Privacy Policy
Last updated: July 2026.
Who we are
The data controller is Fearless Horizon Stunts, based in Athens/Piraeus, Greece. For any data-protection matter — a question, a correction, a deletion request — email [email protected]; we do not have a separate privacy inbox or a call center — that address reaches the team directly.
We have not appointed a Data Protection Officer. Given the scale and nature of our processing (two lead-capture forms and a performer roster), we do not consider one is required under Article 37 GDPR for a business of our size; requests are still handled personally by our team at the address above.
What we collect
Production brief form (/api/brief): contact name, company, email or phone, production type, shoot dates, location, headcount, action description, coordination need, prep type, risk level, budget band, notes, and site language. Every field is length-capped server-side before it is stored — for example notes are capped at 4,000 characters, contact name and email at 200 — and fields like coordination need, prep type, and risk level are restricted to fixed option lists rather than free text.
Performer Pool PDF request (/api/pool-pdf): email address, role (limited to Casting Director, Producer, Production Manager, or Other), and site language.
Anti-spam signals: both forms run a Cloudflare Turnstile check and a hidden honeypot field at submission time. If the honeypot field is filled in, the submission is silently discarded — nothing is stored, no email is sent. The Turnstile check itself sends your IP address to Cloudflare for that one verification, but we deliberately do not store your IP address or browser user-agent in our own database for either form; same-origin checks, content-type checks, Turnstile, and the honeypot are what keep the forms clean, so we don't need to log that data ourselves.
Why we process it, and on what legal basis
Production brief: Article 6(1)(b) GDPR, as steps taken at your request toward a possible production engagement, and Article 6(1)(f), our legitimate interest in responding to inbound professional inquiries efficiently. Your budget band is used to derive an internal "tier" label (hot, warm, or review) purely for our own triage — it is seen only by our team, is never returned to you, and never auto-approves or auto-rejects a brief. A person reads and answers every submission, so there is no automated decision-making within the meaning of Article 22.
Performer Pool PDF request: Article 6(1)(f), our legitimate interest in vetting and fulfilling profile requests from industry professionals, and Article 6(1)(b) as steps taken at your request. The role field lets us confirm the request is coming from someone in a relevant casting or production capacity.
Retention
Production briefs are kept for up to 24 months from submission, then deleted or anonymized. Performer Pool PDF requests are kept for up to 12 months. This is a policy commitment we currently apply by hand — our systems do not yet run an automatic purge job for either table — so if you would like your data removed sooner, email [email protected] and we will delete it manually, typically within a few business days.
Admin login records (IP address and success/failure only, no personal browsing data) are kept for security auditing and abuse-lockout purposes and are not linked to any public-facing form data.
Processors
- Cloudflare — website hosting (Pages) and the Turnstile anti-spam check on both forms.
- Neon — our Postgres database, hosted in the EU (Frankfurt region), storing brief and PDF-request submissions.
- Resend — sends the notification email to our team and the confirmation email to you when you submit a form.
- Umami — self-hosted analytics on its own separate EU-based Postgres instance, under our control rather than a third-party platform.
- YouTube / Vimeo — video hosting for embedded showreel and production clips, contacted only after you click play.
International data transfers
Most of our processing stays inside the EU/EEA: our lead database runs in Neon's Frankfurt region, and our analytics is self-hosted on a separate EU-based database we control. Some providers — Resend, Cloudflare, and YouTube or Vimeo if you play an embedded video — may process or route data outside the EU/EEA. Where that happens, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on Standard Contractual Clauses otherwise. Email us if you would like details on the safeguard used for a specific provider.
Cookies, embeds, and analytics
Public pages set no marketing or advertising cookies and use no third-party ad trackers. Our analytics runs on Umami, self-hosted, cookieless — it sets no cookies, stores no persistent identifier on your device, and processes your IP only transiently to compute aggregate country-level statistics. Because nothing is stored on or accessed from your device for this purpose, Article 5(3) of the ePrivacy Directive (as implemented by Greek Law 3471/2006) does not require a consent banner for it.
Cloudflare Turnstile, the anti-spam widget on both forms, may set a small number of strictly-necessary technical cookies or local values purely to distinguish human traffic from bots during that one check; these are not used for tracking, marketing, or profiling and fall under the strictly-necessary exemption. Showreel and production videos are embedded from YouTube or Vimeo behind a click-to-load facade — no request is made to either platform, and no player cookie is set, until you press play.
The only other cookie on the site is fh_admin, an HttpOnly, SameSite=Strict session cookie issued solely when a Fearless Horizon Stunts staff member logs into the internal admin panel. It is strictly functional and security-related, is never set for public visitors, and has nothing to do with analytics or marketing.
Performer data and consent
Performers do not self-register on the public site. Every profile is entered into our roster by the Fearless Horizon Stunts team through a password-protected admin panel, and each record carries a documented consent object: whether the performer has consented to a public photo, whether they have consented to PDF distribution, the date they signed, and a consent version number.
Our build process runs an automated check before every release that only allows performers with public-photo consent set to true into the public website; anyone who has not consented, or has withdrawn consent, stays in our private records and never reaches the public site — this is verified automatically at build time, not left to manual review alone.
The gated Performer Pool PDF contains public-tier profiles only and is currently sent out manually by a team member after we verify a request; an automated, signed download link served from private cloud storage is a planned future upgrade that is not yet built or in use. Performers may withdraw consent, request a correction, or ask to be removed at any time by emailing [email protected]; a withdrawal is actioned by an admin updating or deleting the record and takes effect from our next site publish.
Automated decision-making
We do not use profiling or automated decision-making that produces legal or similarly significant effects on you. The only automatic classification in our systems is the internal budget-band tier attached to brief submissions, described above under legal basis — it exists purely to help our team prioritize replies, never to block, reject, or auto-respond to anyone. A person reviews every brief and every PDF request before we act on it.
Children and minors
This site is not directed at children. Our forms are not intended for use by anyone under 18, and our performer roster consists of adult professionals recruited and onboarded directly by our team — not members of the public who register themselves. We have no age-verification step in our forms or performer schema because our current way of working does not create a pathway for minors' data to enter our systems in the first place.
Your rights
Under the GDPR, you can ask us to give you access to your data, correct it, delete it, restrict how we use it, give you a portable copy of what you provided, or object to processing we base on legitimate interest. Where we rely on your consent — for example, a performer's photo or PDF-distribution consent — you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
Email [email protected] to exercise any of these rights; we respond to and act on verified requests within one calendar month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, dpa.gr), or with the supervisory authority of your own EU country of residence or work if that differs from Greece.
Changes to this policy
We update this policy as our site or our data practices change — for instance, if the automated signed-download upgrade to the Performer Pool PDF described above goes live, this page will be updated to reflect it. The "last updated" date at the top always shows the most recent revision, and material changes to how we handle your data will appear here before they take effect.
Contact
Fearless Horizon Stunts, Athens/Piraeus, Greece. [email protected].
See also our Terms of Use for the rules governing use of this website.