Effective October 14, 2026 · Castopia Inc.
Castopia Inc. (“Castopia,” “we,” “us,” or “our”) operates castopia.ai, an AI-powered platform that helps small businesses and creators generate content, publish to social media, and manage advertising campaigns across multiple platforms. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have — including when you connect a third-party account such as Google Ads, YouTube, TikTok, Instagram, or Facebook. By using Castopia, you agree to the practices described in this Privacy Policy.
Account & profile information. Your name, email address, business/organization details, and any other information you provide when you create an account.
Usage data. Information about how you use Castopia, including features accessed, content generated, and campaigns created.
Technical data. IP address, browser and device information, and similar diagnostic data that helps us operate and secure the service.
Content & brand data. Website content, logos, and brand information you provide or that our AI analyzes to generate on-brand posts and ad creative.
When you connect a social media or advertising account to Castopia, we access a limited set of data from that platform, solely to provide the features you’ve requested (content publishing, scheduling, and/or ad campaign management). We do not sell this data, and we only use it as described below and in each platform’s own developer policies.
What we access. With the user.info.basic scope: your TikTok open ID and union ID, display name, and avatar image URL. With video.list: metadata for videos you have already posted (title, description, cover image, share link, duration, and public engagement counts). We do not access your email address, phone number, date of birth, followers, direct messages, or drafts.
What we do with it. Profile data identifies which TikTok account is connected so you always know where a post is going. Video metadata is shown in your Castopia content library and used to report how your posts performed.
Publishing. With the video.publish and video.upload scopes we post videos to your account — but only ones you have explicitly approved. Every TikTok post is composed by you: you choose the caption, who can view it, whether comments, Duet and Stitch are allowed, and whether the video is disclosed as commercial content. Castopia never posts to TikTok automatically, and our AI agent cannot publish to TikTok on your behalf.
Retention and deletion. Access and refresh tokens are stored only while your account stays connected. Disconnecting the account in Castopia, revoking access from TikTok’s own settings, or deleting your Castopia account removes those tokens and the TikTok data associated with them. See Data Deletion.
What we never do. We do not sell or rent TikTok data, do not share it with third parties for advertising, and do not use it to train AI or machine learning models.
If you separately connect a TikTok Ads account, we use TikTok’s Marketing API to create and manage ad campaigns you have authorized, including audience targeting, budget management, and performance reporting.
What we access. With YouTube’s read-only permission, we access your channel name, channel ID, channel image, and basic channel information so you can identify the account you connected. We do not request permission to edit or delete your existing YouTube content.
Publishing. With YouTube’s upload permission, Castopia uploads only the videos you choose to publish, using the title, description, and visibility you select. Castopia does not publish to YouTube until you authorize the connection and choose a destination.
Storage and sharing. We securely store the OAuth access and refresh tokens needed to keep your channel connected. We do not sell YouTube user data, use it for advertising, use it to train AI or machine-learning models, or share it except with service providers needed to operate the user-facing publishing feature.
Retention and deletion. Disconnecting your YouTube account or deleting your Castopia account removes the stored authorization and associated connection data. You can also revoke Castopia from your Google Account permissions at any time. See Data Deletion.
Basic profile and account information, and — with your authorization — the ability to publish content and, if connected, manage ad campaigns on your behalf.
The list of Pages you manage and their basic Page information; the like, comment and share counts on posts published to the Page you choose, so we can show you how each post is doing; and — with your authorization — the ability to publish content to that Page and manage Facebook and Instagram ad campaigns on your behalf.
You may revoke Castopia’s access to any connected account at any time from that platform’s own settings, or by requesting deletion as described in Data Retention & Deletion.
Data we receive from Google, including from the Google Ads API, is covered in detail in section 4, Google User Data.
This section explains how Castopia accesses, uses, stores, shares, and deletes data it receives through Google APIs when you connect a Google account, including the Google Ads API. It applies in addition to the rest of this Privacy Policy, and where the two differ for Google user data, this section controls.
