Privacy Policy

Version 2026-10-16.1. Applies from publication.

Who we are

Castframe is operated by Theo Pantazi, trading as Castframe, Tagliaferro Business Center, High Street, Sliema, Malta SLM 1549. Contact privacy@castframe.app for privacy requests and support@castframe.app for service help.

We control the processing of account, billing, trial, security, support, waitlist and website information. For personal data in creative content supplied under a customer's instructions, we act as processor; our Data Processing Agreement covers that relationship. A business customer may act for another controller.

Information and purposes

We process your email, sign-in and verification records, account identifiers and profile settings to provide and secure your account. Optional business details, logos, colours and fonts personalize the workspace. Campaign text, images, layouts, thumbnails, fonts and related records support saving, displaying, rendering and exporting your work.

Stripe-hosted payment information, customer/subscription references, invoices, payment outcomes and purchase/access history support subscriptions, accounting and disputes. Stripe collects payment credentials in its hosted forms; Castframe does not collect full card numbers in its own forms.

Trial records include the original interval, conversion/access facts, account UUID and a mode-specific SHA-256 hash of normalized email. We use these to prevent repeat trials and preserve access history. Hashes and UUIDs are personal data where linkable, not anonymous records.

Support/privacy correspondence and necessary references let us answer and verify requests. Infrastructure receives network/request metadata, including IP and browser/device details where applicable, to deliver and protect the service. Optional website analytics is separate. Waitlist email is used for the requested launch notification, not an unrelated newsletter.

Legal grounds and choices

We rely on contract performance or requested pre-contract steps for necessary individual-account/service processing. Business-contact administration, security, reliability, fair trial access and necessary legal claims rely on legitimate interests, subject to necessity, balancing and your right to object. Applicable financial record keeping relies on legal obligations. Optional analytics and the requested waitlist notification rely on your consent where required.

You choose whether to supply optional brand details, request AI or join the waitlist. Information necessary for authentication, purchases or a requested feature is required for that activity. Access is evaluated from verified trial, grant and payment facts. We do not use this to make decisions with legal or similarly significant effects on you; contact support for human review of an incorrect access or eligibility result.

Optional AI and your OpenAI key

Optional generation uses your own OpenAI account and API key, with usage billed separately by OpenAI. You contract directly with OpenAI and direct Castframe to transmit the selected prompt or copy brief and return its result. OpenAI is a customer-directed third party for this feature.

Copy requests can include the Campaign name, objective, context, audience, tone, destination URL and supplied business context. Image generation sends the text prompt. We do not automatically send the whole workspace or all uploaded images. Send only what is needed.

The key is saved as text in browser-wide localStorage until you remove it or clear site data. Different Castframe accounts in the same browser do not have isolated keys. It passes through Castframe's HTTPS API during generation. Generation handlers do not save it in our database or create a separate prompt archive. Inputs/outputs saved in Campaigns or browser caches follow their ordinary storage rules. No exhaustive all-provider no-logging, zero-retention or EU-only processing promise is made. Remove the key on each device and revoke it at OpenAI when appropriate.

Providers, locations and transfers

We do not sell personal information or share it with others for financial gain. Necessary service-provider processing supports the purposes described here.

Customer-content subprocessors and contractual safeguards are listed in the DPA. Primary storage location does not exclude international support or onward processing. Transfers use applicable adequacy decisions or contractual safeguards, including relevant standard contractual clauses. US adequacy applies only within the scope of a participating recipient; it is not universal. Contact privacy@ for relevant safeguard information, subject to necessary security/confidentiality redactions.

Our font functionality requests Google-hosted font files where needed; those requests disclose network information to the font provider. They are separate from Analytics. See the Cookie and Browser Storage Notice.

Cookies and analytics

Necessary authentication, security, consent and requested workspace storage supports the service. Cookie settings lets you accept, reject or later withdraw optional statistics consent. Rejecting optional storage does not prevent necessary account/workspace access.

Google Analytics tag G-X14TQ77QPZ loads only after a saved statistics choice on https://castframe.app and only on the public home and support pages. Manual page views use fixed canonical URLs/titles without query strings or page referrers. Workspace, sign-in/signup, creative and billing activity are excluded. Advertising features and Google signals are disabled in our integration; automatic Enhanced Measurement is disabled. We do not describe analytics as anonymous. Online identifiers and associated page/device/network information may be personal data. The property is configured for two-month event-data retention and fourteen-month user-data retention, with the latter reset on new user activity. These controls do not cover most aggregate standard reports or determine cookie expiry. Withdrawing consent stops further permitted collection but does not retroactively erase already collected records. Contact privacy@ for an applicable erasure request.

