PPL Privacy Policy

Version: privacy-policy-v1.5 · Effective: 2026-10-21 (v1.5 adds PostHog product analytics, a cookie banner to turn it off, and session replay on public marketing pages; prior opt-outs and Global Privacy Control remain effective; see §2.3, §2.5 and §8) Who we are: PPL Marketplace, Inc., a Delaware corporation ("PPL," "we," "us"). Contact: privacy@therealppl.com. [registered address — counsel to fill]

The short version

We run a marketplace where verified, consenting people license their image, voice, and personal stories to brands, and an AI studio produces clearly labeled content only from what people have consented to. That means we handle sensitive data — identity documents, biometric verification, photos, voice recordings, sometimes health or financial life experience — and this policy is written to the strictest standard that applies to any of it, everywhere we operate.

Plain commitments, up front:

1. You own your likeness. Licensing through PPL never transfers ownership. Every license is scoped, time-boxed, and renewable — never perpetual.
2. Biometric data is for verification only. It is never sold, leased, traded, licensed, or put in any deliverable, and we never profit from the biometric data itself.
3. Consent before capture, always. Nothing about you becomes usable material without your specific, informed, written consent — separately for biometric processing and for AI augmentation.
4. Revocation is real and forward-looking. Withdraw consent and your live verification goes dark immediately, new AI generation stops immediately, and delivered in-term work winds down on the terms you agreed to (details in §9).
5. Your sensitive information is not advertising data. We do not provide your likeness, profile answers, identity documents, biometric information, or payment details to advertising platforms. We share limited visit, completed-registration and saved campaign-application information with Meta under the regional measurement choices described in §2.5. You can turn that measurement off.
6. Adults only. PPL is for people 18 or older, identity-verified.

The rest of this policy is the detail behind those sentences.

1. Who this policy covers

• Members — people who create an account to license their image, voice, or narrative ("you," in most of this policy).
• Brand users — individuals acting for a company that licenses through PPL.
• Visitors — anyone browsing our sites.
• Candidates (sourcing leads) — people we have identified from public sources but who have not yet spoken to us. This category gets its own section (§4) because we hold ourselves to specific limits there.

2. What we collect, and why

2.1 Members

2.2 Brand users

Business contact details, role and seat authority, company and billing information, Brand Compact and terms acceptances (versioned, hashed, timestamped), project briefs, and usage of licensed material for scope monitoring.

2.3 Visitors

We collect minimal technical data, including IP address, browser type and pages viewed, for security and to make the site work. Cloudflare Web Analytics measures visits and page performance in aggregate. PostHog product analytics measures which pages and signup, onboarding and verification steps people reach, so we can fix where they get stuck (§2.5). Meta Pixel measures visits to our creator and retail campaign landing pages, completed new accounts, and saved retail campaign applications under the regional measurement choices described in §2.5. We honor Global Privacy Control (§10).

2.4 What we deliberately do not collect

No data from anyone under 18. No scraped photos or voice as usable material (§4). No biometric data from brand users or visitors. No precise geolocation. No purchase of data-broker profiles about members or candidates.

2.5 Cookies and local storage

Cloudflare Web Analytics, provided by our hosting provider, counts visits and measures page performance in aggregate. It sets no cookies, does not fingerprint your device or browser, and does not track you across other sites.

PostHog product analytics is on by default and helps us see which pages help and where people drop out of signup, onboarding and identity verification. It uses first-party cookies and local storage (names starting with ph_). It records page views, clicks on the public site, and named steps such as "signup email sent" or "identity check started". Once you have an account, those steps are linked to your account's random ID, never your name or email. Page addresses are stripped of everything except campaign tags (utm_*), so sign-in links, account IDs and email addresses are never sent. On our public marketing pages PostHog may also record a session replay — mouse movement, scrolling and clicks — with every form field masked. Session replay never runs on signup, sign-in, onboarding, identity-verification, capture or dashboard pages, and on those pages PostHog receives only the named steps: never what you type, your answers, photos, voice, identity documents, biometric information or payment details. PostHog processes this data for us under contract and does not use it for advertising. A cookie banner appears on your first visit; choose Decline there, or at any time on Cookie choices, to turn PostHog off and remove its cookies. We also keep it off when your browser sends Global Privacy Control or Do Not Track. Your choice is stored in the browser where you make it.

