Skip to content

Privacy Policy

Effective June 26, 2026

1. Personal Data we collect

This Privacy Policy explains how Theodyx Inc. (“Theodyx,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information. We are a media, talent-management, and technology/ventures company in the creator economy, organized as a Delaware C-Corporation. This Policy applies to www.theodyx.com and our related sites theodyx.net, theodyx.store, theodyx.xyz, theodyx.me, and theodyx.info (together, the “Site”), and to the “Our Scouting” creator-application flow available at our scouting page. A short, plain-language summary is available in our Notice at Collection, and this Policy works alongside our Terms & Conditions and Cookie Policy.

We collect the following categories of personal information, described using CCPA categories together with the specific fields involved. We collect only what we need to operate the Site and to evaluate creator applications.

  • Identifiers. Your first and last name and your email address.
  • Age information. Your date of birth, which we use to confirm eligibility. We re-derive your age on the server (see the Children section below).
  • Geolocation (coarse). The city, state, and country you type into your application. We also derive a coarse, country-level location from your network connection; we do not collect precise GPS location.
  • Internet or other electronic network activity. Cookieless, first-party analytics — such as page views and scroll depth — and a salted hash of your IP address. We never store a raw IP address; we store only a one-way salted hash, together with minimal request metadata, for security and abuse-prevention.
  • Professional or creator information. Your primary platform, your social handles, your “best links” (URLs), and audience or creator details you choose to share.
  • Audio-visual information. Media you upload — a media-kit PDF and up to a few sample images or photos — plus any optional notes you add.
  • Inferences. Limited inferences we may draw from the above to evaluate a possible fit for representation. We do not use these to build advertising or cross-context tracking profiles.

Sources of personal information

We obtain personal information from two sources:

  • Directly from you — the information you type into the scouting application and the media you upload, including your age confirmation (14+) and your consent.
  • Automatically from your device and use of the Site — cookieless analytics signals (page views, scroll depth), the coarse country derived from your connection, and the salted IP hash and minimal request metadata generated by our security tools.

Sensitive personal information

Photos and full-length images of minors are treated as sensitive personal information. We use sensitive personal information only for limited, permitted purposes — to provide the service, to evaluate applications, and for security — and never to infer characteristics about a person and never for advertising. You may ask us to limit the use of your sensitive personal information; see Your Privacy Choices.

2. How we use Personal Data

We use personal information for the following purposes:

  • To provide and operate the Site — to deliver pages, run the scouting flow, and measure basic, privacy-preserving usage.
  • To evaluate scouting applications — to review submissions and consider whether to reach out about possible representation. Applicant data may be routed into our internal creator-data system for this evaluation.
  • To communicate with you — to respond to applications, questions, and requests. We contact applicants only from official @theodyx email addresses.
  • For security and fraud-prevention — to protect the Site against abuse, bots, and unauthorized access, using tools such as a privacy-preserving CAPTCHA-alternative, a web-application firewall, rate limiting, and a privacy-safe audit log of salted hashes.
  • To comply with law — to meet legal obligations and to establish, exercise, or defend legal claims.

3. Disclosure of Personal Data

We do not sell your personal information. We disclose it only as follows:

  • To service providers and processors — including our cloud hosting, security, and storage provider, our website platform, and our email provider — under contracts that limit them to performing services for Theodyx and that prohibit using the information for their own purposes.
  • To affiliates under common control with Theodyx.
  • For legal and safety reasons — to comply with law, respond to lawful requests, enforce our Terms & Conditions, and protect the rights, safety, and security of applicants, the public, and Theodyx.
  • In a corporate transaction — in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate protections.

Theodyx does not “sell” personal information and does not “share” it for cross-context behavioral advertising, as those terms are defined under the CCPA. We do not use third-party advertising cookies or ad pixels, and we do not engage in cross-site or cross-context tracking, nor do we work with data brokers.

4. Retention

We keep personal information only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. We determine retention based on criteria such as: how long we need the information to evaluate an application and any resulting relationship; whether you ask us to delete it; and our legal, security, and recordkeeping obligations.

Telemetry is minimized and automatically purged on a schedule. Our security audit log stores only salted hashes — never a raw IP address, user-agent string, or email — and is similarly retained only as long as needed for abuse-prevention.

5. Data controls

We give you meaningful control over the limited information we handle.

