Privacy Policy

1. Who we are (Data Controller)

For all privacy-related requests — access, correction, deletion, portability, or objection — please email us at the address above.

2. Personal data we collect

On this waitlist landing page, before you create a full account, we collect the minimum data needed to add you to our pre-launch list:

• Name (or stage name / agency name) — to address you in communications.
• Email address — to send you a single notification when early access opens.
• Role (Talent, Producer, Agency, Pet Owner) — to send role-relevant updates only.
• Optional notes — free text you provide. Please do not include sensitive personal information (health, religion, ethnicity, sexual orientation, etc.) here.
• Technical data — your IP address, browser user-agent, and the timestamp of your submission. Used for abuse prevention and rate limiting.

When you later create a full casTyou account, additional data is collected as described in the in-app privacy notice.

3. Why we use your data (Legal basis)

• Consent (GDPR Art. 6(1)(a)): You provide your name, email, role, and notes voluntarily when you choose to join the waitlist. You may withdraw consent at any time by emailing us — see Section 7.
• Legitimate interest (GDPR Art. 6(1)(f)): Processing your IP address and request metadata for security, abuse prevention, and bot detection, balanced against your reasonable expectation of a working service.
• Consent (GDPR Art. 6(1)(a)) for analytics: If you accept analytics in our cookie banner, we process pseudonymous usage data through Google Analytics. You can withdraw this consent at any time via the “Cookie preferences” link in the footer.

4. Who we share data with (Recipients)

• Cloudflare, Inc. — We use Cloudflare Turnstile to verify that you are not an automated bot before accepting your waitlist submission. Cloudflare receives your IP address, a token from your browser, and the page you submitted from. Cloudflare acts as our data processor. See Cloudflare's privacy policy.
• Google LLC (Google Analytics) — only if you consent. When you accept analytics in our cookie banner, Google Analytics receives pseudonymous identifiers, your IP address (truncated where supported), and information about pages viewed. Google acts as our data processor under Standard Contractual Clauses for any transfers to the United States. See Google's privacy policy.
• Our hosting providers — Infrastructure providers (database, email delivery) process your data on our behalf under data-processing agreements. They are prohibited from using your data for their own purposes.

We do not sell your personal data, run third-party advertising, or share it with marketing partners.

5. Cookies and similar technologies

We use two categories of cookies and local storage on this site:

• Strictly necessary (no consent required). The Cloudflare Turnstile widget may set cookies such as cf_chl_* on the challenges.cloudflare.com domain solely to complete the anti-bot challenge. We also store your consent choice itself in your browser's localStorage under the key castyou.consent so we don't ask you again on every visit. These fall under the “strictly necessary” exemption in the ePrivacy Directive.
• Analytics (consent required). If you click “Accept analytics” in our cookie banner, we set Google Analytics cookies (_ga, _ga_*) to measure aggregate, pseudonymous traffic patterns and improve the site. You can withdraw consent at any time using the Cookie preferences link in the footer; we will stop loading analytics and you can clear the cookies from your browser settings.

6. How long we keep your data (Retention)

• Waitlist entries are kept until (a) you create a full casTyou account, at which point your account record replaces the waitlist entry, or (b) twenty-four (24) months from the date of submission — whichever happens first. After that, we delete the entry.
• Rate-limit metadata (IP + timestamp counters) is held in memory and discarded within one hour.

7. Your rights

Depending on where you live, you have the following rights regarding your personal data. To exercise any of them, email legal@castyouapp.com from the address you used to sign up. We respond within 30 days.

• Access — a copy of the data we hold about you.
• Rectification — correct any information that is wrong or out of date.
• Erasure — “right to be forgotten” — request deletion of your waitlist record.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — withdraw at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint — you may also complain to your local data protection authority. In the EU, find yours at edpb.europa.eu.

8. International data transfers

casTyou is established in the United States. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data-export rules, your personal data will be transferred to the United States. We rely on the European Commission's Standard Contractual Clauses (SCCs) with our processors where applicable.

9. Children

The casTyou Service is intended for users 18 years of age and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has signed up, please contact us and we will delete the record.

10. Security

We use HTTPS for all data in transit, store waitlist data in an access-controlled database, hash account credentials, and apply rate limits and bot detection to our public endpoints. No system is perfectly secure; if we ever become aware of a breach affecting your data, we will notify you and the relevant supervisory authority as required by law.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Effective Date” above and, if you are on our waitlist, notify you by email.