Meta ad measurement is on for visits identified as coming from the United States unless you have turned it off or send a Global Privacy Control signal. A notice and a way to turn it off appear when you enter the creator or retail campaign funnel; you do not need to click an acceptance button to continue. We use the country signal supplied by our hosting provider to select this setting, without requesting precise location or browser location permission. For other countries, or when the country cannot be determined, Meta measurement stays off unless you choose to allow it. A previous choice to turn measurement off remains in effect when this policy changes.

When measurement is on, Meta Pixel receives creator and retail campaign landing-page views, successful new-account registration events, and saved retail campaign application events. A retail application event includes only its next-step category (call-ready, learning resources, or review); call-ready applications also produce a separate qualification event. These events do not mean a call was booked, a pilot was accepted, or a purchase was made. Meta also receives device and browser information and advertising identifiers. Meta may match this information to a Meta account and process it under its own privacy policy. We do not send names, email addresses, phone numbers, brand names, submitted store URLs, creative counts, written application answers, profile answers, photos, identity documents, biometric information, payment details, or authentication tokens with these events. We do not load the Pixel on the initial signup form, sign-in, onboarding, profile or identity-verification pages. On signup, it loads only after a confirmed new member account is created and measurement is permitted by your choice and the regional setting.

Meta measurement may use cookies including _fbp and _fbc. PPL stores an explicit choice to turn measurement off in your browser until you change it or clear site data. An explicit choice to allow measurement is stored for up to 180 days. When measurement is permitted, campaign attribution is stored for up to 30 days. One-way registration and retail application markers are stored locally to reduce duplicate event attempts and remain until you clear site data. Raw account and application identifiers are not sent with these events. Browser storage also holds functional data such as your theme preference, Supabase session and in-progress forms.

Use Privacy choices, Retail privacy choices, or Do Not Sell or Share My Personal Information, then Turn off ad measurement, to stop measurement. You can also contact privacy@therealppl.com about your privacy rights. Turning measurement off stops future measurement and removes PPL's stored campaign attribution and Meta cookies under our control. It does not recall information already received by Meta. We honor Global Privacy Control received through the browser or the request to our site, even if you previously allowed measurement. Your choice is stored in the browser where you make it; use the control in each browser you use, or enable Global Privacy Control. Turning measurement off does not prevent account creation, campaign applications or platform access. Web fonts may involve requests to Google Fonts, which receives the technical request data needed to serve them.

3. Where data comes from

Directly from you; from your interactions with the platform; from our verification, payments, and e-signature providers (limited to what each returns about you to us); and — for candidates only — from public sources under the §4 limits. We do not buy personal data about you.

4. Candidates: how sourcing works before you've ever talked to us

Some people first appear in our systems because a brand brief called for, say, a cardiologist in Ohio, and public signals (professional profiles, published work, public social presence) suggested a match. Our rules for this stage:

• We store a lead, not a likeness: public, non-biometric attributes only (apparent profession, location, public statements, follower scale).
• We never extract biometric templates from scraped media, never use a scraped image or voice as an asset, and never train AI on scraped material. A scraped photo cannot become a deliverable. Ever.
• Our first message to you says who we are, what we're proposing, that anything we hold came from public sources for matching only, how to decline, and how to have the data deleted.
• If you decline or don't respond, the lead is deleted within 90 days.

5. Biometric data policy

This section is PPL's written biometric policy, published per Illinois' Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, Washington RCW 19.375, and their counterparts. Where state definitions differ, we apply the strictest applicable standard.

What we process. (a) A scan of face geometry, created by our identity-verification provider when it compares your verification selfie to your ID document; and (b) if — and only if — you license your voice, a voiceprint/voice model derived from recordings you provide.

Written consent before capture, every time. Before any biometric identifier or biometric information is captured, we tell you in writing what is collected, why, and for how long, and we obtain your written consent by electronic signature. Biometric consent is captured separately — it is never bundled with the license grant or the AI-augmentation consent, and it is never pre-checked.

