Privacy policy
Last updated 3 November 2026
Castkey lets a team's AI assistants (such as Claude) work with the team's own YouTube, Facebook, Instagram and TikTok accounts. This page says what Castkey stores, why, and how to have it deleted.
What we store
- Team members: name, email address and Google account id, so people can sign in with Google and admins can decide who may do what. Names and emails are encrypted in our database.
- Linked social accounts: the account's id and name (for example a YouTube channel or Facebook Page), the permissions it granted, and the access tokens the platform issued. Tokens are encrypted (AES-256-GCM) and are never shown to team members or AI assistants.
- Activity log: which person used which tool on which account, when, and whether it worked. We do not store the videos, posts or captions themselves.
- Sign-in records for AI assistants: stored only as one-way hashes.
How we use it
Only to do what a signed-in team member asks through their AI assistant, within the permissions an admin gave them and the platform granted: for example, list videos, upload a video, or publish a post. Videos and images are fetched from the link given and sent straight to the platform; they are not kept.
We do not sell data, show ads, or use platform data to train AI models. We do not share it with anyone except the platform the action is for.
Google user data
Castkey's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube features are subject to the YouTube Terms of Service and the Google Privacy Policy.
Where it is kept
On a server in the European Union (Ireland), behind HTTPS. Only Castkey admins can link or remove accounts.
Deleting your data
- An admin can disconnect any linked account on the Channels page. Castkey revokes its access at the platform where the platform allows it and deletes the stored tokens straight away.
- You can also remove Castkey's access yourself: Google at myaccount.google.com/permissions, Facebook in Settings > Business integrations, Instagram in Settings > Website permissions, TikTok in Settings > Security > Manage app permissions.
- To have your team-member record and activity removed, contact the Castkey administrator who invited you. We delete it within 30 days.
Activity records are kept for up to 12 months, then deleted.
Contact
Questions: the Castkey administrator who invited you.