Privacy notice

Effective 16 October 2026. ModelSubmission is operated by ForgeAttest (“we”), ForgeAttest, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom. Contact privacy@forgeattest.com.

What this service does

We provide accounts, private model applications, agency review and messages. You choose the receiving agency. The agency decides whether to consider representation; ModelSubmission does not score people, recognise faces or make automated selection decisions.

Information and purposes

We use your email, account and session identifiers to provide secure access and send service emails. Applications contain the name, city, age, height, experience, introduction and photos you submit. We store application status, agency notes and messages to operate the service you request. The basis for providing your account and requested service is performance of our agreement. We use temporary hashed rate-limit identifiers and limited diagnostic logs for our legitimate interest in preventing abuse and maintaining reliability. We may retain information where necessary to meet legal obligations.

Agency owners supply a business name, website, public contact email, address and introduction. These details appear on their application page. We review them before opening intake.

Who can see your application

You and the receiving agency owner can access your application and conversation. Agency notes are private to that agency. ForgeAttest may access records when necessary for support, rights requests, abuse investigation or service maintenance. We do not sell applications, publish applicant profiles or use uploads to train AI.

The receiving agency is responsible for its own representation decisions and any data it exports. ForgeAttest processes agency application records on its instructions and is separately responsible for account and security information. Contact the agency shown on its application page about its use of your information; contact us for service-related requests.

Hosting and service providers

Cloudflare provides hosting, database, private object storage and transactional email. Photo storage uses an EU-jurisdiction bucket; the database has a Western Europe location hint. This is not a promise that all processing remains in the UK or EU: network handling, email and support may involve other countries. Cloudflare’s data processing terms describe its transfer safeguards. Contact us for relevant safeguard information. Your email provider also handles service messages. UK Postbox handles correspondence sent to our published postal address.

Photos and essential cookies

The application form resizes selected photos on your device and converts them to JPEG before upload, removing embedded metadata from those browser-generated copies. Visible personal details are still visible. Please upload only fully clothed photos you have the right to share. Do not supply identity documents, health information or intimate content. We use essential sign-in and session cookies; there is no advertising or analytics tracking.

Retention and control

Applications, photos, notes and conversations are scheduled for removal 180 days after submission. Withdrawal hides an application from the agency immediately and schedules removal within 30 days, or sooner if its original retention period ends. You can restore it before removal. Account closure hides your applications and agency intake and schedules account removal after a 30-day cancellation period. Daily cleanup removes eligible data; provider recovery copies may persist temporarily under Cloudflare’s retention practices.

Sign-in codes expire after 10 minutes, sessions after 14 days, and temporary rate-limit records after their short enforcement window. Expired records are removed by daily cleanup. Operational diagnostics use Cloudflare’s configured rolling retention. We avoid logging application contents and sign-in codes.

Your rights

You can export account data, view and save photos, withdraw applications and request account closure in the product. Contact privacy@forgeattest.com to correct data or request access, deletion, restriction or portability as applicable. You may object to processing based on legitimate interests. You may withdraw any consent without affecting earlier lawful processing. We normally respond within one month and explain any lawful extension or exception. You can complain to the UK Information Commissioner or your local regulator.

Choice and age

The pilot is for adults aged 18 and over. Required fields are necessary to provide the requested application service; you can choose not to apply. Introductions are optional. We send service messages, not marketing. Material changes will be communicated before applying to existing users.