Privacy Policy

1. Who we are

castomAPI is operated by Castomo prosta spółka akcyjna (Castomo P.S.A.), the data controller for the personal data described in this policy.

We have not appointed a Data Protection Officer, because Article 37 GDPR does not require one for us. Every privacy question or request goes to the address above.

2. What castomAPI is, in one paragraph

castomAPI is an API gateway for businesses and developers. A user creates an account, receives an API key and a prepaid token balance, and calls endpoints — utilities, file conversion, generation, scraping, and integrations with third-party platforms. For an integration, the user connects their own account on that platform through the platform's official OAuth consent screen, and castomAPI then acts on that account only when the user calls an endpoint, and only within the permissions the user granted.

3. The public website (castomapi.com)

The website is a static site. It has no forms, no accounts, no analytics, no advertising and no third-party scripts or fonts, and its content security policy stops the browser from contacting any other host.

• Server access log. The hosting server records each request: IP address, page requested, time, browser user-agent and referring page. It is used only to run and secure the server, is not combined with other data, and is kept for a few weeks by log rotation. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Stored in your browser only, never sent to us: accessibility preferences in localStorage (capi:theme, capi:size, capi:spacing, capi:motion), written only when you change a setting, and an offline cache kept by the service worker. The website sets no cookies.
• "Listen" (read aloud) uses your browser's own speech synthesis. Nothing is sent anywhere.

4. The dashboard and API (app.castomapi.com)

4.1 Account data

Email address, display name, password (stored only as an Argon2 hash), account role, plan and token balance. If you sign in through a castomo ecosystem account, we also store that account's identifier. API keys are stored only as SHA-256 hashes — a key is shown to you once and we cannot recover it.

4.2 Request logs

Every API request is logged for billing, security and troubleshooting. A log record contains:

Request logs do not contain the body of your request or of the response — not your files, not your posts, and not data returned by a connected platform — unless you have switched on request and response storage, which is off by default (section 4.6).

4.3 Content you send through the service

When you call an endpoint, the data in your request passes through our servers so the request can be fulfilled — a URL to scrape, a file to convert, a video to publish to your TikTok account. We process it on your instruction, for that request only, and do not keep it after the response is sent, except where an endpoint's purpose is to store something for you (for example a custom endpoint you created, or a webhook subscription you set up) and except where you have switched on request and response storage (section 4.6).

4.4 Payment data

Payments are processed by Stripe. Card details go directly to Stripe and never reach our servers. We keep the transaction records that accounting law requires.

4.5 Feedback and bug reports

If you send a report through the site or dashboard, we store the message, the email address you give (optional), basic technical context about the page (browser, screen, app version), your account identifier if you were signed in, and your IP address.

4.6 Request and response storage (optional, off unless you turn it on)

What it is. If you choose to turn it on, castomAPI stores what the requests made with your API keys carried and what came back, so you can open any request in the Logs page of the dashboard and see it. It is off by default. Nothing is stored until you switch it on, and the dashboard asks you once before it does.

Why, and the legal basis. Only so that you can inspect and debug your own API calls. The legal basis is your consent, Art. 6(1)(a) GDPR. We do not use stored requests and responses for anything else: not for advertising, profiling, selling, or training machine-learning models. Providing this consent is voluntary; the service and every API call work the same without it.

What is stored. For each request: the query string, the request and response headers, and the request and response bodies, each cut off at 16 KB. The headers include technical details such as your browser or client, and the IP address of the caller as forwarded to our server. Values of fields whose names look secret (for example keys, tokens, passwords, cookies, signatures and the authorization header) are replaced by [redacted] before storing. We do not read the text itself, so a secret or a personal detail written inside free text, such as a prompt, a message or a URL, is stored as sent and can be personal data, including data about your own customers or users. Please do not send data you do not want stored while this is on, and switch it off first if you need to.

Who can see it. In the dashboard, only the account that made the calls. No feature of ours shows these records to anyone else, and we do not look at them. They sit in a database on our servers, so an engineer with administrative access to those servers could technically read them; we do that only where strictly necessary for security or to fix a fault you have asked us to look at.

How long, and where. 30 days from each request, then they are deleted automatically. They are kept in a database on our servers at UpCloud in the EU, and are not shared with anyone else. AI and platform endpoints that you call still receive the content of that call in order to answer it, as described in sections 5 and 9; that happens whether or not you switch storage on.

Switching it off, and deleting. You can switch it off at any time, in Settings → Privacy or on the Logs page, as easily as you switched it on. Switching it off stops new storage and deletes what is already stored for your account at once, and also removes the consent record. You can delete the stored requests and responses without switching it off. Withdrawing consent does not affect the lawfulness of storage before withdrawal. If you close your account, the stored requests and responses are deleted with it (section 7).

Backups. Our servers are backed up every night. The backups are encrypted and the weekly copy is sent to a hosting provider in Poland, where it is kept for 90 days. A stored request or response that you delete can therefore remain in those backups for up to 90 days after deletion. Backups are never read or used for any purpose other than recovering our systems, and if one is ever restored, deletions made since are applied again before the service resumes.

If your content contains other people's data. If the requests you send contain personal data of your own customers or users, you are the controller of that data and, for this storage, we act as your processor. See section 9A of the Terms.

Your rights. Access, correction, erasure, restriction, portability, and withdrawing consent at any time (see section 11).

