Privacy
Who holds what, and who is answerable for it
There are two entirely separate questions here and they get muddled constantly. What we hold about you, our customer, is one. What you hold about your contacts, using our software, is a different one with a different answer — and the difference is the whole legal shape of the product.
This website counts visits and offers a chat
The pages you are reading have no tracking pixels. Neither this site nor the services it uses set any cookies. There are no scripts from other companies: every page loads scripts only from this website and from two services run by Castomo, Observer (observer.castomo.com) and the chat button (chat.castomapi.com). The fonts are served from this domain rather than from somebody else's. Your accessibility and language choices are stored in your own browser's local storage and never leave it.
Analytics: Observer. We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.
Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.
We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.
Chat assistant. Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.
When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.
The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.
We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.
Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.
The demo on the home page is an exception, and only if you use it. The sentence you type and the funnel drawn from it — or a ready-made funnel once you change it — are sent to castomapi-try, our own service, run by Castomo P.S.A. on servers in the European Union, and kept as a draft for 30 days so you can come back to it. After 30 days an unsaved draft is deleted. The draft is opened by a key kept in your browser's local storage (not a cookie), and nobody else can open it unless you share a link to it. If you sign in to keep it, your sign-in session is kept in the same local storage (under cks:try-session) so the page can move the draft into your account; clearing your browser data removes it. Your internet address is used only to stop the demo being abused — an hourly limit held in the service's memory and never written down.
A funnel drawn from a sentence is written by an AI model: the sentence goes, through the OpenRouter routing service, to one of the model providers it lists, and some of those — free models in particular — may keep what they receive under their own terms. The ready-made funnels involve no model at all. So give the demo the job, not anybody's personal data — no names, addresses or contact lists; it does not need any. The demo designs a funnel and sends nothing to anyone.
If you save a draft to a castomo account, from then on it belongs to that account and is covered by what this page says about your own account: it stays until you delete it or the account.
The application at app.clicksomo.com is a different thing and is described below.
You are the controller. We are the processor.
For the contacts in your account, you decide why they are there and what happens to them. That makes you the data controller under the GDPR. Castomo P.S.A. processes them on your instructions, and on no other basis.
This is not a formality. It is why the consent ledger exists, why a CSV import can never claim consent, and why no other product in the castomo family can read or write your contacts. There is no ingest lane through which a sibling service could add somebody to your list, because such a lane would quietly make us a controller of data we have no relationship with.
For your own account, we are the controller
Sign-in is a castomo account handled by a separate identity service. ClickSomo itself stores three opaque identifiers — a tenant, a project and a user — and never sees your password or your profile. Plan limits arrive as numbers: contacts, sends, generations. No amount, no currency, no card, no invoice.
- 1CustomersYou. Held by the identity service. Password, profile, sessions — none of it here.
- 2ContactsThe people you market to. Held here, scoped to your tenant and project, yours.
- ×Never crossedA contact carries no password, no hash, no session and no key. A column that authenticated somebody would be an incident, not a feature.
Controller and processor, kept distinct
What is held about a contact
Only what a message and a funnel need
Identity and attributes
E-mail, optionally a phone number in E.164, the name exactly as it was given, a locale and timezone, and whatever attributes you chose to put there. The attributes are yours; we do not inspect or derive from them.
The consent ledger
One row per channel: state, lawful basis, source, evidence, timestamps and jurisdiction. This is the record that proves why a message was allowed to be sent, which is the record most useful to have when somebody asks.
Behaviour
An append-only log: what was sent, what was delivered, what was opened or clicked, and the events your own application posted. Partitioned by month, and used by triggers, segments and reports.
Messages
One row per message per contact per channel, with its status and its delivery events. Retained so that a report is auditable and a question about a send three weeks ago has an answer.
Suppressions
Hard bounces, complaints, unsubscribes and manual entries. Deliberately kept even after a contact is deleted, because forgetting that somebody asked not to be written to is worse than remembering the address.
Not held
No credential of any kind, no payment data, no cross-site tracking identifier, and nothing derived from a contact's activity on anybody else's website.
Tracking, and how to have less of it
Opens and clicks are served from a separate host, t.clicksomo.com, or a per-customer alias. Being separate means an open pixel carries no application cookie — it is not on the application's origin and cannot. Click redirects are signed and validated against the message's own link set, so the redirector cannot be used to point anywhere else.
Open tracking can be switched off per creative. Click tracking can be switched off per link. Neither is required for a funnel to work; you lose the corresponding trigger and the corresponding number, which for some audiences is the right trade.
Sub-processors
Delivery goes through the sending, SMS and push services, and from there through your provider or your mailbox — which you chose and which you have your own relationship with. AI generation calls a model gateway. Data is stored in the European Union.
- 1AskedThrough the API, or by writing to us. Either way it is the same operation.
- 2HereThe contact, their attributes, their consent rows and their message history.
- 3Runs stoppedAny funnel run for that contact ends. A sequence still addressed to somebody is not an erasure.
- 4Fanned outEvery sibling service that held a copy is told, over the family's internal lane.
- iWhat survivesThe suppression, so an erased address is not mailed again by a later import. It holds nothing but the address and the reason.
Export works the same way
Your rights, and your contacts' rights
If you are one of our customers, write to hello@castomo.com for access, correction, export or deletion of your own account data.
If you received a message sent through ClickSomo and want it to stop, use the unsubscribe link in the message — it is one click, it is honoured immediately, and it is checked again at the moment of every subsequent send. If you want your data erased rather than merely suppressed, the controller is the business that wrote to you, and their name and postal address are in the footer of the message you received. Write to them; they can action it here in one request. If you cannot reach them, write to us and we will help you find the right party.
The data controller for this website and for castomo accounts is Castomo prosta spółka akcyjna, ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Poland, KRS 0001188843. You also have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).
Being straight about scope: this page describes how the product handles data. It is not legal advice, and it does not substitute for the data processing agreement that governs the relationship — ask and you will get it.