What we hold — and how little

We collect only what the service needs: writers’ unpublished manuscripts and IP, talent profiles, video, and — for age and anti-impersonation — identity checks. ID documents are checked and deleted; we keep a pass/fail result, never the document itself.

One standard, applied equally

No lesser store for any category of data. Adult talent, child talent, manuscripts and IP, identity results and video are all held to the same high protection. Children change not the level of protection but the speed of response.

How data is protected

• Encryption in transit and at rest.
• Least-privilege access.
• Continuous monitoring of access and data-movement.
• IP fingerprinted on upload; every download watermarked to the person who took it.

Containment — the kill-switch

If anything looks unusual, the service is cut immediately and investigated afterwards. A separate, always-up standby page shows a calm ‘back soon’ notice and never holds sensitive data. We publish that we cut first and why — never what trips it or how it works, because that only helps an attacker.

Children first

Children’s media is the highest-value target, so a breach is most likely aimed at it. We respond as if every alert is exactly that: cut first, investigate second.

Incident response & the law

Cutting the server contains the risk; it does not discharge legal duties. Where personal data may be exposed, UK GDPR can require notifying the ICO within 72 hours. The kill-switch is step one of a documented process, not the finish line.

Independent review

Before it guards children’s data and writers’ IP at scale, the security build is reviewed by a qualified security professional.