Skip to content
Castfold
DE

Privacy Policy

Last updated: 23 September 2026

1. Controller

Droidtech e.K., owner Michael Rauen, Auf der Eichelsbach 19, 54533 Hasborn, Germany. Phone +49 6574 227 0937, e-mail mail@castfold.com. No data protection officer has been appointed because the legal requirements for one are not met.

This policy covers the website castfold.com and the Castfold application (app). The legal bases are the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Website: access, hosting, storage on your device

Server logs. When you visit the website, the hosting provider processes technically necessary data (IP address, time, page requested, browser, referrer) to deliver and secure the site (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest. The hosting provider is bound as a processor by contract (Art. 28 GDPR); we name the provider and server location on request at mail@castfold.com.

No tracking cookies. The website sets no analytics or advertising cookies and loads no tracking scripts.

Local storage (localStorage). The website stores only on your device: your choice in the consent banner (castfold.consent), whether the language hint has already been shown (castfold.langhint) and – only when you arrive through a referral link – the referrer’s code and the time of that first visit (castfold.ref, castfold.refAt, see below). This is necessary for the service you requested (Section 25(2) no. 2 TDDDG) and is not transmitted to us.

Referral link (?ref=). If you arrive through a partner’s referral link, the website remembers that partner’s code and the time of that first visit on your device and appends both to the links to registration, so the referral can still be attributed if you sign up later. A later visit through a different referral link does not overwrite the remembered code or time. The code belongs to the partner, not to you, and says nothing about your person. We set no cookie for it, and as long as you do not register, nothing is transmitted to us (Art. 6(1)(f) GDPR). You can delete the entry at any time through your browser’s site data.

External media (YouTube embeds). YouTube videos are loaded only after you consent to the “External media” category or load a video individually (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). On loading, Google LLC receives your IP address and sets its own cookies; we use the domain youtube-nocookie.com. Google’s privacy policy: https://policies.google.com/privacy. You can withdraw consent at any time via “Cookie settings” in the footer.

Fonts. Fonts are served from our own server; no connection to Google Fonts is made.

3. Registration and account (app)

On registration we process your e-mail address, display name, account name, time and a confirmation code. Optionally you can add billing details (company, address, VAT ID). The purpose is to provide the account and perform the contract (Art. 6(1)(b) GDPR). If your account is created through a partner link, we store the partner id and the time to settle the partner commission (Art. 6(1)(f) GDPR); the partner receives no personal data, only anonymised figures.

Login sessions do not expire automatically; you end them by logging out. For this we store a refresh token (hashed) with the time of last use.

4. Google sign-in and YouTube API Services

To connect a YouTube channel you sign in with Google (OAuth 2.0) and grant Castfold permissions for the selected channel. Castfold uses YouTube API Services. By connecting you agree to the YouTube Terms of Service; the Google Privacy Policy also applies.

Which data we retrieve through the YouTube API and store:

  • Channel data: channel id, title, handle, description, keywords, banner, subscriber and view counts
  • Video data: video id, title, description, tags, status, publish time, views, likes, comment count
  • Daily analytics: views, watch time, subscriber change, estimated revenue (for monetised channels), audience retention
  • OAuth tokens (access and refresh tokens), stored encrypted

What for: transferring your branding, uploading and scheduling videos, displaying analytics and insights, AI advice based on your channel data. The data is not passed on to third parties and is not used for advertising.

Confirmation before transfer: After the Google sign-in we first retrieve only the channel id, title, handle, profile picture and the subscriber and video counts of the channel found and show them to you. Only when you confirm that it is your channel do we transfer your branding and retrieve further data. If you choose “Choose another channel”, we revoke the permission with Google immediately and delete the retrieved details.

Refresh and deletion (30-day rule): Data retrieved through the API is refreshed regularly; stored API data older than 30 days is retrieved again or deleted, except for the historical daily values of your analytics, which you expressly keep for evaluation and can delete at any time. If you disconnect a channel or delete your account, we delete the associated tokens immediately and the retrieved data within 30 days.

Revocation: You can revoke Castfold’s access at any time in the app (“Disconnect”) or in your Google security settings at https://myaccount.google.com/permissions.

Processing by Google: When data is retrieved through the API, Google LLC (or Google Ireland Limited for the EEA) processes data under its own responsibility. Google may collect data through the YouTube API for security and abuse-prevention purposes.

Handling of Google user data: Castfold’s use and transfer of information received from the YouTube API Services adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only for the purposes described in this section, is not used to train AI models, and is not shared with or sold to third parties.

5. AI features: Google Cloud and Vertex AI as processor

Castfold generates channel concepts, metadata, advice, images, videos, narration and music with Google models (Gemini, Veo, Imagen, Lyria) through Google Cloud Vertex AI. Google Cloud EMEA Limited acts as a processor under the Google Cloud Data Processing Addendum; the data is not used to train the models.

