Privacy Policy

OPAH App Privacy Disclosure

This first-party summary describes the data flows used by the OPAH web and mobile products. It supplements the Termly Privacy Policy below; the Termly policy remains the governing policy. Effective/version date: 2026-10-15-v1.

Information we collect and use

• Account, authentication and legal records: email, login/provider identifiers, profile and role information, session/security records, terms and privacy acknowledgments, support and transaction records.
• Location: optional precise foreground device location, only while using the mobile app, to center the talent map and find nearby talent. It is used on your device and is not sent to OPAH's servers. The map is provided by Google Maps, which receives your device's IP address, device and browser details, and the map area you are viewing, under Google's own privacy policy. A profile city/state and project location can be entered instead; these are not a substitute claim that precise location is always collected.
• Photos, videos and files: media selected through the photo picker or document picker for profiles, portfolios, inspiration boards and project deliverables. Shared project media is made available to the project participants and authorized operations staff as needed for the service.
• Messages and safety: chat and project messages, support requests, safety reports, blocks and moderation outcomes are processed to provide communication, investigate abuse and enforce our rules.
• AI processing: messages, CreateChat requests and media you add are sent to OpenAI. See How OPAH uses AI below.
• Payments and payouts: Stripe processes payment details, transaction information, Connect payout information and KYC/identity information for payment authorization and capture, held-for-settlement balances, refunds, Connect transfers, payouts, disputes/chargebacks and KYC. OPAH does not ask the app to store raw card numbers.
• Address: talent accounts provide a street address, city, state and ZIP code, on the website and in the mobile app, so clients can find talent by area and Stripe can verify payout accounts. The street address is never shown to clients: the talent map places a pin at an approximate point near the center of the ZIP code (or the city, when there is no ZIP), not at the street address.
• Date of birth and phone number: talent accounts provide a date of birth and phone number, on the website and in the mobile app, so Stripe can verify payout accounts. Neither appears on a public profile. Clients and talent may also add a phone number to their account.
• Text messages: if you provide a phone number and agree to text notifications, we record your consent (the number, the wording shown, when you chose, and the IP address and app or browser details at that moment). Twilio delivers text messages, and replying STOP withdraws consent.
• Email: SendGrid delivers account, verification, project and notification emails. We may also email businesses found through public sources about our services; every such message includes an unsubscribe link and unsubscribed addresses are not contacted again.
• Addresses, maps and weather: address text you type while entering your address or a shoot location is sent to Google Places for suggestions, and a project's location (as you entered it, or as coordinates derived from it) may be sent to OpenWeather to show a forecast.
• Hosting and storage: the service runs on Render, and uploaded photos, videos and files are stored in Google Cloud Storage.
• Push notifications: the mobile app may collect Expo push tokens and the platform's APNs/FCM delivery identifiers to send requested project and account notifications.
• Diagnostics: Sentry receives crash and performance diagnostics. PII scrubbing is applied before events are sent, but diagnostic records can still contain technical context needed to troubleshoot.
• Web-only analytics and cookies: Google Analytics and cookies may be used on the website for measurement, security and session functionality, and Google reCAPTCHA may check website forms for abuse. These web tools are not used by the native mobile app.

How OPAH uses AI

OPAH shares some of your personal data with OpenAI, a third-party AI service, to run the product. You agree to this when you create an account, as part of agreeing to these policies. What is sent, and why:

• Messages: every message you send in a project conversation is screened by OpenAI's moderation service, to keep conversations safe and enforce the Acceptable Use Policy. This applies to every account.
• CreateChat: what you type into CreateChat, and any reference images or PDFs you upload to it, is sent to OpenAI so it can understand your request, suggest talent and draft project documents such as treatments and shot lists.
• Inspiration boards: images you add to a board, and the cover image of each video, are sent to OpenAI to describe them and build the search data used for visual search and talent matching.
• Talent portfolios: portfolio photos and video frames are sent to OpenAI to analyze style, lighting and mood for a talent's Creative DNA and for matching.

Content you send can include personal data, such as names or contact details you type and people who appear in photos. OpenAI processes it as a service provider to provide these features; OPAH stores the results (descriptions, moderation outcomes and search data) with the content they came from. OPAH does not sell this data. If you don't want your content processed this way, don't create an account; you can delete an existing account at any time (Settings → Delete account in the app, or opahnow.com/delete-account).

Retention, deletion and choices

We retain information while needed for the service, safety, dispute resolution, legal/accounting obligations and auditability. You can request account deletion in the app (Settings → Delete account) or on the web at opahnow.com/delete-account. Once a request is confirmed, processing normally begins within moments and removes or anonymizes account data where appropriate. If an open booking, dispute, refund, held balance, transfer, payout, fraud investigation or legal hold applies, the request stays pending and is re-checked automatically until it can proceed; some records can be retained where the law or a completed transaction requires it. Safety reports are retained for a finite period needed for review, appeals and abuse prevention, then removed or anonymized. Retention varies by record type; the Termly policy explains rights and contact routes. Location is optional, and notification permission can be changed in device settings.

Read the Acceptable Use Policy. Jump to the Termly Privacy Policy.