Legal
Privacy Policy
Effective and last updated: 1 October 2026
This notice explains how Castane AI collects and uses personal data when you visit or use Compactly. We do not sell personal data, use uploaded media to train artificial-intelligence models, or use advertising or cross-site tracking technologies.
1. Controller and contact
The controller responsible for the processing described in this notice is:
Castane AI, SASUSIREN 909 864 597 — RCS Paris
241 rue Saint-Jacques, 75005 Paris, France
Email: contact@castane-ai.com
Use that email address for privacy questions and data-subject requests. Please include “Privacy request” in the subject line.
2. Data, purposes, and legal bases
| Data | Purpose and source | Legal basis |
|---|---|---|
| Email address, user ID, authentication data, session data, and optional Google profile identifiers | Create and secure your account, authenticate you, deliver transactional authentication emails, and provide protected features. Supplied by you or, if you choose Google sign-in, by Google. | Contract (GDPR Art. 6(1)(b)); security and abuse prevention are also our legitimate interests (Art. 6(1)(f)). |
| Uploaded images and videos, filenames, requested settings, and generated output files | Perform the crop, resize, compression, batch-processing, or key-frame operation you request. Supplied directly by you. | Contract and steps taken at your request (Art. 6(1)(b)). |
| Plan status, Stripe customer ID, checkout metadata, payment status, and limited transaction records | Provide paid features, administer purchases, prevent duplicate webhook processing, and maintain accounting records. Obtained from you and Stripe. We do not receive or store full card details. | Contract (Art. 6(1)(b)) and legal and accounting obligations (Art. 6(1)(c)). |
| IP address, request time, requested route, response status, device/browser information made available in requests, and diagnostic error data | Operate, diagnose, rate-limit, and secure the service and investigate suspected abuse. Collected automatically. | Our legitimate interests in reliability, network security, fraud prevention, and abuse prevention (Art. 6(1)(f)). |
| Messages and information included in privacy or support requests | Respond, verify and fulfil rights requests, and retain an appropriate record of the request. Supplied by you. | Legal obligations (Art. 6(1)(c)) and our legitimate interest in managing correspondence and legal claims (Art. 6(1)(f)). |
Account information is required to create and use an account. Without it, protected features cannot be provided. Uploading media is optional, but we cannot perform a requested job without the relevant file. Billing information is required only if you choose a paid plan.
We do not make decisions producing legal or similarly significant effects about you solely by automated means, and we do not profile you for advertising.
3. Uploaded media
Files are uploaded over an encrypted connection to our backend hosted by Render. Processing is not performed solely inside your browser. Working files and outputs are placed in a temporary, per-job workspace and deleted when the request finishes. If a process is interrupted unexpectedly, residual temporary data remains only on the service instance's ephemeral storage and is removed when that instance is replaced or its temporary storage is cleared.
Smart Crop uses automated face detection only to score possible crop regions. It does not identify people, compare identities, create biometric templates, or use faces for authentication. Uploaded files are not used for model training, advertising, or unrelated product development.
Media may contain personal data about other people. You must have the necessary rights and lawful basis before uploading it. Avoid uploading sensitive personal data unless it is necessary for the processing you request.
4. Recipients and processors
Access within Castane AI is limited to people who need it to operate, secure, support, or administer the service. We use these providers:
- Supabase: authentication, account database, and transactional authentication services. It receives account, session, plan, and related technical data.
- Render: frontend and backend hosting. It processes uploaded media and outputs transiently and receives service and request logs.
- Stripe: checkout, payments, subscriptions, and billing portal. Stripe receives account and transaction data and handles payment-card data under its own privacy terms. For some regulated payment activities, Stripe acts as an independent controller.
- Google, only if you choose Google sign-in: Google supplies the authentication identifiers and profile information you authorize and acts under its own privacy terms.
We may also disclose data when required by law, a court, or a competent public authority, or when necessary to establish, exercise, or defend legal claims. We do not sell or rent personal data.
5. International transfers
Some providers or their subprocessors may process data outside the European Economic Area. Where the destination is not covered by a European Commission adequacy decision, transfers are protected by an approved mechanism, such as the European Commission's Standard Contractual Clauses, with supplementary measures where required. Contact us to request information about safeguards relevant to your data or a copy of applicable clauses; commercially confidential information may be redacted.
6. Retention
- Uploaded media and outputs: deleted at the end of the processing request, subject to the interrupted-job handling described above.
- Account and profile data: kept while your account is active, then deleted or anonymized after a valid deletion request, subject to provider backup cycles and data retained for legal obligations or claims.
- Authentication and service logs: kept according to the configured security and hosting plan's rolling retention period. The criterion is the time needed to secure and diagnose the service within the provider's configured retention window.
- Billing and accounting records: accounting documents and supporting evidence are kept for ten years as required by French commercial law. Other billing metadata is removed when no longer needed for the contract, disputes, fraud prevention, or webhook idempotency.
- Rights requests and legal correspondence: kept for the time needed to answer the request and demonstrate compliance, and longer only where required for a legal claim.
8. Security
We use measures designed to protect personal data, including HTTPS in transit, authenticated access, signed-token verification, restricted server credentials, database row-level access controls, rate limiting, and isolated temporary workspaces. No internet service can guarantee absolute security. Contact us promptly if you believe your account or data has been compromised.
9. Your rights
Subject to applicable conditions and exceptions, you may request access, correction, deletion, restriction, and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing. We do not use personal data for direct marketing.
Send requests to contact@castane-ai.com. You may request account deletion through that address. We may ask for information reasonably necessary to verify your identity. We normally respond within one month; where permitted, that period may be extended by two months for a complex or numerous request, and we will explain the extension.
You may complain to the supervisory authority where you live or work or where you believe an infringement occurred. In France, this is the Commission nationale de l'informatique et des libertés (CNIL).
10. Children
The service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.
11. Changes to this notice
We may update this notice when the service, providers, or legal requirements change. We will change the date above and, for a material change, provide an appropriate additional notice before it takes effect where required.