Privacy Policy
This policy explains what data Castfrom (“the Service”) collects, why, how long it is kept, and how you can have it deleted. Castfrom is operated by Social Marketing Inc., Bunkyo-ku, Tokyo, Japan (“we”, “us”). It applies to the website at castfrom.social-marketing.io and to the Castfrom application.
1. What Castfrom does
Castfrom lets you connect social media accounts that you own or are authorised to manage, publish posts to those accounts, and view performance metrics for the posts you published. Supported networks are X, TikTok, Instagram, Threads and YouTube. If you choose, Castfrom can also promote your own Instagram posts as ads on an ad account you own and share with us, and search public Instagram posts by hashtag and look up public business accounts through your own Instagram account (section 8). All access goes through each network’s official API.
2. Data we collect
| Category | What | Source |
|---|---|---|
| Account information | Your name, email address and organisation, used to create and secure your Castfrom login. | You |
| Connected-account data | The network’s user ID, username, display name and profile image of each account you connect; the access token and refresh token the network issues to Castfrom. | The network, after you authorise Castfrom |
| Content you create | Post text, media files, captions, hashtags, scheduling times and per-network settings (audience, comment/duet/stitch permissions, brand disclosure, paid partnership label). | You |
| Post metrics | Performance data the network returns for posts you published through Castfrom or that belong to a connected account: for example views, likes, comments, shares, saves, reach, impressions, watch time, follower counts and aggregate audience statistics. | The network’s API |
| Comments and replies | Where the network provides them and you enable the feature, public comments or replies on your own posts, so that you can read and respond to them. | The network’s API |
| Ads you run through Castfrom | If you share a Meta ad account with Castfrom: its ID, name and currency; the ads Castfrom creates for you at your request (the post promoted, budget, schedule, placements, prefectures and age range, who drafted and who approved them); and their review status and results as Meta reports them (amount spent, impressions, reach, engagements, clicks). Castfrom never sees or stores your payment details. | You, and Meta’s Marketing API |
| Instagram searches and lookups | If you connect Instagram through Facebook for trends: your Facebook user ID and name, the Facebook Pages and Instagram professional accounts you choose to share, and the access token Meta issues. The hashtags you search and the public posts Instagram returns for them (post ID, caption, media type, like and comment counts, link, time posted and a media link); the public business and creator accounts you look up and what Instagram returns for them (username, name, biography, website, follower, following and post counts, and the captions, like, comment and Reels view counts and links of recent posts). Instagram does not tell Castfrom who posted a hashtag result. | You, and Meta’s Instagram Graph API |
| Technical data | Server logs (IP address, browser type, timestamps, pages requested) kept for security and troubleshooting. | Your browser |
Castfrom does not collect your network passwords. Authorisation happens on the network’s own login page, and the network gives Castfrom a limited token instead.
Castfrom does not read direct messages, does not collect personal data about your followers beyond the aggregate statistics the network exposes, and does not access accounts you have not connected.
3. How we use it
- To publish the posts you create to the accounts you selected, at the time you chose.
- To retrieve and display performance metrics for your posts.
- To show and let you respond to comments on your posts, where you enable it.
- If you use ads: to create the ads you set up on your own ad account, start them only after someone in your workspace approves them, stop them when you ask, and show their status and results.
- If you use trends: to search the hashtags you enter and look up the accounts you name through your own Instagram account, show the results to your brand, and help you plan your own posts.
- To keep your login and connected accounts secure, and to refresh tokens so connections keep working.
- To provide support and to diagnose problems.
- To comply with the developer policies of each network.
We do not sell your data. We do not use connected-account data for advertising, for building profiles of your followers, or for training machine-learning models. We do not share it with anyone except as described in section 5.
4. Legal basis
We process your data to perform the service you asked for, on the basis of your consent given when you connect an account, and to meet our legal obligations. You can withdraw consent at any time by disconnecting an account (section 7).
5. Who we share data with
- The networks themselves. When you publish, the post content and settings are sent to the network you chose. Their handling of that content is governed by their own terms and privacy policies.
- Hosting and infrastructure. Castfrom runs on Amazon Web Services in the Asia Pacific (Tokyo) region. AWS processes data on our behalf under its data processing terms.
- AI assistants you connect. If you connect an AI assistant (section 8), the results of the tools it uses are sent to that assistant at your request.
