Privacy Policy
Last updated: [DATE] · DRAFT — pending legal review, not yet in effect
1. What we collect
Directly from you:
- Account info — email address and display name (from Google sign-in, or the email you register with directly); a hashed password if you sign up with email/password (the plaintext password is never stored); email-verification status.
- Content you submit — lyrics or dialogue text, and comic panel images, for the purpose of generating an adaptation.
- Payment metadata — where paid credit purchases are live, transaction identifiers and amounts from our payment processor. We do not receive or store your full card number; that's handled entirely by the payment processor.
- API keys — if you generate one, we store a one-way hash of it, not the raw key (the raw key is shown to you once, at creation, and cannot be recovered by us afterward).
Generated automatically:
- Your adaptation history (what you submitted, the result, and its language) if you're signed in and choose to keep it — see §3.
- Usage/quota counters (request counts per day, per IP address or API key) used to enforce rate limits.
- Standard server logs (IP address, timestamps, error details) for operating and debugging the Service.
2. Third parties we send your content to
To generate an adaptation, the text (and, for comics, the panel image) you submit is sent to the AI providers Castia's pipeline is built on:
- OpenAI (and/or Anthropic, depending on deployment configuration) — for the translation/adaptation language models.
- Google Cloud Vision — for extracting text from an uploaded comic panel image (OCR).
Each provider processes what we send under its own terms and privacy policy; we do not control how long they retain data on their side. We only send what a given feature actually needs — for example, an image is sent to Google Cloud Vision to read its text, and separately may be sent to an AI vision model if that optional reading-quality feature is enabled for a given deployment.
Where paid credit purchases are live, payment processing is handled entirely by [Paddle (or the live payment processor at time of launch)], acting as merchant of record — they receive what's needed to process your payment (billing details, card information) directly; we do not.
3. Caching and how adaptation results are shared
To avoid re-running the AI pipeline on identical input (which costs real money and time), a completed adaptation is cached on our servers, addressed by a hash of the submitted content and target language — not by who submitted it. If a different user submits the exact same text, they may be served the cached result rather than triggering a new AI run. This cache is not linked to any account by default.
If you're signed in and the adaptation is recorded to your account (automatically for adaptations you run, or explicitly if you star/save someone else's shared result), that link between your account and the result — and the result itself — is retained until you delete it or your account.
For comic panel redraws specifically: the erased-and-relettered output image is cached the same content-addressed way described above. The original image you upload for OCR is processed to extract text and is not separately stored beyond that processing.
4. How long we keep data
Account records (email, credit balance, adaptation history) are kept for as long as your account exists. Content-addressed cached results (§3) may persist independently of any one account, since they can be shared across users who submit identical content. Server logs are retained for a limited operational window before routine deletion.
5. Your choices and rights
You can review your adaptation history, favorites, and collections from your account dashboard at any time. Deleting individual saved adaptations or collections is available from the dashboard. Full account deletion is not yet a self-service feature — email [support@usecastia.com or your real support inbox] to request it, and we'll delete your account record and its linked history (content already shared via the caching mechanism in §3, submitted by other users, is not deleted, since it isn't yours to delete).
If you are located in the EEA, UK, or another jurisdiction with its own data protection law (such as the CCPA/CPRA in California), you may have additional rights over your personal data — including access, correction, deletion, and portability — beyond what's described above. [This section should be reviewed and expanded by counsel for the specific jurisdictions you operate in before publishing].
6. Children's privacy
The Service is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them.
7. Changes to this policy
We may update this policy as the Service changes. Material changes will be reflected by updating the "Last updated" date above.
8. Contact
Questions about this policy or your data: [support@usecastia.com or your real support inbox].