Privacy Policy

Castify.ai operates the Castify self-serve advertising platform. For account data (you, your team, billing) Castify.ai is the controller. For measurement data that advertisers send us through the pixel, conversion API or measurement partners, Castify.ai acts on the advertiser's behalf as a processor or service provider.

• Account data: name, email, sign-in provider, organization, role, theme preference.
• Business data: company name, country, VAT id and, for business verification, registration details and a contact person.
• Billing data: top-ups, invoices and ledger entries. Card details are held by Stripe; we never store card numbers.
• Campaign data: brand kits, creatives, audiences, budgets, and delivery and performance statistics.
• Measurement data: conversion events (event name, value, currency, time) and, with consent, a click identifier and a hashed device or email identifier.
• Usage and security logs: request ids, IP addresses and errors, kept for a limited time.

The Castify pixel and conversion API apply consent rules before storing a conversion:

• Opt-out signals always win: a denied consent, Global Privacy Control, an IAB US Privacy opt-out of sale, or an IAB TCF string without consent for storage and measurement.
• In the EEA, the UK and Switzerland, conversions without consent are stored only as anonymous counts (no click identifier, no device identifier), or not at all for pixels in strict mode.
• In California and elsewhere, conversions are attributed unless the visitor opted out.
• Device identifiers and emails are stored only as one-way hashes.

• To provide the Service: run and optimize campaigns, generate creatives, report results and bill the wallet.
• To keep the Service safe: prevent fraud and abuse, including trial abuse, and verify businesses above the KYB threshold.
• To improve the Service using aggregated and de-identified statistics.
• To communicate with you about your account, campaigns and changes to our terms.

Service providers that help us run Castify (cloud hosting, payments by Stripe, email delivery, AI model providers for creative generation), our media and bidding partners to the extent needed to deliver ads, and authorities where the law requires. We do not sell personal data.

Account and billing records are kept for as long as the account is open and then as long as tax and accounting law requires. Event-level measurement data is kept for a limited period and then aggregated. Data is hosted in the EU (Frankfurt) by default; transfers outside the EEA use appropriate safeguards.

Depending on where you live you can ask to access, correct, delete or export your personal data, object to or restrict processing, and opt out of the sale or sharing of personal data. Write to [email protected]. You can also complain to your data protection authority.