- Your organisation. If your Castfrom account belongs to a company or agency workspace, other members of that workspace can see the connected accounts, posts and metrics in it.
- Legal requirements. If required by law or a valid legal request.
6. Retention
- Access tokens are kept for as long as the account is connected, and are deleted when you disconnect it or when the network revokes them.
- Posts and metrics are kept for as long as your workspace exists, including after you disconnect an account, so that connecting it again brings its history back. YouTube data is the exception and is deleted when the channel is disconnected (see section 8). When you close your workspace, they are deleted 30 days after your request.
- Your Castfrom login data is kept while your workspace exists, and is deleted 30 days after you ask to close it.
- Photos and videos you add to your workspace’s media library are kept for 90 days from when you add them, then deleted automatically. You can delete them sooner on the Media page. Posts you published or scheduled from them are not affected.
- Records of ads you ran through Castfrom (settings, approvals and results) are kept for as long as your workspace exists. When you close your workspace, Castfrom first stops any ad still running, then deletes these records and the link to your ad account.
- Instagram trends: the Facebook access token is deleted when you disconnect trends or when Meta revokes it. Searches and lookups are kept in your brand until you delete them on the Trends page, disconnect with “Also delete the searches and lookups”, or close your workspace.
- Server logs are kept for up to 90 days.
7. Your choices and rights
- Disconnect an account. In Castfrom, open the account and choose “Disconnect”. Its token is deleted immediately. Its stored posts and metrics stay in your workspace until you close it, except YouTube data, which is deleted immediately.
- Revoke from the network. You can also remove Castfrom from the network’s side: X (Settings → Security and account access → Apps and sessions), TikTok (Settings → Security → Manage app permissions), Instagram and Threads (Settings → Website permissions / Apps and websites), YouTube (Google Account → Security → Third-party apps with account access). Revoking from the network stops Castfrom’s access at once.
- Disconnect Instagram trends. On the Trends page, choose “Disconnect”. Castfrom gives its Facebook permissions back to Meta and deletes the token at once; tick “Also delete the searches and lookups” to delete those too, or use “Delete all” at any time. You can also remove Castfrom in Facebook (Settings and privacy → Settings → Business integrations).
- Stop sharing your ad account. In Meta Business settings, open Partners, choose Social Marketing Inc. and remove the ad account and Instagram account. Castfrom can no longer create, change or read ads on them. Ads already running keep running until you stop them in Meta Ads Manager.
- Close your workspace. At the bottom of the Castfrom dashboard, choose “Close workspace”. We email a confirmation, and 30 days later delete the access key, every connected account, the media library, and all post records and history. Until then the workspace keeps working and you can withdraw the request on the same page. If you cannot sign in, email support@social-marketing.io from the address on your account instead; we confirm within 7 days and complete deletion within 30 days. Records we must keep by law are kept as long as the law requires.
- Access and correction. You can ask for a copy of the personal data we hold about you, or ask us to correct it, at the same address.
8. Platform-specific terms
YouTube
Castfrom uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy. Castfrom stores YouTube data (channel details, video metadata, and analytics for your own videos) only for as long as needed to show it to you, refreshes it at least every 30 days, and deletes it when you disconnect the channel. You can revoke Castfrom’s access at any time from the Google security settings page. Castfrom’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
TikTok
Castfrom uses the TikTok Login Kit, Content Posting API and Display API. Before each post you choose the audience and interaction settings yourself; Castfrom does not change them and does not add watermarks or branding to your content. Metrics are those TikTok exposes for your own videos.
Instagram and Threads (Meta)
Castfrom uses the Instagram Platform and Threads API provided by Meta. Publishing requires a professional Instagram account. Media you upload for publishing is placed temporarily on our servers so that Meta can fetch it, and is removed after publishing completes. Files you keep in your media library stay there for the period in section 6.
On Threads, Castfrom can also search public posts for a word you type, so that you can find conversations that mention you. The results are shown to you and are not stored, indexed or used for anything else, and each one links out to the post on Threads. Threads allows 2,200 such searches a day for each connected profile.
Instagram hashtag search and account lookups (trends)
To show what kinds of public posts people engage with in your field, Castfrom can search public Instagram posts by hashtag and read the public numbers of business and creator accounts. For this you connect your own Instagram professional account a second time, through Facebook Login for Business and the Facebook Page it is linked to. For searches and lookups Castfrom asks only for read permissions (instagram_basic, instagram_manage_insights, pages_show_list, pages_read_engagement, business_management) and does not post, comment or send messages through this connection. It posts through it only if you also choose to publish there, as described next.