5. Connected third-party platforms

5.1 What we store for every connected platform

When you connect a platform, we store:

• the access token the platform issues, and a refresh token if it issues one — both encrypted at rest with AES-256-GCM;
• when the token expires;
• the identifier of the connected account or workspace (for example a TikTok open_id, a Shopify shop domain, a Slack workspace id) and a display name for it, so the dashboard can show which account is connected;
• the permissions that were requested.

We do not copy your platform data into our database. Profile details, statistics, video lists, messages, files and other content are fetched from the platform at the moment you call an endpoint, returned to you in the response, and not kept. The only exceptions are events a platform pushes to us because you subscribed to them (for example Facebook Page webhook events), which are stored in your account so you can read them, and deleted with it.

5.2 How we use platform data — the same rules for every platform

• We access a platform only when you, the account holder, call an endpoint that needs it. Nothing runs in the background on your connected account.
• We use platform data only to provide the feature you called, and return it to you.
• We never sell platform data, never use it for advertising, never use it to build user profiles, never share it with anyone other than the sub-processors in section 9 that the request needs, and never use it to train machine-learning models.
• We never ask for more permissions than the features need.

5.3 TikTok

castomAPI uses TikTok's Login Kit and Content Posting API. When you connect your TikTok account you are asked to grant these permissions, and each one is used only for the purpose shown:

What we keep from TikTok: the encrypted access and refresh tokens, your TikTok open_id and display name. Everything else is read live and not stored. A video you publish is held in server memory only while it is being sent to TikTok and is not written to disk or kept afterwards. We publish only the content you send, only when you send it.

To remove castomAPI's access: disconnect TikTok in the dashboard (section 7), and remove castomAPI under TikTok → Settings and privacy → Security → Manage app permissions.

5.4 Google

castomAPI's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you call, is not transferred except as needed to provide those features, to comply with law or as part of a merger with notice, is not used for advertising, and is not read by any person unless you give us permission, it is needed for security, or the law requires it.

5.5 Meta (Facebook and Instagram)

castomAPI uses Meta platform data only for the features you call, in line with the Meta Platform Terms. To request deletion of data received from Meta, follow section 7 — the same process covers it.

5.6 Other platforms

The same rules apply to every other platform you can connect, which at the time of writing includes GitHub, GitLab, Shopify, Shoper, WordPress, Slack, Discord, Notion, Twitch, Pinterest, Snapchat, LinkedIn, Microsoft 365, Dropbox, Asana, Airtable, Trello, Salesforce, HubSpot, Miro, monday.com, Typeform, Calendly, Netlify, Cloudflare and YouTube. Each platform's own privacy policy also applies to your account on that platform.

6. Why we process data, and the legal basis

7. How to delete your data

Disconnect one platform. Sign in at app.castomapi.com, open the platform's card and press Disconnect. The stored connection — including the encrypted access and refresh tokens — is deleted from our database immediately, not deactivated or archived.

Disconnecting deletes our copy of the token but does not revoke the permission on the platform's side. To revoke it there too, remove castomAPI in that platform's own app-permission settings (for TikTok, see section 5.3).

Delete your whole account. Email api@castomo.com from the address your account uses, with the subject Delete my account. We delete your account, API keys, wallet, every stored platform connection, every stored webhook event and any stored request and response content (section 4.6), and reply to confirm. We answer within one month, usually within a few working days.

Two things account deletion does not remove: request-log records, which are deleted automatically when they are 12 months old, and invoices and accounting records, which Polish tax law requires us to keep for five years. Neither contains the content of your requests or data from connected platforms. Encrypted backups (section 4.6) age out within 90 days.

8. How long we keep data

9. Who else processes data (sub-processors)

Each one receives only what the specific request needs.

A connected platform (TikTok, Google, Meta and the others in section 5) is not our sub-processor: you hold your own account there, and we send it only what you instruct us to send.

Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

10. Cookies

• castomapi.com sets no cookies.
• app.castomapi.com keeps your sign-in token in your browser's localStorage, not in a cookie; it is sent to us only as an authorization header on requests you make, and clearing your browser storage signs you out. The only cookie the dashboard sets is short-lived: it is written when you start connecting a platform account, checks that the response coming back belongs to the request you started, and is cleared as soon as that flow returns. It is strictly necessary, so it needs no consent. We use no advertising or analytics cookies anywhere.

11. Your rights

Under the GDPR you may ask for access to your personal data, correction, erasure, restriction of processing and portability, you may object to processing based on legitimate interest, and you may withdraw a consent you gave (such as request and response storage) at any time, as easily as you gave it, without affecting what was done before. Write to api@castomo.com; we answer within one month.

You may complain to the Polish supervisory authority, the Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl), or to the authority in your own EU country.

12. Security

• Platform access and refresh tokens are encrypted at rest with AES-256-GCM.
• API keys are stored as SHA-256 hashes; passwords as Argon2 hashes.
• All traffic is served over HTTPS.
• Databases are not reachable from the public internet.
• A platform connection can only be started from a signed-in dashboard session, and every connection flow is protected against request forgery.

No system is perfectly secure. If you find a vulnerability, report it to api@castomo.com instead of disclosing it publicly.

13. Children

castomAPI is not intended for anyone under 18, and we do not knowingly collect data from children.

14. Changes to this policy

We update this policy when the service changes. The date at the top always shows the current version. Account holders are told by email before a material change takes effect.