Privacy Policy

GRATWICK PRIVACY POLICY
Effective Date: January 1, 2026
Last Updated: October 9, 2026
Operated by: Gratwick Enterprises, Inc.
Address: PO Box 819, Lake View Terrace, CA 91342

This Privacy Policy describes how Gratwick Enterprises, Inc. ("Gratwick," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the Gratwick mobile application, website (gratwick.io), APIs, and related services (collectively, the "App"). The App includes our web app at app.gratwick.io, our casting site at casting.gratwick.io, our share pages at share.gratwick.io, and the campaign landing pages we run on other gratwick.io addresses (for example, castingcall.gratwick.io).

By using the App, you agree to the practices described in this Privacy Policy.

Information We Collect

  • Account and Identity Data: Name, email address, username (handle), password, date of birth, and other information provided during registration or future KYC verification. If you sign in with Google or Apple, we receive your name and email address from that service.
  • Payment Data: Information processed through Stripe for purchases (we do not store full payment card details). Purchases made inside the iOS or Android app are processed by Apple or Google, and we receive a record of the purchase, not your card details.
  • User Content: Photos, images, or media you upload using camera or photo library access, and what you post or send in the App, such as posts, comments, messages, live-show chat, and trivia answers.
  • Casting Submissions: If you submit an audition, the details you give us, such as your name, email address, phone number, country and state, union status, audition video link, headshot or reel, and the consents you agree to.
  • Website Form Data: If you fill in a form on our website or a landing page, the details you enter, such as your name, email address, phone number, the category or role you pick, any message you write, the page you signed up on, and your answer to any consent box on that form.
  • Device and Usage Data: Device ID, IP address, operating system, browser type, crash logs, analytics about interactions (via Firebase and PostHog), and permissions-based data (e.g., camera/photos for uploads). Location data may be collected if enabled, but is not currently used.
  • Communications: Information you provide when contacting support.
  • Mobile Number and Text Consent: If you choose to receive text messages from us, your mobile phone number and a record of your consent (the wording you agreed to and when you agreed).
  • Referral and Campaign Data: The referral code in a link you followed, and the campaign tags in the address of the page you arrived on (see Landing Pages and Campaign Tracking below).
  • Automatically Collected Data: Cookies, pixels, and similar technologies on our website and analytics tools, including advertising pixels from Meta and Google (see Cookies, Pixels and Advertising below).
  • Information From Other Sources: Business contact details that are publicly available (for example, a work email address on a company website), which we may use to contact people about working with Gratwick.

How We Use Your Information

  • To create and manage your account
  • To process payments via Stripe
  • To provide App functionality, including token earning, usage, rewards, and gift card redemptions
  • To review casting submissions and run our shows
  • To detect and prevent fraud, abuse, spam sign-ups, and security risks
  • To improve the App and develop new features (using Firebase, Google Analytics, and PostHog analytics)
  • To measure which campaigns, emails, and ads bring people to Gratwick, and to show our ads to people who have visited our website (see Cookies, Pixels and Advertising below)
  • To communicate with you and provide support
  • To send emails you have agreed to receive, and the emails needed to run your account (see Emails and the Newsletter below)
  • To send text messages you have agreed to receive (see Text Messages below)
  • To comply with legal obligations (including future KYC/AML)

Sharing and Disclosure

We do not sell your personal information for money. We may share it with:

  • Service providers that process information for us under contract and only to provide their service to us:
    • Vercel, which hosts our website and web app and keeps standard server logs (such as IP addresses and pages requested)
    • Amazon Web Services, which runs the App's servers and databases and sends our account emails (Amazon SES)
    • Cloudflare, which provides our domain name service, stores some media files (Cloudflare R2), and runs the Turnstile bot check on landing-page sign-up forms
    • Stripe, for payments made on our website and web app
    • Apple and Google, for purchases made in the iOS and Android apps, for Sign in with Apple and Google sign-in when you choose them, and for app push notifications
    • Google Firebase, for app analytics, crash reports, and push notification delivery
    • Google Tag Manager and Google Analytics, for website and web app analytics
    • PostHog, for product analytics in the App and for counting visits that arrive from our campaigns
    • Future KYC providers
  • GoHighLevel (LeadConnector), our customer relationship and communications provider, which holds your contact details (name, email address, and mobile number if you give it with consent to receive text messages), the categories you choose, where you signed up, and the history of our communications with you. We use it to manage our relationship with you and to send the emails and text messages you have agreed to receive.
  • Advertising partners Meta Platforms, Inc. and Google LLC, through the pixels and tags on our websites described in Cookies, Pixels and Advertising below. Under California law, this can be "sharing" of personal information for cross-context behavioral advertising. You can opt out as described in that section.
  • The public, when you choose to publish something. Posts, comments, live-show chat, and your profile are shown to other users under your handle. Actors and production team members are credited by real name and handle, with their consent.
  • Law enforcement, regulators, or other parties when required by law
  • Successors in a merger, acquisition, or asset sale

