1. Who We Are & Data Controller
MLFRAMES operates the online platform accessible at mlframes.com and associated subdomains. For the purposes of the General Data Protection Regulation ("GDPR"), UK Data Protection Act 2018, and applicable data privacy legislation, MLFRAMES acts as the Data Controller responsible for your personal data.
2. Information We Collect
We collect several categories of information to provide and safeguard our marketplace:
- Account & Identity Data: Username, email address, password hash, role classification (Client or Creator), full name, and avatar imagery.
- Creator Profile Data: Bio, creative categories, equipment specifications, pricing packages, city/country location, Instagram/website links, and portfolio media.
- Communication Data: Inquiries, project shoot briefs, messages sent between clients and creators in platform threads, and booking status updates.
- Location & Geolocation Data: Approximate city and country derived from IP addresses (via DB-IP geolocation) or GPS coordinates provided with your permission to power proximity creator search.
- Technical & Log Data: Browser user agent, device screen dimensions, IP address, referral URLs, and error diagnostics.
3. How We Use Your Data
We process your data for the following specific purposes:
- To facilitate discovery and communication between visual creators and prospective clients.
- To display verified creator portfolios and showcase equipment listings (FrameTools) and studio spaces (FrameStudio).
- To process subscriptions, MLFRAMES Credits, and Spotlight placements via secure PCI-compliant gateways (Stripe).
- To dispatch transactional notifications (enquiry updates, booking confirmations, password resets).
- To monitor platform safety and prevent fraud, spam, or malicious file uploads.
4. Lawful Bases for Processing
We process your personal information under the following legal bases:
- Contractual Necessity: To fulfill our contractual obligations to you when you create an account, publish a listing, or book a creator.
- Legitimate Interests: To maintain platform security, improve search algorithms, and protect users from fraud.
- Consent: Where you provide consent, such as for non-essential analytics cookies or browser geolocation access. You may withdraw consent at any time.
- Legal Compliance: To comply with applicable tax, financial reporting, and statutory obligations.
5. MediaGuard Security Pipeline
Every image, document, or media asset uploaded to MLFRAMES is routed through our proprietary MediaGuard pipeline before storage. Files are scanned for malware, stripped of hazardous EXIF script injections, and re-encoded from raw pixels. This ensures dangerous code cannot compromise platform infrastructure or visitors.
6. Direct Messaging & Confidentiality
Communications between Clients and Creators inside inquiry threads are private. MLFRAMES does not sell or commercially exploit the contents of your shoot conversations. Platform administrators may only inspect message logs when an issue, scam, or harassment dispute is formally reported by a participant.
7. Third-Party Service Providers
We partner with vetted third-party service providers who process data strictly under our instruction:
- Stripe: Encrypted payment tokenization and credit card processing. We never store raw credit card numbers on our servers.
- Google Analytics (gtag.js): Aggregated and anonymized traffic metrics to evaluate platform speed and visitor trends.
- DB-IP: IP geolocation database used to display localized creator recommendations.
- Cloud Infrastructure & Email Delivery: Secure servers and transactional email dispatch providers.
8. Cookies & Tracking Technologies
We use essential session cookies for authentication and CSRF security, alongside functional preference cookies and analytics tags. You can manage or revoke cookie consent at any time using our floating cookie banner or by reviewing our comprehensive Cookie Policy.
9. Data Retention & Erasure
We retain your account profile data for as long as your account remains active. If you choose to delete or archive your account, we securely remove your public portfolio and profile within 30 days, retaining only anonymized transaction and financial records required by tax authorities.
10. Your Privacy Rights (GDPR & CCPA)
Depending on your location, you hold the following rights under data protection laws:
- Right of Access: You may request a copy of all personal data we hold about you.
- Right to Rectification: You can edit and correct your profile information directly in your account settings.
- Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your account and personal details.
- Right to Restrict or Object: You can opt out of marketing emails with one click via the unsubscribe link in any email footer.
- Right to Data Portability: You may request your data in a structured, machine-readable format.
11. Contact Our Data Protection Team
To exercise any of your data rights or discuss privacy practices, please contact our Data Protection Officer: