Privacy_

What we store

• Clients. Your first name, your phone number, and — if you give it — your email. We also record whether your first mission has been used.
• Agents. A codename, real name, phone number, and the two identity-check images an agent uploads to be approved: a photo of their ID and a selfie. We keep their rating and how many missions they have completed.
• Missions. What you asked for, the style, the city and any “where to find me” note, the timestamps of each step, your budget and any tips or unlocked extras, and any rating or review you leave.
• Handshake recordings. Your consent video and your agent’s introduction video, timestamped onto the mission record.
• Photos. The edited photos your agent delivers for your mission. Your agent may use a few of them in their personal portfolio, and City Slick Bureau may feature one on its homepage as a Photo of the month, only if you ticked that box on the pay screen — it is off unless you tick it.
• Payments. A record of each transaction — the amount, the status, and Stripe’s identifiers. Card numbers never reach City Slick Bureau. Payment details are entered on Stripe’s own pages and handled entirely by Stripe.
• Sign-in. Agents and operators sign in with Google. We receive the email address Google verifies, and nothing else from your Google account.

How it’s kept

Photos and Handshake videos are stored privately. They are never public: each one is shown only through a short-lived link we generate after checking who is asking. Mission records and delivered media are kept for the running of the service; you can ask us to delete them (see your rights below).

When you delete your account, your photos, your consent videos and any Photo of the month taken from your deliveries are removed, and your name, phone and email go with them. Two things stay: the payment record of each mission, as our accounting record; and each mission’s chat messages with its sealed chat transcript, kept for 5 years, because we need them to establish or defend a legal claim about a shoot (our legitimate interest — GDPR Art. 6(1)(f) and Art. 17(3)(e)). A Photo of the month showing you that did not come from your deliveries is taken down when you ask us.

Who else processes it

We use a small number of sub-processors to run the service. Each handles only what it needs to:

• Vercel — hosting.
• Supabase — database and photo/video storage.
• Stripe — payments.
• Google — sign-in for agents and operators.
• Meta / WhatsApp — messages between you and the bureau.

Your rights

Under the GDPR you can ask us to show you the data we hold about you, correct it, delete it, hand it over in a portable form, or restrict and object to how we use it. You can also complain to a supervisory authority — in France, the CNIL. To exercise any of these, email rayanmaacha@gmail.com.

The data controller is Rayan Maacha. You can reach us at rayanmaacha@gmail.com.