.
• Identity providers, which return verification results and, where applicable, Biometric Data processing results.
• Processors, which return payment, payout, tax-form and dispute information.
• Google, if you use Google sign-in.
• Automatically, from your device and use of the Service.

4. How we use information

We use personal information to:

1. Create and secure your account, sign you in and authenticate sensitive actions (such as payout changes, which require step-up authentication).
2. Build and display your profile draft, show source and freshness for imported values, and let you confirm, edit or remove them.
3. Recommend rates and estimate audience from public history, with sources and confidence shown. Recommendations are advisory and never change your rates without your explicit acceptance.
4. Operate discovery, requests, negotiation, Quotes, Contract Packets, signatures, Production, review, Distribution, verification of posts and reporting.
5. Verify identity, age and authority before paid work, and verify Organizations and their signatories.
6. Process payments, allocations, Holdbacks, transfers, refunds, disputes, statements and tax reporting through Processors.
7. Provide support, send transactional notices and respond to complaints and takedown requests.
8. Detect, investigate and prevent fraud, impersonation, unauthorized Likeness use, abuse and violations of the Acceptable Use and AI Content Policy.
9. Maintain audit records of consents, approvals, signatures and financial changes.
10. Analyze aggregate Service performance (for example, how long imports take or how often recommended rates are edited) to improve the Service.
11. Comply with law, enforce our agreements, and establish, exercise or defend legal claims.

We do not use your Likeness, photographs, voice, private reference images, identity video or Biometric Data to train general AI models, and we do not create reusable likeness models, fine-tuned models, embeddings or voice models of you unless you give separate, explicit written consent for a specific purpose. Private reference images are used only to deliver the specific Booking for which you provided them.

We send marketing email only where permitted and you can opt out at any time. Transactional and legal notices are not marketing.

5. How we disclose information

We disclose personal information only as described here.

5.1 Service providers

We use service providers who process personal information on our behalf under written contracts that restrict their use of it to providing services to us:

Production vendors receive only the reference assets and instructions authorized for the specific Booking, under terms that prohibit training general models on them. We record each vendor's deletion status.

5.2 Other participants in a Booking

The Service is a marketplace, so some information is shared with the other side of a Booking as needed. Brands see your public profile, rate card, the Booking scope, approved previews and Deliverables, posting evidence and metrics you have made visible. Agencies you have authorized see what your Representation Grant permits. We never disclose your identity evidence, date of birth, legal name (except where a signed contract requires the legal name of a party), private reference images, payout details or private analytics to a Brand or Agency. Agency finance users never see identity video.

5.3 Public information

Your public profile, including selected portfolio images, display name, category, platforms, rates and badges, is visible to the public once you choose to publish it. Do not include information in your public profile that you want kept private.

5.4 Legal, safety and corporate transactions

We may disclose information if we believe in good faith it is required by law, subpoena or court order; to protect the rights, property or safety of ICONS, Users or others; to investigate fraud or unauthorized Likeness use; or in connection with a merger, acquisition, financing or sale of assets, subject to this Privacy Policy or equivalent protections.

5.5 With your direction

We disclose information when you direct us to, for example when you connect an Agency or approve sharing private metrics with a specific Brand.

5.6 No sale and no sharing for cross-context behavioral advertising

We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. We have not done so in the past 12 months. We do not sell or share the personal information of anyone under 16, and the Service is not available to anyone under 18. We do not license or sell identity datasets, Biometric Data or Likeness datasets to anyone.

6. Retention

We keep personal information only as long as needed for the purposes described, subject to legal holds, open disputes, active Bookings and stricter legal or provider requirements. Our default retention periods are:

Copies distributed to Brands, posted publicly or held by vendors are governed by the applicable agreements. We record vendor deletion status but cannot technically recall copies already distributed, and we do not promise technical "unlearning" a provider cannot deliver.

7. Biometric data

7.1 What we collect and why

Biometric Data consists of facial geometry and liveness signals derived from your identity challenge video and the photo on your government ID. We and our identity provider use it only to confirm that you are a real, live adult, that you match your ID, and that you are the person who controls the Likeness offered for Booking. We do not use Biometric Data for marketing, advertising, profiling, emotion analysis or AI training, and we do not use it to generate content.

7.2 Written consent

We collect Biometric Data only after you receive the Identity and Biometric Privacy Notice and Consent and give written consent by typing your full name and checking the consent box. You may decline; if you do, we cannot verify you and you cannot be Bookable for paid work.

7.3 No sale or profit

We do not sell, lease, trade or otherwise profit from Biometric Data. We do not disclose it except to our identity provider acting on our behalf, where you consent, where required by law or valid legal process, or to complete a transaction you request.

7.4 Retention and destruction schedule

We permanently destroy Biometric Data, and require our identity provider to destroy it, at the earliest of: (a) when the initial purpose of collecting it has been satisfied (the verification decision is final and any related dispute is resolved); (b) 3 years after your last interaction with ICONS; or (c) any shorter period required by applicable law. Under our defaults, the challenge video is deleted 30 days after the verification decision, and facial templates held by the provider are deleted within the provider's retention period, not to exceed the limits above. If verification must be repeated, we collect new data under a new consent.

7.5 Protection

We store, transmit and protect Biometric Data using a reasonable standard of care within our industry, in a manner at least as protective as how we protect other confidential and sensitive information. Access is limited to designated identity reviewers.