Our Limited Use commitment. Castopia’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Permissions we request, and why. Castopia asks only for the Google permissions behind a feature you turn on, at the moment you connect that feature:
adwords (Google Ads) — connect the Google Ads account you choose, then create, manage, and report on the campaigns you ask Castopia to run in it.youtube.readonly — read your channel name, ID and image so you can confirm which channel you connected.youtube.upload — upload only the videos you choose to publish or to use in your YouTube ads, with the title, description and visibility you select.yt-analytics.readonly, analytics.readonly, webmasters.readonly — read performance metrics for the channel, property or site you connect, to show your results and inform recommendations.business.manage — read and update the Google Business Profile you connect, and publish the posts and replies you approve.drive.readonly / drive — list and read the folders and media you choose to import as source footage for videos you make in Castopia.openid and email — identify which Google account you connected.Google Ads data we access. When you connect a Google Ads account, Castopia accesses through the Google Ads API:
We do not access Google Ads payment details. We do not access Gmail, Contacts, Calendar, or any other Google data you have not connected.
How we use it. We use Google user data only to provide and improve the user-facing features you connected it for:
We do not use Google user data for advertising, to build user profiles for advertising, to serve or retarget ads, or for credit-worthiness or lending decisions. We do not use it to develop, improve, or train generalized artificial-intelligence or machine-learning models, and we do not transfer it to anyone who would. Data from one customer’s Google Ads account is never used for another customer’s campaigns.
How we store and protect it. Google OAuth access and refresh tokens, the Google Ads account you selected, and records of the campaigns Castopia created for you (with their performance figures) are stored in our production database. Data is encrypted in transit (TLS) and at rest by our hosting providers. OAuth tokens are used only on our servers and are never sent to your browser or the Castopia mobile app. Access to production systems is limited to authorized Castopia personnel who need it to run the service.
We never sell Google user data. We do not sell, rent, or trade it, and we do not share it with advertisers, data brokers, or information resellers.
When it is shared. We share Google user data only:
No one at Castopia reads your Google user data except with your explicit permission (for example, when you ask us for support), when needed for security or to comply with the law, or when the data has been aggregated and anonymized for internal operations.
Retention and deletion. We keep Google OAuth tokens only while your Google account stays connected. When you disconnect it in Castopia, the stored tokens and connection are deleted right away. Campaign records and performance figures Castopia stored for campaigns it ran for you are kept while your Castopia account is active, so you can see your history, and are deleted within 30 days after you delete your Castopia account or ask us to delete them at privacy@castopia.ai. You can revoke Castopia’s access at any time at myaccount.google.com/permissions. Deleting data from Castopia doesn’t delete campaigns from your Google Ads account; those remain yours, in Google Ads. See also Data Deletion.
We do not sell your personal information. We may share it:
We use technical and organizational measures — including encryption in transit, access controls, and least-privilege credential handling — designed to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
We retain information for as long as needed to provide the service, comply with legal obligations, and resolve disputes. You can request deletion of your data, including any data obtained from a connected platform, at any time — see our Data Deletion page or email privacy@castopia.ai. Requests are processed within 30 days.
Depending on your location, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing (rights recognized under frameworks such as the GDPR and CCPA). To exercise any of these rights, contact privacy@castopia.ai.
Castopia is not intended for individuals under 13. We do not knowingly collect personal information from children under 13, and will delete any such information if we become aware of it.
Your information may be processed in countries other than your own. Where required, we use appropriate safeguards to ensure your information remains protected consistent with this Privacy Policy.
Castopia may link to third-party websites or services we do not control. We are not responsible for their privacy practices — please review their policies directly.
We may update this Privacy Policy from time to time. We will post the revised policy here and update the effective date above. Material changes will be communicated to you directly where appropriate.
Questions or requests about this Privacy Policy or your data can be sent to privacy@castopia.ai.
By using Castopia, you acknowledge that you have read and understood this Privacy Policy.