Folio.

Privacy
Policy

Last updated: 23 July 2026

This policy describes how we handle the personal data we collect through the BBD Folio waitlist and the credit graph. It applies under the EU General Data Protection Regulation (GDPR) for users in the EEA and, for US residents, under applicable US state consumer-privacy laws (see §07).

[ 01 ]

Data controller

The data controller is Edoardo Sassone, based at 606 West 57th Street, New York, NY 10019. For any request about your data, write to brokebutdreamingstudio@gmail.com.

[ 02 ]

What data we collect

Depending on how you sign up, we collect:

  • Email sign-up: your email address and the sign-up date.
  • Google sign-in: your email address, full name and Google account identifier, provided by Google at sign-in.

If you use Folio as a creative, we also process credit-graph data (profile, collaborations, affiliations): see §08.

We do not collect special categories of data, and we do not carry out profiling or automated decision-making.

[ 03 ]

Purposes and legal basis

We process your data to manage the waitlist, authenticate you (sending the sign-in link) and contact you when the platform is available, and to keep you posted on the project.

For EEA users, the legal basis is your consent (Art. 6(1)(a) GDPR), given by signing up or signing in with Google. You can withdraw it at any time (see §06), without affecting the lawfulness of processing carried out before withdrawal.

[ 04 ]

Recipients and processors

Data is stored with Supabase (database and authentication infrastructure), acting as a processor. Emails — confirmation, sign-in link, password reset, and application messages like the welcome — are sent through Brevo (a provider based in the European Union), also a processor limited to sending these emails. Signing in with Google involves processing by Google under its own terms. We do not sell or hand over your data to third parties for marketing.

[ 05 ]

International transfers and retention

Data may be stored on servers located in the United States. For EEA users, the transfer is governed by appropriate safeguards (the European Commission's Standard Contractual Clauses) set out in the contract with the provider.

We keep your data until the platform launches and your account is possibly migrated to the live service, or until you request deletion or withdraw consent.

[ 06 ]

Your rights (EEA / GDPR)

If you are in the EEA, you have the right to access your data, rectify it, erase it, restrict or object to processing, request portability and withdraw consent at any time. To exercise these rights, write to brokebutdreamingstudio@gmail.com.

To request deletion of your data: write to brokebutdreamingstudio@gmail.com with the subject “Data deletion request”, stating the email you signed up with. We will delete your waitlist record (and the related account, if created) within 30 days and confirm by email.

You also have the right to lodge a complaint with your competent supervisory authority (in Italy, the Garante per la protezione dei dati personali — garanteprivacy.it).

[ 07 ]

US residents

This section applies to residents of US states with consumer-privacy laws — including California's CCPA/CPRA and similar laws in Virginia, Colorado, Connecticut and other states. It supplements, and does not replace, the rest of this policy.

Categories collected (last 12 months): identifiers — your name, email address and Google account identifier. We collect no other categories: no financial data, precise geolocation or sensitive categories. Sources are you directly, or Google when you sign in. Purposes are those described above (waitlist, authentication, contact).

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

You have the right to know/access the information we hold about you, to delete it, to correct it, to opt out of the sale or sharing of your data (which we do not do anyway) and to not be discriminated against for exercising these rights. We offer no financial incentives tied to your data.

To exercise any of these rights, write to brokebutdreamingstudio@gmail.com: we verify the request using the email address you signed up with, and respond within the timeframes required by applicable law.

[ 08 ]

Professional outreach contacts

Beyond the waitlist, we occasionally contact independent professionals (photographers, stylists, casting) through the email address published on their professional profile, to introduce Folio.

For EEA users, the legal basis is legitimate interest (Art. 6(1)(f) GDPR) in a single, relevant business contact. We do not profile or build marketing lists: one message per person, never a second.

You can object or report at any time by writing to brokebutdreamingstudio@gmail.com: we delete every reference to your contact within 30 days.

[ 08 ]

The credit graph

If you use Folio as a creative, we build a record of collaborations: your profile (name, city, disciplines), the credits of the projects you took part in (who did what on a shoot) and your affiliations with schools. A credit is confirmed by participants(mutual attestation): it is an attribution of a contribution, not a judgement about the person.

We also give the record initial density by extracting credits already published on public sources(editorials, websites). This data stays non-public until it is claimed and confirmed by the person concerned, and you can object to it or ask for its removal at any time.

Legal basis: for the credits you confirm or add, your consent(Art. 6(1)(a)); for credits extracted from public sources, our legitimate interest (Art. 6(1)(f)) in keeping a reliable record of creative collaborations already made public, balanced against your right to object.

Your rights over the graph: you can rectify (dispute a wrong credit) and erase/object (remove a credit that concerns you). On the public page you’ll find “Report / not me”, usable even without an account by leaving your email; alternatively, write to the email in §01. We exclude the content from public views and act on it without undue delay. We do not make automated decisions with legal effects concerning you.

[ 09 ]

Changes

We may update this policy. The current version is always available on this page, with the last-updated date at the top.