Privacy Policy

Version 2.2. Effective October 31, 2026.

This Privacy Policy explains how mjonesone, LLC, a California limited liability company doing business as ICONS ("ICONS", "we", "us", "our"), collects, uses, discloses, retains and protects personal information when you use the ICONS marketplace at iconsai.com and our related apps and APIs (the "Service"). It applies to every User, including Talent, Authorized Users of a Brand or Agency, and visitors who do not create an account. For people in the European Economic Area (EEA), the United Kingdom and Switzerland, ICONS is the controller of personal information described here.

This Privacy Policy is part of the Terms of Service. Capitalized terms not defined here have the meanings given in the Terms. Identity verification is also covered by the more specific Identity and Biometric Privacy Notice and Consent, which controls if it conflicts with this Privacy Policy on identity or biometric data.

1. Summary

• We collect what we need to build your profile, check that you are an adult who controls the accounts and Likeness you offer, run Bookings, pay people and keep the Service safe.
• When you paste an Instagram or TikTok link, we import that account's public profile through a third-party provider, Apify. We do not connect to your social accounts, we hold no social login tokens, and we never ask for social passwords. Imported data is treated as unverified until you confirm it.
• Identity verification is done by Stripe Identity. You take a photo of your ID and a live selfie on Stripe's page, and Stripe checks the ID and matches your face to it. We ask for your written consent first. ICONS keeps only the result, your legal name and your date of birth, and asks Stripe to redact the session 30 days after the decision.
• Payments and payouts are processed by Stripe through Stripe Connect. We never see or store full card or bank account numbers.
• We use one sign-in cookie and one first-party measurement identifier. We do not use advertising cookies, third-party analytics or cross-site tracking.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• We do not use your Likeness, photographs or voice to train general AI models.
• The Service is for adults only. We do not knowingly collect personal information from anyone under 18.

2. Information we collect

Not every category applies to every User. For example, a Brand's Authorized User does not provide identity evidence.

2.1 Account, sign-in and security information

• Email address. It is your account identity. We sign you in with a single-use link or a six-digit code that expires after 10 minutes. We do not use passwords. We store only one-way hashes of sign-in links and codes.
• Google sign-in (optional). If you choose "Continue with Google", Google sends us your email address, whether Google has verified it, your name and your Google account identifier. We use them to sign you in and to link your Google account to your ICONS account. We do not request or store your Google profile photo, contacts, files or any other Google data.
• Authenticator app (two-step verification). Owners and finance users of a Brand or Agency must set up an authenticator app before money, payout and team actions; other Users may set one up. We store the shared secret for your authenticator, encrypted, and record when you last confirmed a code. We may also send a short-lived email code to confirm a sensitive action.
• Name and contact details you add, and your account settings.
• Sessions. For each signed-in session we record the IP address, browser and device, and when it started and expires. You can see and end your sessions on your Account page.

2.2 Social links and imported public profile information

When you paste social links at signup or later, we record the links and handles you submit and the attestation you accept that you own or are authorized to manage those accounts.

For Instagram and TikTok links, we import publicly available information about the account through Apify, a third-party data extraction provider, using its standard public-profile tools. This can include display name, handle and account identifier, public biography, avatar, public website link, category, follower and following counts, post counts, public counters on recent public posts (such as views, likes and comments) and a small set of recent public images. We record where each value came from, which provider run produced it and when it was observed. Public counters are refreshed about once a day while your profile is active; photos are imported once per account.

For Facebook, LinkedIn, YouTube, X and OnlyFans links, we store the link and handle only. We do not import anything from those platforms; any audience figures for them come from evidence you upload, such as an analytics screenshot, which the ICONS team reviews.

We import only public information. We do not connect to your social accounts, we do not receive or store social login tokens, and we never ask for your social media passwords or cookies. We do not collect private messages, subscriber or follower lists, paywalled content, contact lists or login-only analytics. Imported data is an observation, not proof: it does not verify your identity, your ownership of an account, copyright in an image or private reach.

