What we hold,and what we do not.

1. This website counts visits and offers a chat

No cookies while you browse. Neither this site nor the services it uses set any. The only cookie you can have from us is one that the castomFLOW app leaves after you sign in to it, described below. No tracking pixels, no fingerprinting, and no scripts from other companies: every page loads scripts only from this website and from two services run by Castomo: Observer (observer.castomo.com) and the chat button (chat.castomapi.com). The fonts are served from this domain rather than from somebody else's, so reading this page does not tell a font provider that you were here.

Analytics: Observer. We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.

Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.

We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.

Chat assistant. Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.

When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.

The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.

We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.

The accessibility settings — colours, text size, spacing, reduced motion — are stored in your own browser's local storage and never sent anywhere. Clearing your browser data removes them, and nothing else knows they existed.

Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.

The home-page demo is an exception, and only if you use it. The sentence you type and the workflow built from it — or a ready-made workflow once you change it — are sent to castomapi-try, our own service, run by Castomo P.S.A. on servers in the European Union, and kept as a draft for 30 days so you can come back to it. After 30 days an unsaved draft is deleted. The draft is opened by a key kept in your browser's local storage (not a cookie), and nobody else can open it unless you share a link to it. If you sign in to keep it, your sign-in session is kept in the same local storage (under cfl:try-session) so the page can move the draft into your account; clearing your browser data removes it. Your internet address is used only to stop the demo being abused — an hourly limit held in the service's memory and never written down.

A workflow built from a sentence is written by an AI model: the sentence goes, through the OpenRouter routing service, to one of the model providers it lists, and some of those — free models in particular — may keep what they receive under their own terms. The ready-made workflows involve no model at all. So give the demo the job, not anybody's personal data; it does not need any.

If you save a draft to a castomo account, from then on it belongs to that account and is covered by section 2: it stays until you delete it or the account.

One cookie, only after you sign in to the app: castomo_user. When you sign in to the castomFLOW app (app.castomflow.com), the app leaves a cookie named castomo_user in your browser. It holds the part of your e-mail address before the @ (at most 40 characters) and nothing else. It exists so that this site can show that name on the header button instead of "Open castomFLOW". It is set for castomflow.com and its subdomains, so your browser sends it to this site and to the app, as it does with any cookie; our server does not use it. It lasts 30 days, renewed each time you visit the app, and is removed when you sign out; you can also remove it by clearing this site's data in your browser. It is only a label: it gives no access to your account, it is not used for tracking, and it is not sent to anyone else. If you have not signed in to the app, it does not exist, and this site's own pages set no cookie of any kind: they only read it.

The web server keeps ordinary access logs, as every web server does: the request, the time, a response code and a user agent. They exist to keep the site running and to spot abuse, they are retained briefly, and they are not used to build a profile of anybody.

Consequence: this site shows no cookie banner. Its own pages set no cookies and Observer stores nothing on your device; the one cookie that can exist, castomo_user, is left by the app after you sign in and is described above. What the chat button keeps in your browser, and only once you open it, is listed above. If a banner ever appears, it will be because something changed, and this page will say what.

2. Your account

Castomo P.S.A. is the controller for the data that makes an account work: the name and e-mail address you signed up with, your workspace and its members, your plan, your billing details and invoices, the credentials you connect (encrypted, referenced by name, never displayed back), and the security log of sign-ins and consequential changes.

The lawful bases are the contract between us — you cannot have an account without an account record — and, for the security log and abuse prevention, our legitimate interest in running a service that is not trivially abusable. Billing records are kept for as long as tax law requires, which in Poland is longer than either of us would choose.

One castomo account signs into every product in the family. That is one account record, not one per product, and deleting it deletes it everywhere.

3. What a running workflow holds

For the data that flows through your workflows — your customers, your orders, your documents — you are the controller and Castomo P.S.A. is the processor. We hold that data because you instructed a workflow to fetch it, and we act on it only as the workflow you built instructs.

Concretely, a run holds: the payload that triggered it, the input and output of each step, the branch each condition took and the value that decided it, timings, and the request and response of each external call with credentials redacted. That is what makes a run log useful, and it is also, unavoidably, a copy of whatever your workflow was handling.

Run records are retained for a limited window and then deleted. You can shorten that window per workflow, and you can mark specific step inputs or outputs as not to be stored at all — in which case the log records that the step ran and what it decided, but not the content it ran on. For anything involving special-category data, use that setting.

A credential is stored encrypted and referenced by name. It is never written into a run record, an error message, a support conversation or a log line.

4. What an AI step sends, and where

This is the part people most want a straight answer to, so here it is.

When a workflow reaches an AI step, the input you configured for that step — and only that input — is sent to a model provider for inference, and the result comes back into the run. Deterministic steps never send anything to a model provider. A workflow with no AI steps involves no model provider at all.

Providers are engaged as sub-processors under contract, on terms that prohibit training on the content sent for inference. The current list of sub-processors, with what each one does and where it runs, is available on request from hello@castomo.com; ask before you build something sensitive rather than afterwards.

If you would rather your inference happened somewhere specific, an AI step can run against your own provider key, in which case the relationship for those calls is between you and that provider.

The practical advice: an AI step should be given the field it needs, not the whole record. A classification step that receives a message body does not also need a customer's address, and the smallest input that does the job is both cheaper and better for everyone.

5. Where data lives

Account data and workflow data are stored on servers in the European Union. Where a sub-processor operates outside the EU — some model providers do — the transfer is covered by the standard contractual clauses, and which providers those are is part of the list above.

6. Your rights

Under the GDPR you may ask for a copy of the personal data we hold about you, ask for it to be corrected, ask for it to be deleted, ask us to restrict what we do with it, object to processing based on legitimate interest, and receive your data in a portable form. That covers a chat conversation too, if you started one. Write to hello@castomo.com and we will answer within one month.

Deleting an account removes it across the whole family: the account record, the workspaces you own, the workflows, the run history and the stored credentials. Some things survive the deletion because the law requires it — invoices, principally — and those are kept for their statutory period and used for nothing else.

If your personal data is inside somebody else's workflow — because you are their customer rather than our user — then they are the controller and your request goes to them. We will help them answer it; we will not answer it over their head, because we cannot verify a request about a record we hold only on their instruction.

You also have the right to complain to a supervisory authority. In Poland that is the Urząd Ochrony Danych Osobowych.

7. Breaches, and changes to this page

If something happens that puts your data at risk, you will hear it from us, promptly, with what is known and what is not — and the supervisory authority will hear it within the statutory seventy-two hours.

Changes to this page that are material will be announced to account holders before they take effect, not discovered afterwards. Typographical corrections will not be, because nobody wants that e-mail.