Privacy Policy

1Who we are

Castn is operated by Doffy Labs Ltd. For data-protection purposes we are the controller of the personal data described here. You can reach us at privacy@castn.ai.

2Data we collect

Account data

Your email address and an authentication identifier, handled by our authentication provider. We never receive or store your password. If you subscribe, our payment processor holds your billing details — we store only a customer reference and your plan status, never card numbers.

Content you create or upload

Product names, scripts, notes, prompts, captions, product photos, generated images and videos, saved formats, and scheduling metadata. This is stored so the app can show you your own work.

Character photographs — please read this one

If you build a character pack, you upload photographs of a person's face, and we store them against your account. We use them only to generate images and video that resemble that person, at your instruction. These images can identify a living individual and, depending on where you live, may count as a special category or biometric-adjacent data. Two consequences:

• You must have the depicted person's permission to upload and use their likeness this way, and if that person is not you, you are responsible for obtaining it.
• You can delete a character pack at any time from the app, which removes the source photographs from our database.

We do not use your character photographs to train any model, we do not use them to generate content for any other user, and we do not sell or share them.

TikTok account data

When you connect a TikTok account, we receive and store: your TikTok open ID, username, display name and avatar image URL, plus an access token and refresh token so we can act on your instruction. Tokens are stored server-side and are never returned to the browser or exposed through our API. Where you have granted the relevant permission we also read back public metrics for posts Castn created — views, likes, comments and shares — to populate your analytics.

Technical and usage data

IP address, browser and device type, pages and features used, and error diagnostics. We use this to keep the service running and to understand which features are used. We do not use it to build advertising profiles, and we do not sell it.

3TikTok permissions and what we do with them

We request the narrowest set of TikTok permissions that lets the product work. Each is used only for the purpose stated:

We publish only content you have created in Castn and only when you schedule or confirm it. We never post on your behalf without that instruction, never read your private videos, never follow, like, comment or message on your behalf, and never alter your profile.

Data received through the TikTok API is used solely to provide features you can see in the app. It is not sold, not shared with advertisers, and not used to train models.

4Our commitments for TikTok data

We have accepted TikTok's Developer Terms of Service and Data Sharing Agreement, and we hold ourselves to the following specifically for data obtained through the TikTok API:

• We use it only to provide features visible to you inside Castn.
• We do not sell it, license it, or share it with data brokers, advertisers or ad networks.
• We do not use it to train, fine-tune or evaluate any machine-learning model.
• We do not use it to build profiles for targeting, scoring or reselling audience insight.
• We do not combine it with data from other sources to re-identify TikTok users.
• We do not attempt to access content, messages, or account data beyond the scopes you granted.
• We retain it only as long as needed for the feature it supports, and delete it when you disconnect the account, revoke access from TikTok, or close your account.
• If TikTok instructs us to delete data or terminates our access, we comply and delete our copies.
• We keep it within the same security controls as the rest of your account data, described in section 14.

If we ever wanted to use TikTok data for a materially different purpose, we would ask for your consent first and update this policy before doing so.

5AI-generated content

Castn produces synthetic images and video. Where a post is generated by Castn, we flag it to TikTok as AI-generated content at the point of publishing, so it can carry the appropriate label. You remain responsible for complying with TikTok's policies on synthetic media, and for not using generated likenesses to mislead.

6Cookies and similar technologies

We use a small number of first-party cookies and equivalent browser storage to keep you signed in and to remember interface preferences such as your theme. These are strictly necessary — without them the app cannot hold a session.

We also use privacy-respecting product analytics to count feature usage and diagnose errors. We do not run advertising cookies, we do not allow third parties to track you across other sites from Castn, and we do not participate in cross-context behavioural advertising. Where required, we ask for consent before setting non-essential storage, and we honour Global Privacy Control signals as an opt-out.

7Why we are allowed to process it

Where UK/EU data-protection law applies, our lawful bases are: contract, for everything needed to deliver the service you signed up for; legitimate interests, for security, abuse prevention, and product analytics; consent, for connecting a TikTok account and for uploading a third party's likeness, which you can withdraw at any time; and legal obligation, for tax and accounting records.

8Who else processes your data

We use the following sub-processors. Each is bound by contract to process data only on our instructions. Where data leaves the UK/EEA, transfers rely on Standard Contractual Clauses or an adequacy decision.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

9International transfers

We are based in England and Wales and some of our processors operate in the United States. Where personal data leaves the UK or EEA we rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an adequacy decision, together with the technical measures in section 14. You can ask us for details of the safeguards applied to a specific transfer.

10How long we keep it

• Account data — for as long as your account is open, then deleted within 30 days of closure.
• Generated content, formats and character photographs — until you delete them, or within 30 days of account closure.
• TikTok tokens — until you disconnect the account, revoke access from TikTok, or close your account, whereupon they are deleted immediately.
• Post and analytics records — up to 24 months, so year-on-year comparisons work.
• Security and audit logs — up to 12 months.
• Billing records — as long as tax law requires, typically six to seven years.

11Disconnecting TikTok and deleting your data

You can remove your data at any time, and you do not need to contact us to do it:

• Disconnect a TikTok account — in Castn, open Connections and disconnect. We delete the stored tokens immediately and stop all access.
• Revoke from TikTok's side — in the TikTok app, go to Settings and privacy → Security and permissions → Manage app permissions, and remove Castn. Access stops at once.
• Delete individual content — generations, saved formats and character packs each have a delete action in the app.
• Delete your whole account — from account settings, or by emailing privacy@castn.ai. We complete deletion within 30 days.

Deleting content in Castn does not remove posts already published to TikTok. Those live on your TikTok account and must be deleted there.

12Your rights

Depending on where you live you may have the right to access, correct, delete, port, restrict or object to our processing of your data, and to withdraw consent. Under UK/EU law you can also complain to your supervisory authority. If you are a California resident, you have the rights to know, delete, correct and opt out of sale or sharing — we do not sell or share your data as those terms are defined — and we will not discriminate against you for exercising them.

Email privacy@castn.ai and we will respond within 30 days.

13Automated decision-making

Castn generates content automatically, but we do not make automated decisions that produce legal or similarly significant effects about you, and we do not profile you for that purpose. Content generation always runs from a brief you supply and is reviewable by you before anything is published.

14Security

Traffic is encrypted in transit with TLS. Data is encrypted at rest by our infrastructure providers. Database access is constrained by row-level security so one account cannot read another's data. TikTok tokens and all third-party API keys are held server-side only and are never sent to the browser. Access to production systems is limited to personnel who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant regulator as the law requires.

15Children

Castn is not intended for anyone under 18, and you must also meet TikTok's own minimum age to connect an account. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

16Changes

If we change this policy materially we will update the date above and, where the change affects how we use data you have already given us, tell you in the app or by email before it takes effect.

17Contact

Doffy Labs Ltd. Privacy enquiries: privacy@castn.ai. General support: support@castn.ai.