Effective July 8, 2026 · Castopia Inc.
Castopia Inc. (“Castopia,” “we,” “us,” or “our”) operates castopia.ai, an AI-powered platform that helps small businesses and creators generate content, publish to social media, and manage advertising campaigns across multiple platforms. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have — including when you connect a third-party account such as TikTok, YouTube, Instagram, or Facebook. By using Castopia, you agree to the practices described in this Privacy Policy.
Account & profile information. Your name, email address, business/organization details, and any other information you provide when you create an account.
Usage data. Information about how you use Castopia, including features accessed, content generated, and campaigns created.
Technical data. IP address, browser and device information, and similar diagnostic data that helps us operate and secure the service.
Content & brand data. Website content, logos, and brand information you provide or that our AI analyzes to generate on-brand posts and ad creative.
When you connect a social media or advertising account to Castopia, we access a limited set of data from that platform, solely to provide the features you’ve requested (content publishing, scheduling, and/or ad campaign management). We do not sell this data, and we only use it as described below and in each platform’s own developer policies.
What we access. With the user.info.basic scope: your TikTok open ID and union ID, display name, and avatar image URL. With video.list: metadata for videos you have already posted (title, description, cover image, share link, duration, and public engagement counts). We do not access your email address, phone number, date of birth, followers, direct messages, or drafts.
What we do with it. Profile data identifies which TikTok account is connected so you always know where a post is going. Video metadata is shown in your Castopia content library and used to report how your posts performed.
Publishing. With the video.publish and video.upload scopes we post videos to your account — but only ones you have explicitly approved. Every TikTok post is composed by you: you choose the caption, who can view it, whether comments, Duet and Stitch are allowed, and whether the video is disclosed as commercial content. Castopia never posts to TikTok automatically, and our AI agent cannot publish to TikTok on your behalf.
Retention and deletion. Access and refresh tokens are stored only while your account stays connected. Disconnecting the account in Castopia, revoking access from TikTok’s own settings, or deleting your Castopia account removes those tokens and the TikTok data associated with them. See Data Deletion.
What we never do. We do not sell or rent TikTok data, do not share it with third parties for advertising, and do not use it to train AI or machine learning models.
If you separately connect a TikTok Ads account, we use TikTok’s Marketing API to create and manage ad campaigns you have authorized, including audience targeting, budget management, and performance reporting.
What we access. With YouTube’s read-only permission, we access your channel name, channel ID, channel image, and basic channel information so you can identify the account you connected. We do not request permission to edit or delete your existing YouTube content.
Publishing. With YouTube’s upload permission, Castopia uploads only the videos you choose to publish, using the title, description, and visibility you select. Castopia does not publish to YouTube until you authorize the connection and choose a destination.
Storage and sharing. We securely store the OAuth access and refresh tokens needed to keep your channel connected. We do not sell YouTube user data, use it for advertising, use it to train AI or machine-learning models, or share it except with service providers needed to operate the user-facing publishing feature.
Retention and deletion. Disconnecting your YouTube account or deleting your Castopia account removes the stored authorization and associated connection data. You can also revoke Castopia from your Google Account permissions at any time. See Data Deletion.
Basic profile and account information, and — with your authorization — the ability to publish content and, if connected, manage ad campaigns on your behalf.
Page information, and — with your authorization — the ability to publish content and manage Facebook and Instagram ad campaigns on your behalf.
You may revoke Castopia’s access to any connected account at any time from that platform’s own settings, or by requesting deletion as described in Data Retention & Deletion.
Scopes we request, and why. Castopia asks only for the Google permissions behind a feature you turned on, and each one is requested at the moment you connect that feature:
youtube.readonly — read your channel name, ID and image so you can confirm which channel you connected.youtube.upload — upload only the videos you choose to publish, with the title, description and visibility you select.adwords — create, read, pause and report on the Google Ads campaigns you ask Castopia to run. Campaigns are created paused; nothing spends until you activate it.yt-analytics.readonly, analytics.readonly, webmasters.readonly — read performance metrics for the channel, property or site you connect, to show your results and inform recommendations.business.manage — read and update the Google Business Profile you connect, and publish the posts and replies you approve.drive.readonly / drive — list and read the folders and media you choose to import as source footage for videos you make in Castopia.Limited Use. Castopia’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not sell Google user data; we do not use it for advertising; we do not use it to train, and we do not transfer it to, any generalized or personalized artificial-intelligence or machine-learning model; and humans do not read it except with your explicit permission, for security or legal purposes, or on data that has been aggregated and anonymized.
Retention and deletion. Disconnecting a Google account, or deleting your Castopia account, removes the stored authorization and the connection data derived from it. You can revoke Castopia’s access at any time at myaccount.google.com/permissions.
We do not sell your personal information. We may share it:
We use technical and organizational measures — including encryption in transit, access controls, and least-privilege credential handling — designed to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
We retain information for as long as needed to provide the service, comply with legal obligations, and resolve disputes. You can request deletion of your data, including any data obtained from a connected platform, at any time — see our Data Deletion page or email privacy@castopia.ai. Requests are processed within 30 days.
Depending on your location, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing (rights recognized under frameworks such as the GDPR and CCPA). To exercise any of these rights, contact privacy@castopia.ai.
Castopia is not intended for individuals under 13. We do not knowingly collect personal information from children under 13, and will delete any such information if we become aware of it.
Your information may be processed in countries other than your own. Where required, we use appropriate safeguards to ensure your information remains protected consistent with this Privacy Policy.
Castopia may link to third-party websites or services we do not control. We are not responsible for their privacy practices — please review their policies directly.
We may update this Privacy Policy from time to time. We will post the revised policy here and update the effective date above. Material changes will be communicated to you directly where appropriate.
Questions or requests about this Privacy Policy or your data can be sent to privacy@castopia.ai.
By using Castopia, you acknowledge that you have read and understood this Privacy Policy.