Privacy Policy

Castify is collaboration software for brands and creators, operated by Castify at Trần Phú, Hà Đông, Hà Nội, which is responsible for the processing described here. We process data to operate accounts, workspaces, campaigns, communication, content handoff, direct-payment tracking, and support.

This policy applies to castify.vn, Castify workspaces, public creator and campaign pages, and our official social platform integrations. Third-party sites and apps have their own terms and privacy practices.

Questions, privacy requests, and complaints may be sent to contact@castify.vn. We use the information in a request only to verify identity, respond, and maintain a defensible request record.

Account and profile data includes name, email, hashed password, role, avatar, bio, contact details, location, content areas, brand information, collaboration scope, portfolio, settings, and sharing choices.

Collaboration data includes saved creator lists, campaigns, applications, invitations, work requests, collaborations, messages and attachments, tasks, content submissions, feedback/approvals, reviews, disputes, usage rights, and workflow history created in Castify.

Payment data includes bank name/code, account number, account holder, and records needed when you use payment features; account numbers are masked in ordinary interfaces. Consent and record evidence includes version, hash, time, IP address, and user agent. Castify does not collect social passwords.

Technical data includes refresh/session cookies, browser-side access-token state, locale, time zone, theme, request/session identifiers, IP and user agent where needed for permission/record/security, access time, and error logs. Castify does not currently set advertising cookies; optional future analytics will be disclosed and permissioned to where required.

TikTok connections request user.info.basic, user.info.profile, and user.info.stats; creator accounts also request video.list to display public posts/videos and a creator portfolio. Brand connections do not request video.list. Castify does not download video files, read comment text, or collect email addresses or passwords.

Facebook uses Page identity, pages_show_list, pages_read_engagement, and business_management. Castify stores the selected Page and the Page data actually allowed by the current grant; it does not read personal-page analytics or assume full Page Insights.

Instagram connects Professional accounts through Instagram Login with instagram_business_basic and instagram_business_manage_insights; it uses only the current Instagram Login permissions. Threads uses threads_basic and threads_manage_insights. Instagram/Threads on the platform revocation depends on official channels; connections are read-only and cannot publish, edit, delete, like, or comment.

YouTube creators authorize https://www.googleapis.com/auth/youtube.readonly and https://www.googleapis.com/auth/yt-analytics.readonly for supported channel/video data and reports. Authorized Data is not shared with brands without a correct delegation mechanism; brands use youtube.readonly only for channel identity.

We receive data directly from you, from other campaign participants, from official platform APIs after your explicit authorization, and from public profiles or lookup sources that you ask Castify to verify.

Creator or workspace surfaces show only fields the user chooses and Castify is permitted to process. For each connected social account, you can turn Share insights and Share posts on or off; both are on by default. Turning insights off hides history, audience data, and detailed reports from other people, while turning posts off hides the portfolio, media previews, and social-post sources from AI Search. Identity details and some basic counts may remain visible, and the creator can still view their own data.

When you choose Connect, Castify opens the platform's authorization page. That page identifies the permissions being requested and lets you approve or deny them. This Privacy Policy describes the corresponding data categories, purposes, retention, and deletion controls. Castify keeps secret-free record records of authorization grants and revocations.

AI Search processes data only after an clear opt-in. Permitted data such as descriptions, niches, languages, and locations may be transformed for search within the chosen sharing scope.

Social data enters AI Search only when the user has clearly opted in and the field is permitted for search. Passwords, payments, private messages, and private audience data are excluded; Castify does not use social API data to train a shared AI model.

Campaign and collaboration data is used to match participants, deliver work requests, coordinate collaborations/messages/content/due dates/reviews, preserve payment evidence and confirmations, resolve disputes, and send service notices.

Where applicable, processing grounds include performing an agreement, permission for social connections or optional marketing, and legal, accounting, fraud-prevention, and dispute obligations. Withdrawal does not invalidate processing already completed lawfully.

Castify does not sell personal or social data, provide it to data brokers, or use social API data for third-party advertising, credit, employment, or unrelated profiling.