Cookies, Pixels and Advertising

A cookie is a small file a website stores in your browser. A pixel (or tag) is a small piece of code from another company that runs on our pages and sends that company information about your visit. Our websites load these through Google Tag Manager.

Where they run. On gratwick.io and our campaign landing pages, Google Tag Manager loads on every page and the tags below run according to the choices described in Your Choices and the Cookie Banner below. On casting.gratwick.io, the tags below load when the page loads; that site does not yet show the cookie banner. In the web app at app.gratwick.io, Google Tag Manager and PostHog load only after you choose "Accept all" in the cookie notice; choosing "Reject non-essential" keeps them off. The iOS and Android apps do not run the Meta or Google Ads tags, and Firebase Analytics in the apps is set not to use advertising storage.

Advertising pixels.

  • Meta Pixel (Meta Platforms, Inc.): tells Meta each time a page is viewed, and when someone signs up. With each event, Meta receives your IP address, browser and device information, the address of the page (including any campaign tags in it), and Meta's own cookie identifiers. The pixel also sends Meta more detailed information about the page itself, such as its title, description and other details Meta reads from the page automatically.
    Advanced matching. We have turned on Meta's automatic advanced matching. When you type into a form on one of our pages, the pixel reads your email address, first and last name, gender, and city, state and ZIP code from the form if they are there, and sends them to Meta hashed (converted in your browser into a scrambled code) so Meta can match the visit to a Facebook or Instagram account. Meta can still use the hashed values to recognize you. We have set it never to send your phone number, and it does not send your country, date of birth or any account ID of ours.
    Meta may connect this information to your Facebook or Instagram account to measure how our ads perform, to show our ads to people who visited our website (retargeting), and for its own purposes under Meta's privacy policy.
  • Google Ads (Google LLC): the Google tag and its conversion linker remember that you arrived from one of our Google ads, so that a sign-up can be credited to that ad. Google receives your IP address, browser and device information, the page address, and its own cookie identifiers, and may use them to measure our ads, to show our ads to people who visited our website, and for its own purposes under Google's privacy policy. Our Google Ads conversion tag does not send Google your name, email address, phone number, or anything else you type into a form (we have not turned on Google's enhanced conversions).

Neither tag sends your phone number to Meta or Google, including a number you give us for text messages.

Your Choices and the Cookie Banner

On gratwick.io and our campaign landing pages we use Google Consent Mode, which tells the Google tags in Google Tag Manager whether they may use cookies for analytics and for advertising. Before any tag runs:

  • In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising start off. They turn on only if you choose them in the cookie banner.
  • Everywhere else, analytics and advertising start on, and you can turn either off at any time.
  • Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information: advertising starts off wherever you are, and choosing "Accept all" does not turn it on. You can still turn advertising on yourself in Your Privacy Choices.

A cookie banner asks for your choice on your first visit, with three options: "Accept all", "Reject non-essential", and "Manage choices", where you can switch Analytics and Advertising on or off separately. Turning Advertising off is the same as choosing "Do not sell or share my personal information", which is also offered there. The banner stays until you choose. You can change your choice at any time with the Your Privacy Choices link at the bottom of our pages.

Your choice is saved in a cookie named gratwick_consent for 12 months and applies to our gratwick.io websites that show this banner. When analytics is off, Google Analytics does not set its cookies. When advertising is off, the Google Ads tags do not set or read advertising cookies or use your visit for ad personalization, and the Meta Pixel does not run. With either off, Google tags may still send Google a signal without cookies (what Google calls a consent mode ping), which Google uses to estimate visits and ad results in aggregate. Choices you make on our websites do not change the separate cookie notice in the web app at app.gratwick.io.