2.3 Profile, rates and business information

Information you add or confirm in your profile: biography, category, country, languages, services, production modes, rate card, restrictions (for example, excluded categories or limits on voice or body depiction), approval preferences, agency representation and availability. For Organizations: legal business name, display name, website, business email, business address, category, authorized signatory, agency license information where applicable, and the members and roles of the Organization. To help a Brand set up faster, we may read public information from the website address the Brand gives us.

2.4 Images, video, documents and messages

Portfolio images you select or upload for public display; private reference photographs you upload for a specific production Booking; scripts, storyboards, previews, Deliverables and Approved Final Assets; Brand materials such as logos, product images and music; evidence you upload (such as analytics screenshots or rights documents); messages and comments in campaign rooms; and posting evidence such as publication URLs, screenshots, captions and disclosures.

Every upload is checked for malware. Images are re-encoded when processed, which removes embedded metadata such as camera details and location. Video and PDF files are stored as uploaded and may contain metadata your device or software added. We do not strip it from videos, because campaign videos can carry content credentials and AI-disclosure labels that must stay intact. If you do not want location data in a video, turn off location tagging on your device before recording.

2.5 Identity evidence

When you activate paid work as Talent, we ask you to complete identity verification under the Identity and Biometric Privacy Notice and Consent. You first give written consent. You are then sent to the hosted page of our identity-verification provider, Stripe Identity (Stripe, Inc.), where you take a photo of a government-issued photo ID and a live selfie.

Stripe, not ICONS, captures and stores the ID image and the selfie. Stripe checks the document and compares your selfie with your ID photo using automated face matching, which relies on facial geometry and is biometric data under laws such as the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and Washington's biometric identifier law. Together they are "Identity Evidence". Stripe returns the result to ICONS, and ICONS reads your verified legal name and date of birth to confirm you are 18 or older. ICONS does not receive or store your ID image, your selfie or any facial template. Identity Evidence and ID details are also "sensitive personal information" under California law. Section 7 explains how we handle them. Before October 29, 2026, ICONS did the check itself with a challenge video and ID photo compared by a person at ICONS; those files are destroyed on the schedule in Section 6.

2.6 Payment, payout and tax information

Live payments are enabled. Card, bank and tax details are collected by Stripe, not by ICONS, as described below. Section 15 applies only if the Service returns to Sandbox Mode.

Our payment processor is Stripe, Inc. and its affiliates ("Stripe"), through Stripe Checkout and Stripe Connect. Brands pay through Stripe. Talent and Agencies receive payouts through connected accounts with Stripe, which collects the bank account, tax identification, identity and business information it needs for its own "know your customer" checks and tax forms, under the Stripe Privacy Policy and the Stripe Connected Account Agreement. We never receive full card or bank account numbers. We receive from Stripe limited information such as account and payout status, the last four digits of a card or account, transaction identifiers, amounts and dispute status. We keep our own ledger of charges, allocations, transfers, refunds and disputes.

2.7 Booking and transaction information

Requests, proposals and counteroffers, Quotes and Quote Hashes, Contract Packets, typed-name signatures and acceptance evidence (time, IP address, browser, the checkbox text you accepted and the version and fingerprint of each document), approvals, change orders, Rights Manifests, distribution orders and outcomes.

2.8 Usage, device and log information

When you use the Service we automatically collect IP address, browser and device type, operating system, pages and actions, timestamps, referring URLs, request identifiers and error logs. We do not collect precise geolocation.

2.9 Cookies and similar technologies

We keep these to a minimum:

We do not use advertising cookies, third-party analytics, social media pixels or cross-site tracking, and our fonts and images are served from our own site. The session cookie is strictly necessary: blocking it prevents sign-in. You can clear the measurement identifier at any time in your browser settings without affecting the Service. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we do not do in any case.

2.10 Communications

Emails we send (sign-in codes, booking notifications and account notices) and emails and messages we receive, including support requests, complaints, takedown requests and feedback. We send email through Resend. We do not send marketing email today; if we start, every marketing email will have an unsubscribe link.

2.11 Inferences

We derive limited inferences such as suggested rates, audience estimates based on public post history, and fraud or risk signals. We do not infer your age, ethnicity, health, sexual orientation or other sensitive characteristics from your appearance or from imported data. Age is checked only against the date of birth on your ID.

