Privacy Policy
Lawyer review pending: to be completed before the paid beta and the public launch
1. Data controller
The controller of your personal data is: Company name, MERSIS number and address are written here before launch. For questions about this policy write to privacy@castwide.enesakt.com. It is based on the Turkish Personal Data Protection Law no. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR). The full notice: KVKK notice.
2. What Castwide is and what data it processes
Castwide sends a video you upload to the social network accounts you connect, with your approval. For that we process:
- Account data: e-mail address, sign-in method (e-mail, Google, Apple), user ID, display name.
- Connected social accounts: account ID and display name, and the access keys (tokens) the network issues so we can post for you. We use the keys only for posts you start.
- Content you upload: the video, title, description and tags; the status and result of each post.
- Purchase data: subscription status and transaction ID. For store purchases we never see your card. For web purchases only the payment provider (iyzico) receives the card; we never see or store the card number.
- Technical data: device model, operating system and app version, crash reports, push token, IP address, security logs.
- Usage data: screen and action events in the app (product analytics).
- Waitlist: the e-mail address you leave in the site form, your language and (if ticked) your consent to announcement e-mails.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5 / GDPR art. 6) |
|---|---|
| Open the account, send your video to the networks you choose | Performance of a contract |
| Manage subscriptions and purchases, issue invoices | Performance of a contract, legal obligation |
| Send account and transaction notices | Performance of a contract |
| Send announcement e-mails | Explicit consent (optional, can be withdrawn) |
| Waitlist: send one e-mail when your turn comes | Taking steps at your request before a contract; deleted at the end of the retention period |
| AI title and description suggestions | Explicit consent (optional each time) |
| Find bugs, prevent abuse, keep the service secure | Legitimate interest |
| Product analytics to improve the app | Legitimate interest; consent where required |
| Keep financial and legal records | Legal obligation |
4. What we take from the networks you connect, and what for
Connecting a network is your decision and is approved on the network's own consent screen. From each network we ask only for what posting needs; we do not sell this data, use it for advertising or share it for any other purpose.
| Network | What we receive | What for |
|---|---|---|
| YouTube (Google) | Channel ID and name, permission to upload videos | Upload your video to your channel (title, description, privacy setting) |
| Instagram, Facebook, Threads (Meta) | Account or page ID and name, publishing permission | Publish the post on your account |
| TikTok | Open ID, display name, publishing permission | Send your video to your account |
| Member ID and name, sharing permission | Share the post on your profile | |
| X | User ID and handle, posting permission | Share the post on your account |
| Bluesky | Your account identifier (DID) and handle, OAuth permission | Share the post on your account |
| Telegram | ID of the channel or chat to post to, the bot permission needed to post | Post to the channel you choose |
YouTube API Services
Castwide uses YouTube API Services. By using the app you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy.
- We use the data we receive from YouTube only to upload videos to your YouTube channel and to show you the result. Castwide's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- You can revoke access at any time on the Google permissions page by removing Castwide.
- If you remove access in the app (disconnect the network) we delete the authorized data we got from YouTube within 7 days. If you revoke access on Google's side we delete it within 30 days at the latest.
- We refresh or delete the data we store from YouTube at least every 30 days; we do not keep out-of-date data.
5. AI and speech recognition
If you choose, the speech in your video is turned into text and used to suggest a title and description. Speech recognition runs on our own server in Germany; the audio is not sent to a third party. To produce the suggestion only the resulting text is sent to Anthropic's Claude service (USA), and only with your consent. If you do not consent nothing is sent: choose Continue without AI and write the title and description yourself. Your video file is never sent to Anthropic.
6. Processors and recipients
| Provider | Purpose |
|---|---|
| Google (Firebase Authentication, Crashlytics, Cloud Messaging) | Sign-in, crash reports, push notifications |
| RevenueCat | Management of store subscriptions |
| iyzico | Card payment and subscription on the web (only iyzico receives card data) |
| PostHog (EU region) | Product analytics |
| Cloudflare | Content delivery, DNS and security protection, video file storage |
| netcup (Germany) | Server hosting, database and speech recognition |
| Anthropic (USA) | Only with your consent: text processing to produce suggestions |
| The networks you connect (Google/YouTube, Meta, TikTok, LinkedIn, X, Bluesky, Telegram) | Publish the post you chose |
| E-mail delivery provider | Written when the provider is chosen |
Some providers may process data outside Turkey and the European Economic Area. Such transfers rely on safeguards under KVKK art. 9 and GDPR chapter V (such as standard contractual clauses). We do not sell personal data. iyzico keeps the buyer details it receives under its own legal obligations and its own policy.
7. Retention
- Account and app data are kept while your account is open.
- When you delete your account, your data is erased after the 7-day grace period; the request closes within 30 days at the latest. Details: account deletion.
- The access keys of the networks you connected are deleted when you disconnect or delete the account.
- Uploaded videos and temporary files: Retention period is written before launch.
- Security and access (IP) logs: 12 months at most; personal fields are pseudonymised after 90 days.
- Waitlist e-mail: Retention period is the owner's decision; written before launch. To leave the list just write to privacy@castwide.enesakt.com.
- Invoice and payment records are kept for as long as tax and commercial law require (period depends on the accountant's answer; 10 years for now).
- Backups: deleted data stays in backups for at most 35 days, then is overwritten.
8. Your rights
Under KVKK art. 11 and GDPR art. 15-22 you may: learn whether your data is processed, access it, have it corrected or erased, restrict processing, object, receive it in a portable form and withdraw consent at any time. Send requests to privacy@castwide.enesakt.com; we answer within 30 days at the latest. If you are not satisfied you may complain to the Turkish Personal Data Protection Board or to the data protection authority of your country.
9. Deleting your account and data
You can delete your account in the app (Settings → Delete account) or on the web: Delete account. For data deletion requests that arrive through Meta (Instagram, Facebook, Threads), you can follow the status with your request code on the status page.
10. Children
The service is not directed at children under 13 and we do not knowingly collect their data. If you notice we collected a child's data, write to us and we will delete it.
11. Cookies
Details: Cookie policy.
12. Changes
We may update this policy. We announce important changes in the app or by e-mail. The current version is always on this page.