Privacy Policy

Castor ("Castor," "we," "us") is operated as a sole proprietorship based in Pakistan. Castor provides an AI agent that replies to Instagram, Facebook, and WhatsApp messages and creates social posts on behalf of business owners who connect their accounts to our service.

If you have any questions about this policy or how your data is handled, contact us at support@castor.ai.

We collect the following categories of data:

• Account information you provide when you sign up: your name, email address, and password (stored hashed via Supabase Auth).
• Business information you enter in chat or forms: business name, products or services, pricing, FAQs, and other details your AI agent uses to answer customers accurately.
• Connected platform data: when you connect Instagram, Facebook, or WhatsApp through our provider Zernio, we receive and store an encrypted access token, your page/account ID, and the messages sent to and from your account so the agent can read and reply to them.
• Message and conversation content: incoming DMs and comments, and the replies our AI agent generates, so we can maintain conversation history and improve reliability.
• Payment information: subscription and billing details are handled entirely by our payment processor, Paddle. We do not store your card number; we retain only the subscription status and price plan Paddle reports back to us.
• Usage data: basic technical logs (timestamps, error reports, API request metadata) used to operate and debug the service.

• To operate your AI agent: reading incoming messages and generating replies using Mistral AI (for text) and Cloudflare Workers AI (for post images).
• To post content and send replies to Instagram, Facebook, and WhatsApp on your behalf, via the Meta Graph API through Zernio.
• To run your account: authentication, billing via Paddle, and customer support.
• To maintain and improve the reliability of the service, including debugging failures in message delivery.

Your account data, business information, connected-account tokens, and conversation history are stored in a Supabase (PostgreSQL) database. Access tokens for connected platforms are encrypted at rest before being written to the database. Access to production data is restricted to Castor's operator.

Castor uses a small number of cookies — no third-party ad-tech beyond what's listed below, and no cross-site tracking network.

• Session cookie (required): set by Supabase Auth to keep you signed in. Without it, the dashboard can't recognize your account.
• Meta Pixel (marketing pages only): when configured, measures ad performance for our own Instagram/Facebook campaigns. It doesn't run inside the dashboard, only on the public marketing site.

You can block or delete cookies in your browser settings at any time. Blocking the session cookie will sign you out; blocking the Meta Pixel has no effect on using Castor itself.

We share the minimum data necessary with the following processors to run Castor:

• Meta Platforms, Inc.: via the Meta Graph API, to send and receive Instagram, Facebook, and WhatsApp messages and to publish posts.
• Zernio: our connection provider for Instagram, Facebook, and WhatsApp, which brokers the OAuth connection and delivers message webhooks to us.
• Mistral AI: to generate text replies and post captions from your business information and incoming messages.
• Cloudflare Workers AI: to generate images for posts.
• Supabase: our database and authentication provider.
• Paddle: our payment processor, which handles checkout, subscriptions, and billing on our behalf.

We do not sell your data, and we do not share it with anyone outside of the processors above except as required by law.

We retain your account and conversation data for as long as your account is active. If you disconnect a platform (Instagram, Facebook, or WhatsApp), we stop sending and receiving messages for that account and delete the associated access token. If you delete your account, we delete your business information, stored conversations, and connected account tokens from our database. You can request deletion at any time by emailing support@castor.ai.

• You can disconnect any connected platform from your dashboard at any time; this immediately stops the agent from acting on that account.
• You can request a copy of the data we hold about you.
• You can request that we correct or delete your data.
• You can cancel your subscription at any time from your billing settings; cancellation is processed by Paddle.

Castor is a business tool and is not directed at, or intended for use by, children. We do not knowingly collect data from anyone under 18.

We may update this policy as the service changes. If we make material changes, we will update the "last updated" date below. Continued use of Castor after a change means you accept the updated policy.

Questions about this policy or your data can be sent to support@castor.ai.