Cookies and browser storage you may see.

  • _fbp (Meta): identifies your browser to Meta for ad measurement and retargeting. Usually lasts about 90 days.
  • _gcl_au, _gcl_aw and other _gcl_ cookies (Google Ads): store ad click information so a sign-up can be credited to an ad. Usually last about 90 days.
  • _ga and _ga_ cookies (Google Analytics): count visits and tell repeat visits apart. Can last up to 2 years.
  • gratwick_attribution (Gratwick): remembers the referral code and campaign tags you arrived with, so a sign-up or purchase is credited to the right referral or campaign. Lasts 30 days. Some referral information is also kept in your browser's local storage.
  • Cloudflare Turnstile: on landing-page sign-up forms, a short check runs in your browser and sends Cloudflare technical information about your browser and your IP address, to tell people apart from bots. It may use browser storage for that check only.
  • gratwick_consent (Gratwick): remembers your cookie banner choice (analytics on or off, advertising on or off) and when you made it, so we do not ask again. Lasts 12 months.
  • PostHog and the cookie notice (web app only): after you accept, PostHog stores an identifier in your browser for product analytics. Your cookie-notice choice is kept in your browser's local storage.

How to opt out.

  • On gratwick.io and our campaign landing pages, choose "Reject non-essential" in the cookie banner, or open Your Privacy Choices at the bottom of our pages and turn Advertising off ("Do not sell or share my personal information"). Turning Analytics off there stops Google Analytics cookies.
  • Turn on Global Privacy Control in your browser or a browser extension. Our websites treat it as a request to opt out of sale and sharing, as described above.
  • Email support@gratwick.io with "Do Not Sell or Share" in the subject. You do not need an account to ask. We will not share the information we hold about you with advertising partners. Because the pixels run in your browser, also use one of the browser options below to stop them on your device.
  • In the web app, choose "Reject non-essential" in the cookie notice, or change your choice later under Cookie Preferences in Privacy and Security settings.
  • Use your browser's settings to block or delete cookies, block third-party cookies, or use a tracker blocker. Blocking cookies does not stop the App working, though some sign-ins may need you to log in again.
  • Control the ads Meta shows you in your Facebook or Instagram Ad Preferences (Accounts Center), and the ads Google shows you at My Ad Center (myadcenter.google.com).
  • Stop Google Analytics in your browser with Google's opt-out add-on (tools.google.com/dlpage/gaoptout).

Landing Pages and Campaign Tracking

Links in our emails, ads, and social posts often carry campaign tags (UTM parameters) in the address, saying which campaign, email, or ad the link came from. When you arrive on our website with these tags:

  • We store them, with any referral code, in the gratwick_attribution cookie for 30 days.
  • Our server records one visit count in PostHog with the campaign tags and the page path. This count does not use a cookie, does not include your IP address, and is not linked to you.
  • If you sign up on a form, the campaign tags are saved with your contact record in GoHighLevel. If you buy something, they are saved with the purchase at Stripe.
  • Our landing pages also report page views and sign-ups, with the campaign tags, to Google Tag Manager, which passes them to the analytics and advertising tags described above.

Sign-ups on our landing pages are sent to GoHighLevel. Before a landing-page sign-up is accepted, Cloudflare Turnstile checks that it comes from a person.

Emails and the Newsletter

Account emails. We send the emails needed to run your account, such as email verification, password resets, a welcome email, and subscription confirmations, from noreply@gratwick.io through Amazon SES. These are not marketing and do not depend on a consent box.

Marketing emails and the newsletter. We send news, show reminders, and offers by email only to people who agreed by ticking a consent box. The box is unchecked and optional on our sign-up and checkout forms. On a landing page that offers a reminder or the newsletter, ticking the box is how you ask for it. The optional box on our website's homepage, creators, and casting forms asks us to call you to schedule a walkthrough and to keep you up to date. We keep a record of the wording you agreed to, the page, and when. Text messages are sent only as described in Text Messages below.

