Privacy Policy

1. Introduction

This Privacy Policy explains how castroai (“castroai”, “we”, “us”, or “our”) collects, uses, and shares information when you use our website and application (the “Service”). By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect the following types of information:

• Account information — your name, email address, and password (stored as a salted hash, never in plain text) when you create an account directly.
• Third-party sign-in information — if you sign in with Google, we receive your name, email address, and profile image as authorized by you during that sign-in flow.
• Organization data — organizations you create or join, member roles, and invitations you send or receive.
• Usage data — log data such as IP address, browser type, pages visited, and timestamps, collected automatically as you use the Service.
• Cookies and session data — a strictly necessary cookie keeps you signed in. If you accept analytics cookies via the cookie banner, we also set analytics cookies as described below.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate you and keep your account secure
• Send transactional emails, such as organization invitations, email verification, and password resets
• Respond to support requests and communicate with you about the Service
• Monitor and analyze usage and trends to improve the Service
• Detect, prevent, and address technical issues, fraud, or abuse

4. Third-Party Services

We rely on the following third-party service providers to operate the Service:

• Google — for optional sign-in via Google OAuth.
• Resend — to deliver transactional emails (invitations, verification, password resets) on our behalf.
• Neon (Postgres) — to store account, organization, and application data.
• Vercel — to host the Service and provide privacy-friendly product analytics and performance monitoring.
• Google Analytics — to help us understand how the Service is used, only if you accept analytics cookies via the cookie banner described below.

Each of these providers processes data only as necessary to provide their service to us and is bound by its own privacy and data-processing terms.

5. Cookies and Analytics Consent

We use one strictly necessary cookie to keep you signed in; this does not require consent and cannot be disabled while remaining signed in. On your first visit, we ask for your consent before enabling Google Analytics. If you accept, Google Analytics sets cookies (such as _ga and _ga_*) to distinguish visitors and measure usage; if you decline, no analytics script loads and no analytics cookies are set. You can change your choice at any time using the “Cookie Preferences” link in the footer.

6. Data Sharing

We do not sell your personal information. We share information only with the third-party service providers described above, other members of an organization you join (such as your name, email, and role), or when required to comply with the law, enforce our agreements, or protect the rights, property, or safety of castroai, our users, or others.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where retention is required for legal, security, or legitimate business purposes.

8. Security

We use reasonable administrative, technical, and physical safeguards to protect your information, including encrypted connections, hashed passwords, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location, you may have the right to access, correct, export, or delete your personal information. You can update your account information at any time from within the Service, or contact us using the details below to exercise these rights.

10. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the “Last updated” date above or, where appropriate, by other means.

12. Contact Us

If you have questions about this Privacy Policy, contact us at support@castroai.com.