Retention, return and deletion

Saved content is held for your instructed service while the account is open, until selected deletion or the end of relevant processing. Paid/trial expiry and renewal cancellation preserve saved-work viewing; they are separate from account closure. There is no automatic dormant-content purge. We review necessity after twelve months of inactivity and annually afterwards.

Request secure return, selected deletion or closure through privacy@. After proportionate verification, we arrange readable structured data and original source bytes when return is chosen before destructive cleanup. The preparation target is seven days after sufficient identity/scope information, ordinarily with an agreed retrieval window up to fourteen days. We aim for ordinary active-system cleanup within fourteen calendar days of a clear, sufficiently verified instruction. These are handling targets, not automatic waiting periods or an all-provider erasure deadline. Temporary delivery copies are targeted for removal within twenty-four hours after receipt or retrieval-window expiry. We explain actual completed, retained and pending scope.

Completed HTML5 exports have a twenty-four-hour delivery period from completion, followed by scheduled cleanup. R2 has a two-day object lifecycle fallback measured from upload. Private source files have a different purpose. Existing signed links, caches and downloaded copies may remain usable until removed or expired; we cannot recall files or clear all your devices.

Weekly owner-device backups to a dedicated unshared Workspace Drive folder cover database records and current referenced uploaded originals (images, logos and fonts). Generated files/exports, R2, thumbnails, temporary files and caches are excluded. We keep the last five completed weekly sets and delete older ones without Drive trash. With timely rotation a set lasts about thirty-five days; administrator recovery may add up to twenty-five days. Missed runs, failures, Google internal deletion and any lawful hold have separate effects, so this is not a fixed all-copy deadline. Recovery copies are restricted from routine processing, and deletion restrictions must be reapplied before restored information becomes accessible.

Necessary financial/transaction records follow the applicable legal period and any specific lawful hold. Maltese income-tax business records generally require at least nine years after completion of the relevant transaction or operation; applicable VAT rules may use six years from the relevant year or later return/correction, and relevant OSS records ten years from the transaction year. We apply the duties that actually cover the records and the latest applicable expiry, rather than applying every period to every account or creative file.

We normally retain routine support correspondence for twelve months after resolution and remove unnecessary content attachments promptly, targeting thirty days, subject to necessary commercial/tax correspondence, a dispute or a specific duty. Raw privacy-case correspondence normally follows twelve months after resolution; minimal outcome evidence has a three-year review/disposal point. Optional consent evidence is retained while relied on, then has a three-year review point after the relevant reliance ends, unless transaction-record duties apply.

Operational/error logs have a thirty-day internal target; authentication/security logs ninety days. Actual provider-controlled retention may differ. Necessary incident evidence, unresolved events and financial subsets follow their specific purpose. We review resolved webhook payloads after ninety days, preserving required reconciliation and financial/trial facts. These are not claims that every provider automatically deletes on these dates.

Minimal permanent trial claims and necessary identity/trial/conversion anchors remain under current product rules to prevent deletion/recreation from restarting a trial. We review necessity and minimization annually and when the trial programme changes, and handle objections individually. Ongoing grants and immutable access/audit history have their own integrity purpose and review schedule. Closing Auth does not erase required billing/trial history or relink it by email.

Your rights

Where conditions apply, you may request access/copies, correction, erasure, restriction, portability or object to legitimate-interest processing. Withdraw optional consent at any time without affecting earlier lawful processing. Portability concerns qualifying data you provided under automated consent/contract processing; it does not promise automatic import into another editor.

Email privacy@ from your account address where possible and identify the requested scope. Do not send passwords, API keys, full card details or unsolicited identity documents. We use proportionate verification and assist the relevant customer for customer-controlled content. We ordinarily explain action within one month of receipt; where justified by complexity/number, up to two additional months may apply with reasons given within the first month. Required erasure proceeds without undue delay, subject to lawful exceptions; a response period is not a physical-erasure deadline.

You can complain to a competent supervisory authority, including Malta's Information and Data Protection Commissioner, and seek a judicial remedy. You need not complain to us first.

Security and changes

We use authenticated ownership checks, restricted client writes, private source/export storage, bounded signed delivery and account-closure restrictions. Authorized providers/operators can access readable processing where necessary; no absolute security or end-to-end encryption claim is made. Material notice changes are communicated appropriately; a new consent is requested where required.