Privacy Policy

Last updated: 11 October 2026

Castbase (“we”, “us”) provides a web app at app.castbase.io that helps agencies and brands create social media content and schedule it to their own Instagram and Facebook accounts. This policy explains what we collect, why, and the choices you have.

Who we are

Castbase is provided by WOW London Ltd, 10 Harland Avenue, Croydon CR0 5QB, United Kingdom, and is operated from the United Arab Emirates. WOW London Ltd is the controller of the personal data described here.

What we collect

• Account data: your name, email address and password (stored hashed by our authentication provider), and the workspace and brands you belong to.
• Content you create or upload: brand guidelines, logos, images, videos, captions and schedules.
• Connected social accounts: when you connect Instagram or Facebook we receive an access token, the IDs and names of the Pages and Instagram professional accounts you choose, the permissions you granted, and the results of posts we publish for you (post IDs, links, errors). If you ask us to learn your style from Instagram, we read your own recent posts and captions.
• Website imports: if you give us a website address, we fetch that public page to suggest colours, fonts and logos.
• Billing: handled by Stripe. We do not store card numbers.
• Usage and diagnostics: basic logs needed to run and secure the service, and problem reports you send us.

How we use it

• To provide the service: generate content, show previews, and publish to the accounts you select at the times you choose.
• To keep the service secure and working, and to support you.
• We do not sell your data, use it for advertising, or publish anything you have not scheduled or approved.

Data from Meta (Instagram and Facebook)

• We only use Meta data to publish and manage content on the accounts you connect, and to show you the results.
• Access tokens are encrypted at rest and never shown in the app.
• You can remove Castbase’s access at any time in your Facebook settings under Apps and Websites, and ask us to delete the data we hold. See Data deletion.

Service providers

We use trusted providers to run Castbase. Most process data only on our instructions; some, such as Meta and Stripe, also handle data under their own privacy policies:

• Supabase (database, authentication, file storage; hosted in the United Kingdom, London region)
• DigitalOcean (application hosting and media storage)
• Cloudflare (custom domains and network security)
• Anthropic (AI writing and brand analysis) and Higgsfield (AI image generation): only the text and images needed for the request you make
• Stripe (payments) and Windsor.ai (analytics, only if you connect it)
• Meta (Instagram and Facebook), to publish the content you schedule

How long we keep data

• We keep your data while your account is active.
• When you ask us to disconnect a social account, we delete its access token. If you remove Castbase in Facebook, the token stops working straight away and we delete it once we detect this, or sooner on request.
• When an account is deleted we delete its content, files and connections within 30 days, except where we must keep records by law (for example invoices).

Legal bases

• Contract: to provide the service you signed up for, including publishing to accounts you connect.
• Legitimate interests: to secure, support and improve the service.
• Consent: when you connect a social account or ask us to analyse your Instagram or website. You can withdraw it at any time.
• Legal obligation: for records we must keep, such as invoices.

International transfers

Some providers (for example Anthropic, Meta and Stripe) process data in the United States or other countries. Where data leaves the UK or EU we rely on the providers’ standard contractual clauses or equivalent safeguards.

Your rights

You can ask to access, correct, export or delete your personal data, or object to how we use it. Email [email protected] and we will reply within 30 days. You can also complain to your data protection authority where you live (in the UK, the Information Commissioner’s Office).

Security

Data is encrypted in transit. Each workspace is isolated from others at the database level, uploaded files are private, and social tokens are encrypted.

Changes

If we change this policy we will update the date above, and tell you in the app for significant changes.