Privacy Policy
What we collect, why, and your rights. · Version 2026-07-04
Who we are
Castalume Limited is the data controller for your account data. Contact: privacy@castalume.com.
Data we collect
Account data (name, email, hashed password). Content you submit (briefs, uploaded images/logos, custom-avatar consent). Usage and billing data. Technical data (IP, device, cookies).
Why we use it
To provide the service, process payments, prevent abuse, meet legal duties, and improve Castalume. We rely on contract, legitimate interests, consent (for marketing/cookies) and legal obligation as lawful bases.
Providers (subprocessors)
To run the service we share the necessary inputs with processors including Anthropic (scripts), HeyGen (presenter), ElevenLabs (voice), fal.ai (scenes/images), Lemon Squeezy (payments), Resend (email) and Supabase (hosting/storage). See the current subprocessor list on request.
International transfers
Providers may process data outside your country. We use appropriate safeguards (e.g. standard contractual clauses) where required.
Retention
We keep account data while your account is active and as needed for legal/accounting purposes, then delete or anonymise it.
Your rights
Depending on where you live (GDPR/UK GDPR/CCPA/LGPD etc.) you can access, correct, delete, port or object to processing of your data. Use the Export and Delete tools in your dashboard, or email us.
Security
Passwords are hashed; access is restricted. No system is perfectly secure, but we take reasonable measures.
Children
Castalume is not for children under the minimum age in your country. We don't knowingly collect their data.