What is transmitted: the text you enter (keywords, hints, scripts, questions), excerpts of your channel data and analytics as context, and image prompts. You should not enter personal data of third parties.

Regions: Text models run in an EU region (e.g. europe-west4, Netherlands). Models not available there (video, narration, music) run through the global or us-central1 (USA) locations. Transfers to the USA rely on the EU-US Data Privacy Framework (Google LLC is certified) and the EU standard contractual clauses. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

Every AI call is logged with time, model, tokens and cost so that we can show and bill your usage.

6. E-mail delivery

We send sign-in codes, invitations and notifications through the SMTP service of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (processor, servers in Germany). E-mail address, subject and message content are processed.

7. Payment processing, invoices, fraud prevention

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (“Stripe”), as an independent controller. Stripe receives name, e-mail address, billing address, VAT identification number where applicable, amount and payment method; we do not receive full card details, only confirmation, amount, time, the last digits and a technical identifier of the payment method (Art. 6(1)(b) GDPR). Stripe issues invoices on our behalf; we retain them for eight years (§ 14b UStG, § 147 AO). Stripe screens payments for fraud (Stripe Radar) and may process device data and the IP address for this; Stripe’s privacy policy: https://stripe.com/privacy. To prevent multiple starter credits and chargeback fraud we store the technical identifier of the payment method and the IP address at registration and match them against other accounts (Art. 6(1)(f) GDPR); a block after a chargeback is reviewed by a person before it remains in place for more than 30 days. If we store a card for automatic top-up, this happens only with your consent in the purchase flow; you can remove it in the customer portal at any time.

Partner payouts. For commissions Stripe sets up a payout account (Stripe Connect) and verifies identity and bank details as an independent controller under anti-money-laundering rules. We transmit to Stripe your name or company name, address, e-mail address, country, language, your website if you provide one, and the payout amounts, and retain the credit notes for eight years.

8. Contact, partner applications, support

If you write to us by e-mail or through the contact or partner form on the website, we process your details (name, e-mail address, message, for the partner form also website and reach, plus the chosen language) to handle the request (Art. 6(1)(b) or (f) GDPR). Form submissions are stored on our server and additionally delivered to us by e-mail. To keep automated submissions out, the form checks a hidden field and the time between display and sending; we use neither a captcha nor tracking. We delete the details once the request is settled and no retention obligation applies.

9. Retention, deleting your account

We keep account data until you delete your account. You start the deletion in the application and confirm it with a code sent by e-mail; we then remove channels, video details, analytics, studio projects, memberships and access keys without undue delay, revoke the YouTube permissions with Google and anonymise the account. Restoration is not possible. You can export your data beforehand (section 11).

After deletion we keep only what the law requires or what we need to defend claims (Art. 17(3)(b) and (e) GDPR), counted from the end of the calendar year:

  • Invoices, credit notes, partner credit notes, billing details (country, business status, VAT ID, identifiers at the payment provider): eight years (§ 14b UStG, § 147 AO, § 257 HGB).
  • Credit bookings, top-ups and usage with time, type and amount (without AI inputs and outputs): ten years (§ 147 AO, § 257 HGB).
  • Order confirmations with billing address, your consents in the purchase flow and in the studio, cancellations, block notes and the record of the deletion with your e-mail address: six years (§ 257 HGB, § 147 AO); afterwards we remove address and e-mail address from them.
  • Payment-method identifier and registration IP address against multiple starter credits: twelve months after deletion (Art. 6(1)(f) GDPR).
  • At the payment provider we immediately detach all stored payment methods and have the customer record deleted 180 days after the last payment or refund; invoices remain there for the period stated.

Video files you upload yourself that are not scheduled for publication are deleted 30 days after the upload or after a schedule is cancelled, with a reminder by email seven days beforehand; video files of scheduled or published videos are deleted as soon as YouTube has processed them, at the latest 48 hours after the transfer to YouTube. The related entries with title, description, thumbnail and analytics remain until you delete the video or the account. Export files are deleted 48 hours after they are made available. Server logs: 14 days. AI call logs with inputs and outputs: 24 months for billing and cost control.

10. Recipients and international transfers

Recipients are the processors named above (hosting, IONOS, Google Cloud, payment service provider) and Google LLC in the context of the YouTube API. Transfers to the USA rely on the adequacy decision (EU-US Data Privacy Framework) and the EU standard contractual clauses.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future. You can lodge a complaint with a supervisory authority; the competent authority is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Germany. Requests to mail@castfold.com.

You obtain your data export (Art. 20 GDPR) yourself in the application under Account: we provide a ZIP with your account, channel, video, analytics and studio data and, for the account owner, invoices and credit history, and send you a link valid for 48 hours. Credentials, keys and video files are not included.

12. Changes

We update this policy when features or the legal situation change. The current version is always at castfold.com/privacy/.