What this website collects about you.

Last reviewed: 30 September 2026. This page covers castomind.com, the public website, including the demo on its home page. The castoMIND service at app.castomind.com is a different thing with its own agreement and its own privacy terms — signing in there is not covered by this page.

Who is responsible

The controller of any personal data connected with this website is Castomo prosta spółka akcyjna, ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Poland; KRS 0001188843, NIP 8993033031.

You can reach us about anything on this page at hello@castomo.com.

What this website does not do

• No third-party analytics. No Google Analytics, no Plausible, no Matomo, no pixel, no session recording. Visits are counted by Observer, the castomo family's own cookie-less, privacy-first analytics, built in-house to make our products better: it measures how pages are used. What it records is listed under "Analytics: Observer" below.
• No scripts from other companies. Every page loads scripts only from this website and from two services run by Castomo: Observer (observer.castomo.com) and the chat button (chat.castomapi.com). The content security policy declared on every page refuses to load a script from any other origin, and the only other addresses a page may talk to are our own: the home-page demo's service at app.castomind.com and castomo sign-in at accounts.castomo.com. You can check this in your browser's developer tools; it is not a promise, it is a rule the browser enforces.
• No cookies when you visit. Visiting this site sets no cookie: neither this site nor the services it uses set one. The one cookie involved is left by the castoMIND app after you sign in there, and this site only reads it, to show your name — see "The cookie after you sign in to the app" below.
• One form on the home page, and a chat. The demo sends what you type into it — see the next section; so does the chat button, see "Chat assistant" below. Otherwise there is nothing on this website you can submit: the contact page is an e-mail address, which means what you send us is what you decided to write.
• No embedded fonts, maps, videos or social widgets. The typeface is served from this website. Nothing here quietly tells another company that you visited; the chat button loads from Castomo's own servers.

The demo on the home page

This is an exception, and only if you use it. The idea you type and the names, team and plan made from it — or an example once you change it — are sent to castomapi-try, our own service, run by Castomo P.S.A. on servers in the European Union, and kept as a draft for 30 days so you can come back to it. After 30 days an unsaved draft is deleted. The draft is opened by a key kept in your browser's local storage (not a cookie), and nobody else can open it unless you share a link to it. Your internet address is used only to stop the demo being abused — an hourly limit held in the service's memory and never written down.

The names, the team and the plan are written by an AI model: your idea goes, through the OpenRouter routing service, to one of the model providers it lists, and some of those — free models in particular — may keep what they receive under their own terms. The examples involve no model at all. So describe the business, not anybody's personal data; the demo does not need any. For the same reason, the promise further down that your idea is not used to train anything is about an idea you engage us to run — for what you type into the demo, the model provider's terms apply.

If you save a draft to a castomo account, from then on it belongs to that account: it stays until you delete it or the account.

Analytics: Observer

We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.

Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.

We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.

Chat assistant

Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.

When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.

The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.

We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.

If you write to us

We receive what you put in the e-mail: your address, your name if you signed it, and whatever you told us about your idea. Nothing is added to it — no tracking identifier, no record of which pages you read before deciding to write.

We use it for one thing: to answer you about castoMIND. It is not added to a mailing list, not sold, and not shared outside Castomo. The lawful basis is your request — taking steps at your request before entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in replying to business enquiries (Article 6(1)(f)) where no contract follows.

We keep the correspondence while the conversation is live and for up to 24 months afterwards, so a thread can be picked up when somebody writes again. Ask us to delete it and we will, at any time, by writing to the same address.

What we hold when we run an idea through the pipeline

If you engage us, the description you send becomes the working document for the run, and what gets produced from it lives on your account in the castomo family — the site on castomUI, the board in dash-b, the workflows in castomFLOW, the contacts in iKonekt, and so on. Each of those services has its own terms and its own privacy terms, which is where the details of that processing live.

Your idea is not used to train anything, is not shown to other customers, and is not published anywhere by us. If you would rather we deleted the working document once the run is finished, say so and we will.

What is stored in your browser

If you use the accessibility panel in the header, your choices are saved in your browser's local storage under four keys: cmd:theme, cmd:size, cmd:spacing and cmd:motion. They hold values like dark or large.

These never leave your device, are never sent to us or to anyone else, and are not readable by any other website. Clearing your browser's site data removes them, and the site works perfectly well without them — it simply forgets that you preferred the dark theme.

The demo on the home page keeps entries of its own there, and only once you use it: cmd:try-drafts holds the key to each draft you made in this browser, cmd:try-pending remembers what you asked to keep while you go to sign in, and cmd:try-pkce and cmd:try-session hold the castomo sign-in if you create an account or log in from the demo. Unlike the settings above, these are sent somewhere — only to our own demo service and to castomo sign-in — because opening a draft and saving it to your account is what they are for. A draft's key is removed once that draft is saved to an account.

Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.

The cookie after you sign in to the app

Only after you sign in to the castoMIND app at app.castomind.com does the app leave one cookie that this website can read. It is a plain first-party cookie named castomo_user. It is not set for anyone who has not signed in, and nothing on this website sets it.

It holds one thing: the part of your e-mail address before the @, cut to at most 40 characters. It is there so the button in this site's header can show your name instead of "Start with castoMIND". It is only a label: it gives no access to your account, and this website's server does not use it.

The cookie is set for castomind.com, so your browser sends it to castomind.com and its subdomains, such as app.castomind.com, over HTTPS only (Secure) and not with requests other websites make in the background (SameSite=Lax). It lasts 30 days and is renewed each time you visit the app. Signing out of the app removes it, and so does clearing your browser's cookies or site data for castomind.com.

It is not used to track you, and it goes nowhere except to castomind.com and its own subdomains: no other company or service receives it.

What the server records

Serving a web page requires a server, and servers keep access logs. Our hosting provider records the usual technical entries — the IP address a request came from, the time, the page requested, the browser's user-agent string and the response status. This is ordinary operation of a website, used to keep it running and secure, not to build a profile of anybody.

We do not combine those logs with anything else and we do not analyse them for marketing. There is no identifier on this website that could connect a log entry to a person. (The chat's visitor session is kept by castomapi-chat, not in these logs.) The hosting provider acts as a processor on our behalf under a data-processing agreement. The lawful basis is our legitimate interest in operating and securing the website (Article 6(1)(f) GDPR).

The read-aloud button

The Listen button in the header uses the speech synthesiser built into your own browser and operating system. No text is sent anywhere and no service is called. If your device has no voice installed for the page's language, it uses the default voice and tells you so.

Your rights

Under the GDPR you may ask for access to your personal data, its rectification or erasure, restriction of processing, and you may object to processing based on legitimate interest. Where processing is automated and based on consent or a contract, you may ask for portability.

On this website there is very little to exercise those rights against — the honest answer to "what do you hold about me?" is normally "an entry in a web server log, any e-mail you sent us, a demo draft if you made one, a chat conversation if you started one, and, for 24 hours, a raw analytics record of your visit". Write to hello@castomo.com and we will tell you exactly that, in writing, without making it difficult.

If you think we have handled your data badly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

Links to other websites

This site links to the other products in the castomo family and to a small number of external sites. Once you follow a link you are on someone else's website, under their policy. We chose the links; we do not control the pages at the other end of them.

Changes

If this page changes materially, the review date at the top changes with it. There is no mailing list to notify, because — see above — we do not have your address unless you gave it to us.