3. Sources of information

• You, when you sign up, build your profile, upload content, communicate or transact.
• Public sources, through Apify, for the Instagram and TikTok links you submit, and public pages of a Brand's own website.
• Other Users: an Agency may draft a roster entry with your name, email and handles before you claim it (it stays unpublished until you claim it and consent); a Brand may upload materials or enter information about a Booking.
• Stripe, which returns payment, payout, tax-form and dispute information, and, for identity verification, the result and your verified legal name and date of birth.
• Google, if you use Google sign-in.
• Automatically, from your device and use of the Service.

4. How we use information

We use personal information to:

1. Create and secure your account, sign you in and confirm sensitive actions (such as payout changes, which need two-step verification).
2. Build and display your profile draft, show the source and date of imported values, and let you confirm, edit or remove them.
3. Suggest rates and estimate audience from public history, with sources shown. Suggestions are advisory and never change your rates without your acceptance.
4. Operate discovery, requests, negotiation, Quotes, Contract Packets, signatures, Production, review, Distribution, verification of posts and reporting.
5. Verify identity, age and authority before paid work, and verify Organizations and their signatories.
6. Process payments, allocations, Holdbacks, transfers, refunds, disputes, statements and tax reporting through Stripe.
7. Provide support, send transactional notices and respond to complaints and takedown requests.
8. Detect, investigate and prevent fraud, impersonation, unauthorized Likeness use, abuse and violations of the Acceptable Use and AI Content Policy.
9. Keep audit records of consents, approvals, signatures and financial changes.
10. Measure and improve the Service in aggregate (for example, how long imports take or where people stop during sign-up).
11. Comply with law, enforce our agreements, and establish, exercise or defend legal claims.

We do not use your Likeness, photographs, voice, private reference images or Identity Evidence to train general AI models, and we do not create reusable likeness models, fine-tuned models, embeddings or voice models of you unless you give separate, explicit written consent for a specific purpose. Private reference images are used only to deliver the specific Booking for which you provided them.

Identity checks are automated by Stripe Identity: if a check fails, you can start a new one or ask a person at ICONS to review it by emailing hello@iconsai.com. Profile reviews and suspensions are made by people.

5. How we disclose information

We disclose personal information only as described here.

5.1 Service providers

These providers process personal information on our behalf under contracts that limit their use of it to providing services to us:

Production vendors receive only the reference assets and instructions authorized for the specific Booking, under terms that prohibit training general models on them, and we record each vendor's deletion status. Stripe also acts as an independent controller for the information it collects for its own compliance obligations.

5.2 Other participants in a Booking

The Service is a marketplace, so some information is shared with the other side of a Booking as needed. Brands see your public profile, rate card, the Booking scope, approved previews and Deliverables, posting evidence and metrics you have made visible. Agencies you have authorized see what your Representation Grant permits. We never disclose your Identity Evidence, date of birth, legal name (except where a signed contract requires the legal name of a party), private reference images, payout details or private analytics to a Brand or Agency.

5.3 Public information

Your public profile, including selected portfolio images, display name, category, platforms, rates and badges, is visible to the public once you choose to publish it. Do not include information in your public profile that you want kept private.

5.4 Legal, safety and corporate transactions

We may disclose information if we believe in good faith it is required by law, subpoena or court order; to protect the rights, property or safety of ICONS, Users or others; to investigate fraud or unauthorized Likeness use; or in connection with a merger, acquisition, financing or sale of assets, subject to this Privacy Policy or equivalent protections.

5.5 At your direction

We disclose information when you direct us to, for example when you connect an Agency or approve sharing private metrics with a specific Brand.

5.6 No sale and no sharing for cross-context behavioral advertising

We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. We have not done so in the past 12 months. We do not sell or share the personal information of anyone under 16, and the Service is not available to anyone under 18. We do not license or sell identity datasets, biometric data or Likeness datasets to anyone.

6. Retention

We keep personal information only as long as needed for the purposes described, subject to legal holds, open disputes and active Bookings. Our default retention periods are:

Copies distributed to Brands, posted publicly or held by vendors are governed by the applicable agreements. We record vendor deletion status but cannot technically recall copies already distributed.