8. Sensitive personal information

Sensitive personal information we may collect includes government ID details, account login credentials (sign-in codes), financial account information held by Processors, Biometric Data, and precise information about you contained in identity evidence. We use and disclose sensitive personal information only for purposes permitted by California Civil Code section 1798.121 and its regulations: to provide the Service you request, verify identity and age, prevent fraud and security incidents, ensure safety, comply with law, and perform services on our behalf. We do not use it to infer characteristics about you. Because of this, the right to limit use of sensitive personal information does not apply, but you may still contact us with questions.

9. Notice at collection and your California privacy rights

This section is our notice at collection for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). It also describes the information practices that apply to Users in other states.

9.1 Categories collected in the past 12 months

We collect these categories for the purposes in Section 4, from the sources in Section 3, and keep them for the periods in Section 6. We do not sell or share any category.

9.2 Your rights

Subject to exceptions in the law, California residents have the right to:

• Know and access the categories and specific pieces of personal information we collected about you, the sources, purposes and the categories of recipients.
• Delete personal information we collected from you. Some records must be retained, for example signed contracts, financial records and records needed to complete an active Booking or defend legal claims.
• Correct inaccurate personal information. You can correct most profile information yourself.
• Opt out of sale or sharing. We do not sell or share, so there is nothing to opt out of, but we honor Global Privacy Control signals as a valid opt-out request.
• Limit use of sensitive personal information beyond permitted purposes. We do not use it beyond permitted purposes.
• Non-discrimination. We will not deny you service, charge you a different price or provide a different quality of service because you exercised a privacy right. Some deletion requests may mean we can no longer provide a Service that requires that information.

9.3 How to exercise your rights

Email privacy@iconsai.com from the email address on your account, or use the account and privacy settings in the Service. We will confirm receipt within 10 business days and respond within 45 days, or tell you if we need an additional 45 days.

To protect you, we verify requests by confirming control of the email on your account through a sign-in code, and for requests involving sensitive or identity information we may require additional verification proportionate to the risk. We will not ask for more information than necessary, and we use verification information only for that purpose.

You may use an authorized agent. We will require the agent to provide your signed permission, and we may ask you to verify your identity directly and confirm that you gave the agent permission, unless the agent holds a valid power of attorney under California Probate Code sections 4000 to 4465.

9.4 Other states

Residents of other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon) may have similar rights to access, correct, delete and obtain a copy of personal information, and to opt out of targeted advertising, sale and certain profiling. We do not engage in targeted advertising, sale or profiling with legal or similarly significant effects. To make a request, use the method in Section 9.3. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy appeal"; we will respond within the time the law requires, and if the appeal is denied you may contact your state attorney general.

9.5 Shine the Light

We do not disclose personal information to third parties for their own direct marketing purposes.

10. Google API Services and Limited Use

If you sign in with Google, we receive only basic profile information: your name, email address, Google account identifier and profile image. We use it only to authenticate you and to set up your account. ICONS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or when aggregated and de-identified for internal operations.

11. Your choices and controls

• Profile: edit, hide or remove imported fields and images; hide a platform; pause bookings; unpublish your profile.
• Connections: disconnect a connected social account at any time; we delete the access token immediately.
• Agencies: revoke future agency authority at any time; signed obligations are preserved.
• Communications: unsubscribe from non-essential email using the link in the email.
• Account closure: close your account in settings or by emailing privacy@iconsai.com. Your public listing is removed and eligible private assets are deleted under Section 6.
• Cookies: the session cookie is necessary to sign in; blocking it prevents sign-in.

12. Children

The Service is only for adults 18 and older. Every Talent must be verified as an adult before paid work, and minors may not appear in any content on the Service. We do not knowingly collect personal information from anyone under 18. If we learn we have collected personal information of someone under 18, we will delete it and close the account. Contact privacy@iconsai.com if you believe a minor has used the Service or appears in content.

13. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, encryption of OAuth tokens with a managed key, private storage that is not publicly enumerable, short-lived signed links to private files, file scanning, separated storage for portfolio, identity, private reference and campaign files, role-based access limited to people who need it, hashed sign-in tokens, step-up authentication for payout changes, rate limits and audit logging. No system is perfectly secure. If a breach of security affects your personal information, we will notify you and regulators as required by law.

14. International users and data location

The Service is a United States pilot. We store and process personal information in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored and processed in the United States, where data protection laws may differ from those in your country.

15. Sandbox Mode

While the Service runs in Sandbox Mode, nothing is charged or paid and signatures are test records. We still protect sandbox data under this Privacy Policy. Synthetic demonstration data is labeled and kept separate from real accounts.

16. Changes to this Privacy Policy

We may update this Privacy Policy. Each version has a version number. If we make material changes, we will notify you by email or in the Service before the change takes effect and, where required by law, ask for your consent. Your consents are recorded against the version you accepted. Material changes to how we use Biometric Data or Likeness will not apply to you without your consent.

17. Contact

Questions, requests or complaints about privacy:

• Email: privacy@iconsai.com
• Legal notices: legal@iconsai.com
• Support: hello@iconsai.com
• Mail: mjonesone, LLC, Los Angeles, California. A full mailing address for legal notice is available on request at legal@iconsai.com.