Prohibitions we accept as binding on us:

• We do not and will not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. (The thing licensed on PPL is a scoped use of your likeness — never the biometric data itself.)
• Biometric data is never included in any deliverable to a brand, never licensed, never sublicensed.
• No disclosure to third parties except: our verification/processing providers under contract (§8), with your consent, or as required by law.

Where the raw data lives. The biometric template created during identity verification is held by our verification provider under a data-processing agreement; PPL stores the inquiry reference and the pass/fail outcome, not the template. Voice models exist only for members who separately consented to voice licensing, and are destroyed on revocation (§9).

Retention & destruction schedule. We permanently destroy biometric identifiers and biometric information on the earliest of: (a) the initial purpose for collection is satisfied; (b) you revoke the consent that supports it; (c) your account closes; (d) 1 year after the purpose for collection expires; or (e) 3 years after your last interaction with PPL. Destruction propagates to our providers by contract.

No waiver, ever. We never ask you to waive a statutory biometric right.

6. Sensitive data and lived experience

Some of PPL's most valuable stories are sensitive — a diagnosis, a recovery, a bankruptcy survived. Rules:

• Sharing is optional and yours to initiate. It is never required to be a member.
• Sensitive attributes are person-held and match-gated: a brand sees only what you chose to reveal, for that one brief, after your explicit accept. Brands are contractually barred from re-identifying anyone, cross-referencing matches against outside data, retaining declined matches, or treating a condition as a targeting attribute.
• Sensitive attributes are never published as search keywords and never used for advertising.
• Consumer health data is processed only with your consent and is never sold.

7. AI augmentation and what "training" means here

• AI-generated or AI-augmented content is produced only from consented, directly captured material, within a specific license's scope, after your separate AI-augmentation consent. Every output links back to your consent record and carries provenance (C2PA Content Credentials) and AI-made labeling. Brands may not strip either.
• We do not use your data to train general-purpose AI models. Models or fine-tunes derived from your assets exist solely to generate content for licenses you approved, are bound to your consent record, and are destroyed when the consent that supports them ends.
• Outputs must remain a faithful, non-degrading representation of you; the fidelity-and-dignity rule is contractual, not aspirational.

8. Who we share data with

• Brands — only: the profile facts you chose to show, match reveals you accepted, and licensed deliverables. Never your biometric data, verification documents, payout details, or declined matches.
• Processors under contract (data-processing agreements, least-privilege, no independent use): identity verification, payments, e-signature, cloud infrastructure and database, email, workflow automation, and product analytics (PostHog, §2.5) providers. The current provider list is available on request to privacy@therealppl.com.
• Meta, only for ad measurement you can turn off: under the regional choices described in §2.5, Meta receives limited event, device/browser and advertising-identifier information and may process it under its own privacy policy. It receives none of the sensitive platform data listed there.
• Professional advisers and authorities — where law requires; we notify you unless legally barred.
• Corporate events — if PPL is acquired or merges, this policy's commitments travel with the data; a successor is bound to the consent records as recorded, including their revocability.
• No data brokers. We do not provide personal data to data brokers. Advertising measurement is limited to the sharing with Meta described in §2.5, which you can turn off; it does not include licensing, profile, verification, biometric or payment data.

8.1 Transparency-reporting disclosures for health-care professionals

If you are a licensed health-care professional and you license through PPL to a pharmaceutical or health client, federal transparency law adds a disclosure you should know about before you accept the engagement:

• What is disclosed, and to whom. For each payment made to you under such a license, PPL provides the client the record it needs for CMS Open Payments reporting: your name, National Provider Identifier (NPI), state license number and state, specialty/taxonomy, primary practice address, and the payment's amount, date, nature of payment, and related product. Providing this identity accurately is a condition of pharma engagements (Terms of Service B7).
• Why. The Physician Payments Sunshine Act (42 U.S.C. §1320a-7h) obliges the client — the "applicable manufacturer," not PPL — to report these transfers of value to CMS, and CMS publishes the reported data publicly each year on the Open Payments website. PPL prepares the data; the client submits and attests.
• Legal basis. Where GDPR-style law applies: the client's legal obligation and our documented legitimate interest in enabling it, together with the contract you accepted — the license agreement's pharma overlay (Schedule C) states the reporting duty before you accept.
• You see it first. Your dashboard shows your pending report lines — what the client will report to CMS about this license — before publication.
• These records are books and records. Transfer-of-value records supporting a report already made or legally required are retained as compliance books-and-records and are not deleted on revocation or account closure (§9, §11). Revocation stays forward-looking: it stops new work; it does not un-report a payment already made and already reportable.