Visitors, brands, and creators see only fields made public on a profile or campaign, or information needed for a collaboration they are authorized to join. Contact details, work requests, messages, files, and payments do not become public discovery data.

Infrastructure, file-storage, email, identity, error-monitoring, and support platforms may process only the data needed to provide services to Castify under instructions and confidentiality duties. We do not allow them to use social data for an incompatible independent purpose.

We may disclose data in response to a valid legal demand, to protect users or the service, investigate fraud or abuse, or in a corporate transaction with notice and appropriate safeguards. Internal access is restricted by role and work-related need.

Account and collaboration data is kept only as long as needed. When Castify accepts a whole-account deletion request, it immediately disables the account and sessions, accepts platform-revocation work, returns a confirmation number/status URL, and deletes data that can be deleted through the published workflow.

TikTok, Facebook, Instagram, and Threads data is retained while the selected connection is active and removed from active systems after disconnection, valid revocation, or account deletion. Instagram/Threads on the platform revocation may depend on official channels.

YouTube channel/video metadata and other data subject to the 30-day rule are refreshed or deleted within that period. Authorized statistics and Analytics may be retained longer when necessary and permitted for reporting, with authorization and relevant video availability checked at least every 30 days. Disconnecting YouTube, requesting deletion, or deleting a Castify account triggers deletion as soon as possible and within 7 calendar days. Revocation directly through Google triggers deletion as soon as possible and within 30 calendar days of revocation.

Only records with a specific valid retention basis remain restricted. We disclose the scope, reason, and retention period or end criteria unless legally restricted. Collaboration duties do not justify retaining social access or delaying deletion of other data. Deletion covers source data, caches, search indexes, backups, and copies held by processors acting for Castify; deleted data must not be restored to active use. When retention grounds end, data is deleted or irreversibly de-identified.

You can access and correct your profile, choose what is public, change settings, disconnect each social account, or request complete deletion in Settings. Disconnecting does not delete the account or content held by the social platform.

You can also withdraw access Google access in Google Account permissions, remove Facebook access in Business Integrations, or manage TikTok authorization in TikTok settings. Provider revocation may take effect before Castify next receives a callback, so our scheduled checks also detect expired or withdraw accessd grants.

You may request access, correction, a copy, restriction, objection, or deletion under applicable law at contact@castify.vn, even without signing in. Castify requests only the minimum information to confirm the sender, responds within 2 working days, and normally processes a proper request within 20 days. Processor/third-party handling may take 30 days; one extension of up to 20 days applies only where law permits, with reasons and an expected completion date. Shorter YouTube or other platform due dates are not extended.

You can unsubscribe from marketing messages while continuing to receive authentication, security, campaign, payment, deletion-status, and other necessary service communications.

Castify uses role and ownership checks, HTTPS, password hashing, OAuth-token encryption, masked bank-number responses in ordinary interfaces, scoped access, upload checks, revocation workflows, activity records, and secret-free logs. No online service can guarantee absolute security.

Infrastructure and social platforms may process data outside Vietnam. Castify applies access controls and contractual or technical safeguards appropriate to the data and destination.

Castify is for people aged 18 or older. If we discover that an account does not meet this requirement, we restrict access and handle its data under applicable law.

Castify uses essential cookies and browser storage for sign-in, language, security, and core functionality, not its own advertising cookies. Social embeds may connect your browser to a platform, disclose IP/device information, use cookies, and show ads under that platform's policy. Castify uses YouTube API services; Google Privacy Policy and YouTube Terms links appear below. New optional technologies will be disclosed and permissioned to where required.

Each policy version has an effective date and record of the accepted document version, and Castify retains evidence of the version you accepted. For a material change, signed-in users receive notice and must affirmatively accept; silence or continued browsing alone is not recorded as permission.

For privacy questions or requests, email contact@castify.vn, use the Contact page, or open Privacy choices in Settings. The Data deletion instructions describe each request type and display status using a confirmation number.