Last updated: 2026-10-08
Privacy Policy
CASTARA provides browser tools and optional member services designed with privacy and safety in mind. Keep original files, protect sensitive input and inspect every result.
Privacy contact
Privacy questions and rights requests can be sent to [email protected].
Information and sources
We receive information directly from you when you create or manage an account, contact us, save member content, use points or rewards, or choose optional marketing. Authentication providers may provide identifiers, name, email address and profile information you permit them to share. We also handle security and service records such as session, rate-limit, audit and request data, and obtain published loan-rate information from the identified public sources.
Local tool processing
Most file, media, text, calculator and developer-tool inputs are processed in the current browser tab and are not uploaded to CASTARA, saved to an account or included in analytics. This includes JSON, JWT, URL, timestamp, hash and random-generator input. Browser downloads remain under your device and browser settings. Exceptions are clearly identified server-backed features, including account records, protected reusable QR-logo uploads, saved member items, public Smart Profile shares, Tool Finder analytics when allowed, and direct requests for public rate data.
Purposes and lawful bases
We process required account, authentication, saved-content and support information to provide the service and perform our agreement with you. We use necessary security, fraud-prevention, service-integrity and limited operational records for our legitimate interests in protecting and operating CASTARA, except where your rights override those interests. We use consent for optional marketing, analytics and advertising where consent is required. We may process or retain information to comply with legal obligations and establish, exercise or defend legal claims.
Recipients and service providers
Information is shared only as needed with service providers that support hosting, databases, authentication, email delivery, security or abuse prevention. If enabled and permitted by your choices, Google and its participating vendors may process analytics or advertising data. Information may also be disclosed when required by law, to protect legal rights or service security, or as part of a properly managed business transfer. Tool input that remains local is not shared by CASTARA.
International transfers
Some providers may process information outside your country. Where data-protection law requires transfer safeguards, we rely on an applicable adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Contact us for information about safeguards relevant to your information.
Retention
Local tool input is normally released when you clear or leave the tool, subject to ordinary browser memory and download behaviour. Tool Finder analytics expires after 90 days. Bulk-code job records expire after one hour. Authentication sessions normally expire after 30 days unless ended sooner. Account, saved-content, points, redemption, consent, security and audit records are retained while needed to provide the account, preserve transaction and security integrity, resolve disputes and meet legal obligations. We delete or anonymise records when they are no longer reasonably needed, subject to backups and records that must be retained.
Your data-protection rights
Depending on applicable law and the processing involved, you may have rights to access, correct, delete, restrict or object to processing, and to receive portable data. You may withdraw consent at any time without affecting earlier lawful processing. The right to object to processing based on legitimate interests, and to direct marketing, is specifically available where applicable. Use account controls where provided or contact [email protected]. We may need to verify your identity and may retain information where the law permits or requires it.
Consent and privacy choices
Use the Privacy choices control on the Cookie Policy page to review or change optional cookie, analytics and advertising choices. You can withdraw optional marketing consent through account settings or by contacting us. Necessary storage and processing used for security, sign-in and requested features cannot be disabled through the advertising consent control.
Complaints
Please contact us first so we can investigate. If UK data-protection law applies, you may complain to the UK Information Commissioner's Office at ico.org.uk. If Malaysian data-protection law applies, you may contact the Personal Data Protection Commissioner at pdp.gov.my. You may also have the right to contact the supervisory authority where you live or work.
Automated tools and required information
CASTARA calculators, recommendations, matching tools and validation results assist you but do not make legal or similarly significant decisions about you. Required registration and security fields are identified in the interface; without them we cannot create or protect an account. Optional profile and marketing fields may be left blank without losing the public tools.
Local subtitle and video files
SRT, WebVTT and optional preview-video files selected for Subtitle Toolkit are read and processed in the current browser tab. Their contents are not uploaded to CASTARA, saved to an account, placed in browser storage or included in analytics. Temporary in-memory file references are released when replaced, when the tool is cleared or when the tab closes. Downloaded results and original files remain subject to your device and browser settings.
Loan calculator values
Salary, commitments, target home price and repayment inputs entered in the loan calculator remain in the current browser tab and are not sent to CASTARA, saved to an account or included in analytics. Public bank-rate records and administrator audit records do not contain a visitor's calculator inputs.
Tool Finder analytics
If you allow analytics, Tool Finder removes common emails, URLs, phone-like numbers, filenames and secret-like tokens in your browser before sending the remaining search text to CASTARA. The server repeats this redaction and stores the anonymous search, outcome and recommended tool identifiers for 90 days to improve matching. These records do not include an account, session or IP identifier. Avoid entering personal or confidential information in a search request.
Member accounts
Using Google sign-in signs you in to CASTARA and, if no matching account exists, registers a CASTARA account under these Terms and the Privacy Policy. We receive account identifiers and profile information made available by Google for authentication. A Google-only CASTARA account has no CASTARA password unless you voluntarily add one in Security. We also handle optional profile details you choose to provide, including phone number, country, gender and date of birth, to provide profile and optional reward features.
Saved member content and protected QR logos
Saved code configurations, label sheets and related member records are stored under your account until you delete them, delete the account where available, or retention is otherwise required. Reusable QR logos are the only tool images uploaded to CASTARA: the server validates and re-encodes supported PNG, JPEG or WebP content where practical, stores it under a private random filename, and serves it only through an authenticated ownership-checked route. Logo metadata and a trusted relative storage reference are stored in the database; image bytes are not placed in database fields, browser storage, analytics or advertising data. A logo cannot be deleted while a saved code still references it.
Smart Profile sharing
Smart Profile stores reusable information you voluntarily enter for your account. Field values and the owner copy of each share token are encrypted at rest. A public expiring link displays only the fields you explicitly select, while public lookup uses a cryptographic token hash. Anyone who receives an active link can view and copy those selected fields, so choose recipients and expiration carefully and revoke links that are no longer needed. Smart Profile values and tokens are not sent to analytics or advertising providers.
External links
When you provide an external media link, your browser requests it directly from the source with credentials omitted and without a referrer. The source and network providers can still receive your IP address and ordinary connection information, and the content remains subject to the source site's terms and privacy practices. CASTARA does not proxy or store that remote file. Use only links and content you are authorized to access.
Access, deletion and retention
You can review and correct available profile information. Self-service deletion requires a CASTARA password; Google-only members can voluntarily add one. If you voluntarily claim the one-time profile completion reward after the separate confirmation, self-service deletion is permanently disabled for that account. This does not waive rights that cannot legally be waived, and you may contact support about access, correction, withdrawal, privacy or deletion requests available under applicable law. Some records may be retained for security, transaction, backup or legal reasons where permitted or required.