9. Revocation, deletion, and what happens to what

Revocation is forward-looking, and honest about what that means:

1. Immediately on revoke: your live verification mark and verify page go dark; new AI generation in your likeness/voice stops; your profile leaves matching.
2. Biometric data supporting the revoked consent is destroyed per §5, including at providers.
3. Delivered, in-term, in-scope, paid work doesn't vanish retroactively — it winds down on the schedule in the license you accepted (default 30-day wind-down). Withdrawing consent doesn't make past lawful processing unlawful, and a paid, in-scope campaign isn't clawed back mid-flight.
4. Exception — immediate pull: out-of-scope, harmful, defamatory, or exclusion-violating uses come down immediately, mid-term or not.
5. Consent and license records survive in the ledger even after deletion of content, because they are the legal proof of what was and wasn't permitted — retained per §11, access-restricted.
6. Transparency-reporting records survive the same way: a health-care professional's transfer-of-value records supporting a report already made or legally required (§8.1) stay on the books — revocation and account closure never un-report a payment already made.

10. Your rights

Everyone: access, correction, deletion, and a copy (portability) of your personal data; no retaliation or discrimination for exercising rights. Exercise via privacy@therealppl.com or your dashboard. We verify requests; an authorized agent may act for you; if we refuse, we explain why and you may appeal by replying to our decision — appeals are reviewed by someone other than the original decision-maker.

United States. We extend the core rights above to all US members regardless of state. You can use Privacy choices or Do Not Sell or Share My Personal Information to turn off the advertising data sharing described in §2.5. This control is available to all visitors, including California residents exercising their right to opt out of sale or sharing. We honor Global Privacy Control by keeping that measurement off. We limit sensitive personal information to the purposes you consented to; the categories collected are those in §2, and category-level detail for the look-back period is available on request. Illinois residents: §5 is your BIPA disclosure and written-policy publication. Washington residents: §6 states our consumer-health-data posture; health data is processed only with consent and never sold.

EU/UK (where applicable). Legal bases: contract (operating your account and paying you), consent — explicit for biometric and special-category data — and documented legitimate interests (security, §4 sourcing). Rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent (as easy as giving it), and complaint to your supervisory authority. International transfers use Standard Contractual Clauses. AI-generated content is labeled and machine-readable per EU AI Act Article 50.

11. Retention schedule

12. Security

Encryption in transit and at rest; least-privilege, role-based access; biometric raw data held at the verification provider, not on PPL infrastructure; keys and secrets managed server-side; logging and audit trails on consent-state changes; vendor security review before any processor touches member data. We maintain a documented breach-response process: containment, assessment, and notification to you and regulators within the timelines each law sets.

13. Children

PPL is 18+ only, enforced by identity verification, not a checkbox. We do not knowingly hold data on anyone under 18; if we learn we do, we delete it and close the account.

Members may optionally tell us the coarse age bands (for example "under 5" or "6–12") of their own children, and nothing more, so that casting can match a family brief. That field is shown only when the member has separately consented to display it, is never verified against or linked to any record of the child, is erased the moment the member withdraws it or leaves PPL, and is never licensed or put in a deliverable. Beyond that optional field, PPL holds no data about minors.

14. Changes to this policy

Versioned like everything else. Material changes are notified before they take effect; where consent rests on the changed text, we re-ask — silence is not consent. Prior versions remain available.

Advertising measurement choices are separate from accepting account terms. US measurement uses the opt-out setting described in §2.5; we do not treat account-terms acceptance as measurement consent. Where measurement requires a choice to allow it, that choice remains separate. Previously stored opt-outs remain in effect, and Global Privacy Control continues to turn measurement off.

15. Contact

PPL Marketplace, Inc. · [registered address — counsel to fill] · privacy@therealppl.com

People are people on PPL — this policy governs data about you; it never makes you the product.