Privacy
What we hold,and why.
This page is about two separate things that are easy to confuse: this website (how this site counts visits with our own analytics, what the chat assistant keeps, and how to reach us), and the castomUI service, which holds your projects in order to build and publish them. Both are covered below, in that order.
This website
No cookies. Neither this site nor the services it uses set any. No scripts from other companies: every page loads scripts only from this website and from two services run by Castomo: Observer (observer.castomo.com) and the chat button (chat.castomapi.com).
Analytics: Observer. We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.
Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.
We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.
Chat assistant. Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.
When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.
The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.
We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.
Your colour, text-size, spacing and motion preferences are stored in your own browser's local storage, under names beginning cui:, and never leave it. Clearing your site data removes them.
Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.
The contact form is another exception, and only if you send it. The topic, your name if you gave one, your e-mail address and your message are posted through proxy.castomui.com to our own feedback inbox on castomAPI, run by Castomo P.S.A. Alongside them go the page's language and address, your browser's user-agent string and the size of its window — the details that make "something is broken" answerable. They are used to reply to you and for nothing else.
The web server keeps ordinary access logs for a short period, as any web server does, for security and for diagnosing faults. There is no profile behind them and nothing is combined with anything else.
The castomUI service
Using castomUI means signing in with a castomo account, and from that point there is a service holding data in order to do the job. Specifically:
Your account. The e-mail address and account identity that castomo holds, plus which plan you are on, how many seats and what has been billed. Standard, and unavoidable if anything is to be paid for.
Your projects. Pages, blocks, components, templates, menus, settings, descriptions, code and redirections — everything that makes up a site in the editor. These are documents on your account.
Your media. The files you upload, generate or add from stock, with their names, tags, ALT text and the EXIF data the editor reads from them. EXIF can include where and when a photograph was taken; if that is not something the world should know, strip it before uploading.
Your data. Dataset records you enter, and the address, login and key of any external database you connect. Those credentials are held so the editor can reach the database you pointed it at, and are used for nothing else.
The people you work with. The first name, last name, e-mail address and role of everybody you invite to a project, and the notes and chat messages written inside it.
What an AI step sends,
and where.
Generating a project, a page, a block, a component, META, llms.txt, base CSS, an image or a translation means sending a model the material it needs: your instructions, the parts of the project you chose to include as context, and the content of any source address you gave it to read.
What it does not send is everything else on your account. Each action says which context goes in, and you decide. A project for one client does not carry another client's material.
Models are reached through castomAPI, the platform underneath, among them DeepL, OpenAI and Grok models. What a provider does with what it receives is governed by its own terms, and they are not all alike — which is one reason the model is chosen per action. Where a model runs matters to some businesses; if it matters to yours, ask before you start rather than after.
Who else sees anything.
Wherever you publish. Publishing to cstmui.com, to your own domain, to GitHub or to a custom publisher puts your site there, and a public website is, by design, public. GitHub holds what you push under its own terms. A preview code shows a hidden preview only to the people you give it to.
Stock libraries. Browsing Pixabay, Unsplash, Pexels, Openverse or Wikimedia Commons sends them your search terms, through castomAPI, and nothing about you.
castomAPI. The platform underneath, run by the same company, carries media and AI for the editor.
Your collaborators. Exactly the people you invited, with the role you gave them.
Nothing is sold, and nothing is passed to an advertising network. There is no advertising network involved in any part of this.
How long, and how to get it back or removed
Your projects, media and data are kept while your account exists, because a website that forgets its own pages is not much of a website. Deleting a project or a file in the editor removes it. Access logs are short-lived. Billing records are kept for as long as tax law requires, which is not a decision we get to make.
You can ask for a copy of what we hold, a correction of something wrong, or a deletion. That covers a chat conversation too, if you started one. Write to hello@castomo.com and say which; it reaches a person. One castomo account signs into the whole family, so deleting it is one request rather than several.
A site already published to your own domain, or code already pushed to your GitHub repository, is not ours to remove. It is on your server or in your repository, under your control, and deleting it is done there.
The controller
The controller is Castomo prosta spółka akcyjna, ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Poland. The full registration details are in the footer of every page on this site.
Where the sites you build hold other people's data — customers in a dataset, members of a community, recipients of a mailing campaign, or a database you connected — you are the controller of that data and we are processing it for you. If you need that written down as a data processing agreement, ask and you will get one.
You have the rights the GDPR gives you, including the right to complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office. We would rather you wrote to us first, but that is your choice and not a precondition.
Plainly: this site counts visits with our own analytics; it keeps what you write in the form only if you send it, and a visitor record and your conversation, until 180 days after your last visit, only if you open the chat — as described above. The service holds your projects because building websites out of nothing is not a feature we offer, and it is all visible to you inside the editor. If something here is unclear, that is worth an e-mail — the answer usually improves this page.