  • Cookies and tracking. We use a cookieless, first-party approach to analytics and do not use advertising cookies or third-party ad pixels. The only client-side storage we rely on is a per-tab session token kept in your browser’s sessionStorage (not a cookie), which is cleared when you close the tab. For details, see our Cookie Policy.
  • Global Privacy Control (GPC). We honor GPC browser signals as a valid opt-out preference signal. Because we do not sell or share personal information, a GPC signal does not change how your information is handled, but we recognize and respect it.
  • Sale, sharing, and sensitive information. You can record your preferences — including to opt out of any sale or sharing and to limit the use of sensitive personal information — through Your Privacy Choices.

6. Your rights

Depending on where you live and applicable law, you may have the following rights (drawn from the California and Virginia-model frameworks):

  • Know and access — to learn what personal information we collect, use, and disclose, and to obtain a copy.
  • Delete — to ask us to delete personal information we hold about you.
  • Correct — to ask us to correct inaccurate personal information.
  • Data portability — to receive your information in a portable, readily usable format where applicable.
  • Opt out of sale or sharing, and of targeted advertising and certain profiling — though, as explained above, we do none of these.
  • Limit the use of sensitive personal information — see Your Privacy Choices.
  • Non-discrimination and no retaliation — we will not discriminate or retaliate against you for exercising any of these rights.
  • Appeal — if we deny your request, you may appeal our decision (Virginia-model). We will respond within the time the law allows and explain our reasoning.

How to exercise your rights

To make a request, email contact@theodyx.com. We will take reasonable steps to verify your identity before acting, which may include confirming information you previously provided. You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and may ask you to verify your identity directly. We aim to respond within the timelines required by applicable law, and we will let you know if we need additional time.

7. Children

You must be at least 14 years old to apply through the scouting flow, and this minimum is enforced on the server (your date of birth is re-derived on the server, not merely accepted as a checkbox). We block applicants under 13 entirely, consistent with a conservative reading of the Children’s Online Privacy Protection Act (COPPA).

We do not sell or share the personal information of consumers we know to be under 16 years of age without the affirmative authorization (opt-in) required by California Civil Code section 1798.120(c). Because we do not sell or share personal information at all, no such authorization is sought.

A parent or guardian may contact us to exercise rights on behalf of an eligible minor, including to access, correct, or delete the minor’s information. Please email contact@theodyx.com. To report impersonation or a safety concern involving a minor, contact scouting@theodyx.com and see our Scouting Safety & Anti-Impersonation Notice.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include one-way salted hashing of IP addresses, encryption of data in transit, access controls, and abuse-prevention tooling such as a privacy-preserving CAPTCHA-alternative and a web-application firewall. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security; we encourage you to share only what you are comfortable providing.

9. Additional U.S. state disclosures

We have written this Policy to meet a high-water mark drawn from the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), and from Virginia-model comprehensive privacy laws, so that we can offer strong, consistent protections to everyone. This section summarizes disclosures for residents of U.S. states with comprehensive privacy laws.

California

In the sections above we describe the categories of personal information we collect and the sources of that information (see Personal Data we collect), the business and commercial purposes for collecting it (see How we use Personal Data), and the categories of recipients to whom we disclose it (see Disclosure of Personal Data). We do not sell or “share” personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics. California residents have the rights described under Your rights, may designate an authorized agent, will not be discriminated against for exercising those rights, and may record preferences through Your Privacy Choices. We honor Global Privacy Control signals.

Virginia and similar states

Residents of Virginia and other states with comparable laws have the rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. As explained above, we do not engage in those processing activities. You also have the right to appeal a refusal to act on a request; to appeal, reply to our response or email contact@theodyx.com with “Appeal” in the subject line.

10. Changes to the privacy policy

We may update this Policy from time to time. When we do, we will revise the effective date shown with this Policy and, where appropriate, provide additional notice. Your continued use of the Site after an update means you accept the revised Policy.

11. Data controller

Theodyx Inc., a Delaware C-Corporation, is the controller responsible for the personal information handled under this Policy. You can reach us using the details in How to contact us.

Theodyx is based in the United States, and we process and store personal information in the United States. Our launch is US-only. We do not currently target or monitor individuals in the European Union, the United Kingdom, Canada, Brazil, or China, and the corresponding regional privacy modules are dormant. If that changes, additional regional rights and representative arrangements would apply, and we would update this Policy accordingly.

12. How to contact us

If you have questions about this Policy or our privacy practices, you can contact us:

  • By email at contact@theodyx.com
  • By phone at +1.938.293.5290
  • By mail at Theodyx Inc., 16192 Coastal Highway, Lewes, DE 19958

For scouting safety or impersonation reports, email scouting@theodyx.com.

13. Useful resources