Privacy Policy

Castiva is a social media management platform operated by Goptimise ("we", "us"). This policy explains what personal data we collect, why, and the choices you have. It applies to the Castiva application and website. For questions or requests, contact [email protected].

Account data — your name, email address, password (stored only as a salted hash), and team membership/role within an agency.

Social account data — when you connect a social channel, we receive the account's identifier, name/handle, avatar, follower and performance statistics, and OAuth access tokens. Tokens are encrypted at rest (AES-256-GCM) and used only to provide the Service.

Content — media you upload, posts you compose, prompts you submit to AI tools, and the content those tools generate for you.

Billing data — your subscription status, plan, and usage counts (for example the number of AI generations, used for metered billing). Card details are collected and processed by Stripe; we never see your full card number.

Technical data — logs, IP addresses, and basic request metadata used for security (such as rate limiting) and troubleshooting.

We use only cookies that are necessary to operate the Service (session/authentication cookies). We do not use advertising or cross-site tracking cookies.

• to provide the Service: schedule and publish posts, sync statistics, store media, and generate AI content you request;
• to bill you, including reporting metered usage to Stripe;
• to secure the Service: authentication, tenant isolation, rate limiting, and abuse prevention;
• to support you and communicate service messages (such as invitations you request, payment issues, or material changes);
• to comply with legal obligations.

We do not sell personal data, and we do not use your content or connected-account data for advertising.

Where the GDPR applies, we process data on these bases: performance of a contract (operating your account and publishing your content), legitimate interests (service security, preventing abuse, improving the Service), legal obligation (tax and accounting records), and consent where required (for example, connecting a social account, which you can revoke at any time).

We share data only with processors needed to run the Service, under agreements that limit their use of it:

• Stripe — payments, subscriptions, and metered billing;
• Hosting and storage providers — running the application and storing your media;
• AI providers — Anthropic (text), fal.ai (images and video), and ElevenLabs (voiceovers) receive the prompts and, where applicable, the media needed to fulfil a generation you request. They process this data to provide the generation;
• Social platforms — Meta (Facebook/Instagram), Google (YouTube), and TikTok receive the content you publish and return account statistics, under their own privacy policies.

We may also disclose data if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to data collected before the change).

Data received from connected platforms is used solely to provide the features you use — showing your channels and statistics, and publishing the posts you schedule. We do not sell platform data or use it for advertising.

Google/YouTube. Castiva uses YouTube API Services. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's privacy practices are described in the Google Privacy Policy. You can revoke Castiva's access to your Google data at any time via Google security settings.

Meta and TikTok.You can revoke Castiva's access at any time in your Facebook/Instagram or TikTok app settings, or by disconnecting the channel inside Castiva — disconnecting deletes the stored tokens for that channel.

We keep your data while your account is active. Disconnecting a social channel deletes its stored tokens; deleting media, posts, or companies removes them from the active Service. When your account or agency is deleted, we delete associated personal data within 30 days, except records we must keep for legal reasons (such as billing records) and short-lived encrypted backups that expire on their own schedule.

To request deletion of your account and data — including data obtained from connected social platforms — email [email protected] from your account email. We will confirm completion once processed.

We use industry-standard measures: encrypted connections (HTTPS), social tokens and provider secrets encrypted at rest (AES-256-GCM), salted password hashing (bcrypt), per-tenant data isolation enforced in every query, role-based access, and rate limiting on authentication endpoints. No system is perfectly secure; notify us at [email protected] if you suspect a vulnerability or breach.

Our processors may store or process data outside your country, including in the United States. Where the GDPR applies, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or adequacy decisions.

Depending on where you live (including under the GDPR), you may have the right to access, correct, export, restrict, object to the processing of, or delete your personal data, and to withdraw consent. Exercise these rights by emailing [email protected]. You also have the right to lodge a complaint with your local data-protection authority.

The Service is not directed to children and may not be used by anyone under 18. We do not knowingly collect data from children.

We may update this policy from time to time. For material changes we will notify you before they take effect (for example by email or an in-app notice). The "Last updated" date above always reflects the current version.

Goptimise · [email protected]

See also our Terms of Service.