Privacy

The family holds the switch

This platform puts young people’s names and faces on things brands pay for. That only works if a parent decides what is allowed, can see exactly what was agreed, and can undo it without asking permission. Everything below follows from that.

Last updated 18 August 2026

The short version

No asset featuring a minor is published, sold or delivered to a brand until a parent or guardian has approved it. That gate is enforced in the database, not just in the interface.
No one can message a member through this platform. Brands book through structured offers, comments are off by default, and a member's address is never shown to a brand.
We do not sell personal information, we do not run advertising, and a member's photographs are never used to train any AI model.
A guardian can withdraw any permission at any time. It takes effect immediately, without asking us first.

The rest of this page is the detail behind those four sentences. If the two ever disagree, the detail governs — but we have tried hard to make sure they do not.

What we collect

Only what a living card actually needs. A member builds their own card — but for a minor, nothing about it becomes brand-visible until a parent or guardian has signed, and the sensitive facts a child should not control (like a date of birth) are set at signing, not by the child.

Members

The talent whose card this is. For a minor, a guardian signs before anything goes brand-visible.

Name: The name on the card. Public surfaces for minors show what the guardian chose to show.
Date of birth: Used to derive the age tier, to apply minor-safety rules, and to record whether the member was a minor at signing. A minor can never set this themselves.
Activity and story: The activity, accomplishments, journey posts and showcase items the member adds to their card.
Photographs: The approved photo set. Stored privately, served through short-lived signed links, and the only source any AI asset may be generated from.

Parents and guardians

Supplied by you when you take up your role on a member's account.

Name and email: To send approval requests and to reach you about your own child.
Relationship to the member: Recorded on the signed consent.
Signature and approval record: The name you typed, the exact wording you were shown, a hash of that document, the date, time, network address and browser used — and every approval, Fast-Track limit and veto you set afterwards. This is what makes the record hold up later.

Brands

The businesses that book talent.

Account and business details: Name, email, role, business name and marks, used to sign in and to attach to offers.
Product materials: What you upload for a booking — product shots, briefs and the offer terms.
Payment: Handled entirely by Stripe. Card numbers never reach our servers and we never store them.

Supporters

The people who fund a member's goals.

Name and email: For the receipt and to reach you about your contribution.
Contribution details: Which goal, how much, and any message — visible to the member's guardian and never a channel to the member.
Payment: Handled entirely by Stripe, as above.

Consent gates

Permission is not one switch, and it is not a checkbox at the bottom of a form. A guardian grants each permission separately, and each one gates a different thing.

Brand visibility

Whether the member may appear to brands at all — searchable, bookable, on a public card.

Per-asset approval

Nothing publishes without approval of the finished asset — by the member, and by a parent for members under 18. Rejecting costs nothing and needs no reason.

Fast-Track limits

A guardian may pre-authorise within limits they set — approved photos, approved categories, human review, and a 24-hour veto before anything goes live.

Enforced by the database, not by the interface

Whether an asset featuring a minor may be published or delivered is a value the database computes from the signed permissions and approvals. It is not a flag any part of the application is allowed to set. Postgres refuses the write outright, so a bug in our own code — or a mistake by someone with full access — cannot publish a child whose family did not agree. This is the one commitment on this page that does not depend on us behaving well.

What we never do

These are limits on the business, not features of the current version. They are the reason a parent can say yes to this at all, and we would rather lose the revenue than the line.

We do not sell personal information
Not to data brokers, not to advertisers, not to anyone. There is no version of this product where a member's details are the thing being sold — the member's work is.
No one can contact a minor through us
There are no direct messages to minors, from anyone, ever. Brands book through structured offers only, comments are off by default, and a supporter's message with a contribution goes to the guardian, not the child.
Brands never receive source photos or contact details
A booking buys a finished, licensed deliverable. It does not buy the approved photo set, an address, an email, or any way to reach a member or their family directly. For a UGC shoot, shipping runs on a platform label — the address is never shown to the brand.
No advertising and no tracking on member pages
We run no advertising anywhere. We put no analytics or session-replay tooling on member portal routes, and we keep cookies to what is needed to sign in and to complete a payment.
Minor members stay out of search results
Pages for members who are minors carry noindex and are excluded from the sitemap unless a guardian has chosen otherwise. Deep links use unguessable identifiers.
AI from approved photos only — and no model training
Every AI asset is generated from the member's approved photos only, carries a visible, non-removable AI label, and is never used to train, fine-tune or improve any model. Nothing a member uploads is training data — here or anywhere else.

Your rights

Most of these you can exercise yourself, immediately, without writing to us. That is deliberate — a right you have to request is not much of a right.

Change or withdraw any permission

From the parent portal, at any time, for any reason. It takes effect immediately. Assets already delivered under a licence are governed by that licence and earnings already paid are unaffected, but nothing further will be published, generated or sold.

See exactly what you agreed to

Every signature is archived showing the precise wording you were shown, with the date and time. You can download your copy whenever you want it.

See every booking and payout

The parent portal shows each deal involving your child, each supporter contribution, and where the money went — including what was pledged onward to a cause — down to the cent.

Ask for a copy, a correction, or deletion

Write to us and we will provide what we hold about you or your child, fix what is wrong, or delete it. We keep signed consent records and the financial records the law requires us to keep, and we will tell you plainly which of those apply.

Have something taken down now

A member can take any asset down in one tap, and it comes down. Anything suggesting a minor has been contacted goes to a dedicated queue with a 24-hour response commitment, and the guardian is notified at the same time.

safety@nil.cards

Children

Most of the talent on this platform is under 18. That is the normal case here, not an edge case, and it shapes the whole design.

A guardian decides, always

A minor cannot consent to their own brand visibility, cannot set their own date of birth, and cannot widen their own privacy settings. Those decisions belong to a parent or guardian, and the record shows who signed, when, and whether the member was a minor at the time. On turning 18, control transfers to the member with a fresh affirmation, and the guardian is told their control has ended.

Under 13

The platform serves high-school-age talent and older. We do not knowingly collect information about a child under 13, and we will not open the platform to younger members until the additional protections that age requires are in place. If you believe we hold information about a child under 13, tell us and we will remove it.

Security and retention

How it is held

Photographs, signed consents and finished assets live in a private store, separate from public artwork, and are reachable only through links that expire.
Payment card details never touch our servers; Stripe handles them end to end.
Access is scoped by role — a brand sees offers and deliverables, never a member's private materials.
Consequential actions are written to an audit log recording who did what, when, and from where.

How long we keep it

Signed consent records are kept for as long as they may be needed to show what was agreed — a signature is only worth something if it can still be produced later.
Booking and payment records are kept for the period tax and accounting law requires.
Photographs and profile details are removed when a family asks, or when they are no longer needed.
Withdrawing a permission stops future use immediately; it does not erase the record that the permission once existed, because that record is what protects everyone involved.

No system is perfect, and we would rather say that than imply otherwise. If something involving a member’s information ever goes wrong, we will tell the affected families promptly and describe what actually happened.

Questions, or something that needs to come down

A privacy question about your own child is never a nuisance to us — it is the most important message we get. Write to us and a person will answer.

safety@nil.cards Terms of service →

Who is responsible

NIL.CARDS is a trading name of NIL Cards LLC, formed in Delaware and operating from California. That company is responsible for the information described on this page.

Changes to this policy

If we change how any of this works, we will update this page and change the date at the top. Where a change materially affects what a family already agreed to, we will not apply it quietly — we will ask for permission again.