In short
- You enter card details only on the payment page of Flitt, our Payment Processor, so full card numbers and security codes never reach us.
- Two-factor sign-in and "Sign out everywhere" help you protect your Account.
- We never ask for your password, card number or one-time codes by email, message or phone.
- If you see a payment you did not make, or someone gets into your Account, contact us at once, and your bank too if money is involved.
1. Scope and status
Paid features open in stages. This document applies to each paid feature from the moment the Service offers it with a price and a checkout.
The Account protections and advice in sections 3, 5 and 6 apply now. You accept this policy at checkout. It is one of the Legal Documents listed in the Terms of Service, section 1 "About these Terms".
2. Card payments
Card payments are processed by Flitt, a payment service of Tpay LLC (TBC Group, Georgia). You enter card details only on Flitt's payment page; Sphere Cinema never receives or stores full card numbers or security codes.
- Flitt's payment page is certified under the Payment Card Industry Data Security Standard (PCI DSS). Card numbers never pass through Sphere Cinema's systems, and we hold no such certification of our own.
- Card details travel from your device to Flitt over an encrypted connection (TLS).
- Where your card supports 3-D Secure, your bank may ask you to confirm the payment.
- From Flitt we receive only the payment result and the details needed to record the Order and make Refunds.
3. Account protection
These protections work in the Service today:
- Two-factor sign-in. Under "Security" in your Account settings you can turn on "Two-factor auth": each sign-in then also asks for a code from an authenticator app, with backup codes in case you lose the app.
- Ending sessions. Resetting your password or changing your Account email ends your sessions on every device. "Sign out everywhere", also under "Security", does the same at any time.
- Limits on sign-in attempts. We limit failed sign-in attempts for each email address and each IP address, to slow down password guessing.
- Encrypted connections. We tell browsers to use only encrypted connections (HTTPS) with the Service, and our pages send standard security headers.
- Messages. Messages are encrypted while stored on our servers. The Service holds the key and decrypts messages to deliver and show them, so this encryption protects stored copies and backups. Files, attachments and the message preview in email alerts fall outside it (see the Privacy Policy, section 6 "What other Users and the public can see" and section 11 "Marketing and service emails").
You keep your password secret and answer for activity on your Account (see the Terms of Service, section 4 "Your Account").
4. Fraud prevention
Once payments open:
- Payment checks. Flitt screens payments for fraud and may decline them.
- Seller checks. We verify each Seller, including a sanctions check, before their first Listing goes live and before any Payout (see the Creator and Organizer Terms, section 2 "Becoming a Seller and verification").
- Holds and refusals. We may refuse, cancel or hold a payment or a Payout that shows signs of fraud, money laundering or a sanctions match (see the Legal Compliance Policy, section 3 "Anti-money laundering and fraud").
5. How to protect yourself
- Use a unique password and turn on two-factor sign-in.
- We never ask for your password, your full card number, your card's security code or a one-time code by email, in a message or by phone. Type your password and codes only in the Service itself, and card details only on Flitt's payment page.
- Pay for anything sold in the Service only through the checkout in the Service. A request to pay another way breaks our rules (see the Community Guidelines, section 4 "Conduct that is not allowed").
- Never pay to apply or audition (see the Casting and Hiring Terms, section 5 "What is not allowed in casting" and section 7 "Auditions and safety").
- Protect the email account linked to your Account, since password reset links go there, and sign out on shared devices.
- If a message that seems to come from us asks for your password, a code or card details, do not answer or open its links: forward it to support@sphere.art.
6. If something goes wrong
- A payment you did not make. Contact your bank at once to block the card, then write to support@sphere.art. If we confirm that you did not authorise a charge, we refund it in full, unless your bank has already returned the money. Bank disputes follow the Payment Policy, section 10 "Chargebacks and payment disputes".
- Someone else in your Account. Reset your password with "Forgot password?" on the sign-in page, which ends every session, then turn on two-factor sign-in. If you are still signed in, "Sign out everywhere" ends every session at once. Write to support@sphere.art if you cannot get back in.
- A scam or abuse by another User. Report it as described in the Community Guidelines, section 7 "How to report".
- A data breach. If a personal data breach affects you, we follow the Privacy Policy, section 12 "Security and data breaches", and tell you without undue delay when the risk to you is high.
7. Changes and contact
We may update this document. We tell you about material changes by email and in the Service at least 14 days before they take effect, and at least 30 days before for changes to Seller fees, Payouts or selling rules, as set out in the Terms of Service, section 15 "Changes to the Service and the Legal Documents". Earlier versions of this document are available on request at legal@sphere.art.
Write to support@sphere.art with security questions, suspicious messages or a security weakness you found in the Service.