Marketing emails are sent through GoHighLevel from hello.gratwick.io and news.gratwick.io. We also use hello.gratwick.io to contact people at their published business addresses about working with Gratwick. Every marketing email has an unsubscribe link, and you can also unsubscribe by emailing support@gratwick.io. Our emails can tell us whether they were opened and which links were clicked, and their links carry campaign tags as described above.

Text Messages

If you opt in, Gratwick Enterprises, Inc. will send you marketing and promotional text messages, including automated messages, about shows, live-show alerts, news, and offers. You opt in by entering your mobile number and ticking a separate, unchecked, optional text-message box: on the sign-up form at gratwick.io/register, or on the Create Account form in the Gratwick app at app.gratwick.io/register (the same box is in your account settings in the app). It is the same box with the same wording in each place. You must be 18 or older to opt in to text messages. We do not text anyone who has not ticked it. Message frequency varies. Message and data rates may apply. Opting in is optional, and consent to receive text messages is not a condition of any purchase.

Reply STOP to any message to opt out, and HELP for help. You can also withdraw your consent at any time in the App, or by emailing support@gratwick.io. After you opt out, we send one message confirming it and no others.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every category of sharing described in this Policy and will not be shared with any third parties, except the messaging provider that sends messages on our behalf.

Recordings and Permanent Storage

Finished recordings of live shows and broadcasts, and some media published in the App, may be archived on Arweave, a public, decentralized storage network designed to keep files permanently. Anything stored on Arweave can be viewed by anyone who has its address, and neither we nor anyone else can delete it from the network. We can remove it from the App, but not from Arweave. If you appear in a live show, your image, voice, and handle (or, for actors and production team members, real name) may be part of a recording that is archived this way.

Data Retention

We retain information as long as needed for account operation, reward fulfillment, legal compliance, and dispute resolution. Cookies last for the periods given in Cookies, Pixels and Advertising above. We keep records of marketing and text-message consent, and of opt-outs, for as long as we need to show what you agreed to. Media archived on Arweave is permanent, as explained above.

Security

We use reasonable administrative, technical, and organizational measures to protect your information, but no system is 100% secure.

Your Rights and Choices: California Residents (CCPA/CPRA)

In the last 12 months we have collected these categories of personal information, from you, from your device and browser, and from the services you sign in with: identifiers (such as name, email address, phone number, handle, IP address, and cookie and device identifiers); customer records (such as payment and purchase records); commercial information (purchases and rewards); internet and other network activity (pages and screens viewed, campaign tags, and interactions with our emails and ads); audio, visual, and similar information (photos, videos, auditions, and live-show recordings); professional information (such as union status in a casting submission); account log-in information (email address and password); and inferences drawn from your use of the App. We use and disclose them for the purposes and to the recipients described above.

Sharing for cross-context behavioral advertising. We do not sell personal information for money. When the Meta Pixel and Google Ads tags run on our websites, we make identifiers and internet activity available to Meta and Google, which California law treats as "sharing" for cross-context behavioral advertising (and which may be considered a "sale"). This includes the hashed email address, name, gender, and city, state and ZIP code that Meta's advanced matching reads from forms, as described above. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you, or for any purpose that would give you a right to limit its use.

California residents have rights to:

  • Know what personal information we collect and share
  • Access or receive a copy of your information
  • Correct inaccurate information
  • Delete your information (subject to exceptions, including media archived on Arweave)
  • Opt out of the sale or sharing of your personal information for cross-context behavioral advertising, using the Your Privacy Choices link at the bottom of our pages, a Global Privacy Control signal, or the other ways in How to opt out in Cookies, Pixels and Advertising above
  • Non-discrimination for exercising rights

To submit a request, email support@gratwick.io with "CCPA Request" in the subject (or "Do Not Sell or Share" to opt out of sharing). We will verify your identity before responding to a request to know, access, correct, or delete; an opt-out request does not need verification. You may use an authorized agent to make a request for you.

Children

The App is not intended for users under 18. We do not knowingly collect personal information from children.

International Transfers

Data may be processed in the United States.

Changes to This Policy

We may update this Policy and will notify you of material changes via the App or email. Continued use constitutes acceptance.

Contact Us

Gratwick Enterprises, Inc.
PO Box 819, Lake View Terrace, CA 91342
Email: support@gratwick.io