7. Identity evidence and biometric data

7.1 What we collect and why

Identity Evidence is your ID image, your selfie and the biometric data Stripe derives from them (and, for checks before October 29, 2026, your challenge video and ID image). It is used only to confirm that you are a real adult, that you match your ID, and that you are the person who controls the Likeness offered for Booking. We do not use it for marketing, advertising, profiling, emotion analysis, AI training or content generation.

7.2 Written consent before capture

We collect Identity Evidence only after you have read the Identity and Biometric Privacy Notice and Consent and given written consent by typing your full name and checking the consent box. The Service will not start an identity check until that consent is recorded. You may decline; if you do, we cannot verify you and you cannot be Bookable for paid work.

7.3 No sale or profit

We do not sell, lease, trade or otherwise profit from Identity Evidence. We disclose it only to Stripe, our identity-verification provider, and our hosting provider for storage, with your consent, to complete a transaction you request, or as required by law or valid legal process.

7.4 Retention and destruction schedule

An automated job asks Stripe to redact each verification session 30 days after the decision (or 30 days after an unfinished session expires), and deletes earlier challenge videos and ID images on the same 30-day schedule, or after 24 hours for a capture never sent for review. Stripe may keep some information where the law requires it, under the Stripe Privacy Policy. In every case Identity Evidence is destroyed no later than the earlier of when the purpose of collecting it is satisfied and 3 years after your last interaction with ICONS. We delay this only under a recorded legal hold. Full details are in Section 6 of the Identity and Biometric Privacy Notice.

7.5 Protection

We store, transmit and protect Identity Evidence using a reasonable standard of care within our industry, at least as protective as how we protect our other most sensitive information. ICONS does not hold the images from Stripe checks. Only ICONS staff with the identity reviewer or administrator role can see verification results, legal names and dates of birth, and open earlier identity files, through links that expire after two minutes.

8. Sensitive personal information

Sensitive personal information we may collect includes government ID details, account sign-in codes and authenticator secrets, financial account information held by Stripe, and Identity Evidence. We use and disclose it only for purposes permitted by California Civil Code section 1798.121 and its regulations: to provide the Service you request, verify identity and age, prevent fraud and security incidents, ensure safety, comply with law, and have service providers act on our behalf. We do not use it to infer characteristics about you, so the right to limit its use does not apply, but you may still contact us with questions.

9. Notice at collection and US state privacy rights

This section is our notice at collection for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), and describes the rights available in other US states.

9.1 Categories collected in the past 12 months

We collect these categories for the purposes in Section 4, from the sources in Section 3, and keep them for the periods in Section 6. We do not sell or share any category.

9.2 Your rights

Subject to exceptions in the law, California residents have the right to:

• Know and access the categories and specific pieces of personal information we collected about you, the sources, the purposes and the categories of recipients.
• Delete personal information we collected from you. Some records must be kept, for example signed contracts, financial records and records needed to complete an active Booking or defend legal claims.
• Correct inaccurate personal information. You can correct most profile information yourself.
• Opt out of sale or sharing. We do not sell or share, but we honor Global Privacy Control signals as an opt-out request.
• Limit use of sensitive personal information beyond permitted purposes. We do not use it beyond permitted purposes.
• Non-discrimination. We will not deny you service, charge you a different price or give you a different quality of service because you exercised a privacy right.

9.3 How to exercise your rights

Use the tools on your Account page ("Download my data" and "Delete my account and data"), or email privacy@iconsai.com from the email address on your account. We will confirm receipt within 10 business days and respond within 45 days, or tell you if we need an additional 45 days.

We verify requests by confirming control of the email on your account with a sign-in code. For requests involving sensitive or identity information we may ask for more verification in proportion to the risk, and we use that information only for verification.

You may use an authorized agent. We will require the agent to provide your signed permission, and we may ask you to verify your identity directly and confirm that you gave the agent permission, unless the agent holds a valid power of attorney under California Probate Code sections 4000 to 4465.