Searches run on behalf of your own Instagram account and only for the hashtags you enter or choose. Instagram allows each account 30 different hashtags in 7 days, and Castfrom shows how many are left. Hashtag results contain public posts only, and Instagram does not include who posted them. Account lookups work only for public business and creator accounts and return what those accounts show publicly.
The results are shown only to your brand in Castfrom. Castfrom does not show them to other customers, does not sell them, and does not use them to identify, contact or build profiles of the people who posted. Each result links out to the post on Instagram.
Instagram posts with the Paid partnership label
If you connect Instagram through Facebook Login for Business and choose to publish there, Castfrom also asks for instagram_content_publish. Castfrom then publishes the posts you create to that Instagram account through the Facebook Page it is linked to, and, for a post you mark as a paid partnership, sets Instagram’s “Paid partnership” label. Castfrom publishes only when you press Publish, and only the text and media you chose. It keeps a record of each post published this way (the caption, which photo was used, the Instagram post ID and link, whether it was labelled, and who published it) in your brand, for as long as your workspace exists. Disconnecting removes the permission and deletes the token; posts already published stay on Instagram until you delete them there.
Meta ads
Castfrom uses Meta’s Marketing API to promote your own Instagram posts. You keep your ad account and pay Meta directly; Castfrom does not hold or handle your money. You share the ad account with Castfrom’s Meta business portfolio as a partner, and Castfrom acts on it through a system user of that portfolio. Castfrom creates every ad paused and starts it only after a person in your workspace approves it. Each ad has a lifetime budget, so Meta does not spend more than the total you approved, and your workspace has daily and total limits on top. Castfrom only works with ad accounts you shared with it and does not change your business settings, users or payment methods.
AI assistants (Claude and other MCP clients)
You can connect an AI assistant such as Claude to your workspace through Castfrom’s MCP server. You sign in on Castfrom’s own page with your account ID and access key; the assistant then holds a token that lets it use Castfrom’s tools for that workspace only (access tokens last 12 hours and refresh tokens 30 days, and a refresh token works once). Castfrom receives only what the assistant sends to a tool, such as the text and files of a post, the account to post to, or a search word, and handles it like anything you enter in the Castfrom website. Castfrom does not receive or store your conversation with the assistant, your chat history or your files in the assistant. What a tool returns (for example your accounts, scheduled posts and post metrics) is shown to the assistant, and from then on the assistant’s provider’s privacy policy applies to it. To stop access, remove Castfrom from the assistant’s connectors, or close your workspace; disabling your account ID stops every connection within a minute. Tools that post, change or cancel something are marked as such, so assistants like Claude ask you before using them.
If your workspace belongs to a group that checks posts against each account’s brief, the post text and images are checked by Anthropic’s Claude model running on Amazon Bedrock in the Tokyo region before they go out. Neither AWS nor Anthropic uses this content to train models.
X
Castfrom uses the X API v2. Posts made through Castfrom may be labelled by X as coming from an automated source in line with X’s automation rules. Metrics are those X exposes for your own posts.
9. Cookies
The public website sets no tracking cookies. The Castfrom application uses a session cookie that keeps you signed in; it contains no tracking identifiers and expires when you sign out or after a period of inactivity.
To measure how well our referral links work, when you open the website through one (an address ending in ?ref= followed by a code), your browser’s local storage keeps that code and the time for 60 days, so we can count a sign-up that follows. The browser also keeps a random identifier so a visitor is counted once a day. This is not a cookie and contains no personal information; you can remove it at any time by clearing this site’s data in your browser.
10. Security
Tokens and personal data are encrypted at rest and in transit. Access within our team is limited to the people who operate the Service. If we learn of a breach affecting your data we will notify you without undue delay.
11. Children
Castfrom is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
12. International transfers
Data is stored in Japan. Where a network you connect processes data outside Japan, that transfer is governed by your agreement with the network.
13. Changes
If we change this policy in a way that affects your rights we will post the new version here with a new effective date, and notify you in the application before it takes effect.
14. Contact
Social Marketing Inc. (ソーシャルマーケティング株式会社)
Bunkyo-ku, Tokyo, Japan
support@social-marketing.io