9.4 Other US states

Residents of other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon) may have similar rights to access, correct, delete and obtain a copy of personal information, and to opt out of targeted advertising, sale and certain profiling. We do not engage in targeted advertising, sale or profiling with legal or similarly significant effects. To make a request, use Section 9.3. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy appeal"; we will respond within the time the law requires, and if the appeal is denied you may contact your state attorney general.

9.5 Shine the Light

We do not disclose personal information to third parties for their own direct marketing purposes.

10. People in the EEA, the UK and Switzerland

Anyone 18 or older can create an account from outside the United States. During the pilot, Bookings and payouts are available only in the United States, in US dollars. If you are in the EEA, the UK or Switzerland, the General Data Protection Regulation (or the UK or Swiss equivalent) gives you the rights below.

10.1 Legal bases

Where we rely on legitimate interests, we have balanced them against your rights, and you can object (Section 10.2).

10.2 Your rights

You can ask to access, correct or delete your personal information, to restrict or object to our processing of it, and to receive the information you gave us in a portable format (the "Download my data" export). Where we rely on consent, you can withdraw it at any time without affecting earlier processing. To exercise a right, email privacy@iconsai.com; we respond within one month, which the law lets us extend by two months for complex requests. You also have the right to complain to your local data protection authority, or in the UK to the Information Commissioner's Office (ico.org.uk).

10.3 International transfers

ICONS is based in the United States and stores and processes personal information in the United States. When you use the Service from outside the United States, you send your information to us there. Where the law requires a transfer safeguard for information our service providers process, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) in their data processing terms, or on another lawful transfer mechanism. You can ask us for more information at privacy@iconsai.com.

11. Google API Services and Limited Use

If you sign in with Google, we receive only your email address, its verification status, your name and your Google account identifier. We use them only to authenticate you and set up your account. ICONS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or when aggregated and de-identified for internal operations.

12. Your choices and controls

• Profile: edit, hide or remove imported fields and images; delete a photo; remove a social link (its unconfirmed imported photos are deleted with it); pause bookings; unpublish your profile; delete a profile that has no bookings.
• Agencies: revoke future agency authority at any time; signed obligations are preserved.
• Sessions: see your active sessions and sign out of any of them on your Account page.
• Your data: download a copy of your records from your Account page.
• Account closure: use "Delete my account and data" on your Account page or email privacy@iconsai.com. Your public listing is removed and eligible private files are deleted under Section 6.
• Cookies: see Section 2.9.

13. Children

The Service is only for adults 18 and older. Every Talent must be verified as an adult before paid work, and minors may not appear in any content on the Service. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it and close the account. Contact privacy@iconsai.com if you believe a minor has used the Service or appears in content.

14. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest for stored files, encrypted authenticator secrets, private storage that is not publicly listed, short-lived signed links to private files, malware scanning of uploads, separated storage areas for portfolio, identity, private reference and campaign files, role-based access limited to people who need it, hashed sign-in tokens, two-step verification for money and team actions, rate limits and audit logging. No system is perfectly secure. If a breach of security affects your personal information, we will notify you and regulators as required by law.

15. Sandbox Mode

While the Service runs in Sandbox Mode, nothing is charged or paid, no payment details are collected, and Booking signatures are test records. We still protect all data, including sandbox data, under this Privacy Policy. Demonstration data is labeled and kept separate from real accounts.

16. Changes to this Privacy Policy

We may update this Privacy Policy. Each version has a version number and an effective date, and earlier versions stay available on this page. If we make material changes, we will tell you by email or in the Service before the change takes effect and, where required by law, ask for your consent. Your acceptances are recorded against the version you accepted. Material changes to how we use Identity Evidence or Likeness will not apply to you without your consent.

17. Contact

ICONS is operated by mjonesone, LLC, a California limited liability company based in Los Angeles, California, USA.

• Privacy questions and requests: privacy@iconsai.com
• Legal notices: legal@iconsai.com
• Support: hello@iconsai.com
• Postal address: mjonesone, LLC (ICONS), Attn: Privacy, Los Angeles, California, USA. Our full street address for postal mail is being registered and will be published here; until then, email legal@iconsai.com and we will send it to you.