Skip to main content

Privacy Policy

Last updated: 8 July 2026

Castly is a tool for professionals, and we treat your work like it. This policy explains what we collect, why, and, most importantly, how we handle the source code you convert.

On this page

1. Who we are

Castly is a product of DawnForge Studios ("we", "us"). We provide a hosted service that compiles hand-built HTML/CSS (and approved public URLs) into native, editable Elementor templates. For any privacy question, reach us through the contact page.

2. What we collect

  • Account data: your email address, a securely hashed password, and a generated API key. We never store your password in plain text.
  • Billing data: handled by our payment processor (Stripe). We receive a customer/subscription reference and your plan; we never see or store your full card number.
  • Usage & project history: for each conversion we store lightweight metadata: a title, timestamp, credit cost, part/page counts, a status, and (after you run it) a fidelity score. Retention follows your plan (see §7).
  • The source you submit: the HTML/CSS/JS or public URL you convert. See §3 for exactly how this is handled.
  • Operational logs: one line per API request (method, path, status, duration, a request id). Logs are body-free by design; they never contain your submitted source.

3. Your source code (the important part)

The code and URLs you submit are processed only for the duration of the conversion to produce your Elementor output. We do not use your code to train machine-learning models, and we do not sell or share it with third parties. The compile engine is stateless per request; your source is not persisted after the conversion completes; only the lightweight project-history metadata in §2 is kept.

If you need full control over where your code is processed, the Enterprise plan offers a self-hosted engine that runs inside your own infrastructure.

4. How we use your data

  • To run conversions and return your output, preview, and fidelity report.
  • To operate your account: authentication, sessions, credit metering, and billing.
  • To send transactional email you request (e.g. a password-reset link). We do not send marketing email without your consent.
  • To keep the service secure and reliable (rate limiting, abuse prevention, debugging via request ids).

5. Service providers (processors)

  • Stripe: subscription and payment processing.
  • Resend (or an equivalent email provider): delivery of transactional email such as password-reset links.
  • Our hosting provider: runs the engine and stores the accounts database.

Each provider processes only the data needed for its function, under its own terms and security controls.

6. Cookies

We use a single strictly-necessary session cookie (castly_sess, HttpOnly) to keep you signed in. We do not use advertising or cross-site tracking cookies. Your browser's localStorage may hold a local copy of your recent project history as an offline fallback. See our Cookie Policy for details.

7. Data retention

  • Account data: kept while your account is active; deleted on request.
  • Project history: retained for the window your plan provides (Starter 7 days, Pro 90 days, Agency 1 year; Free keeps no server-side history). Enterprise retention is set by contract.
  • Submitted source: not retained after the conversion (§3).
  • Logs: retained briefly for operations and security, and contain no submitted source.

8. Your rights

You can access, export, correct, or delete your account data at any time, from your account settings or by contacting us. If you are in the EU/EEA or UK, you have rights under the GDPR (access, rectification, erasure, portability, objection). Our legal basis is the performance of our contract with you and, where applicable, your consent. You may also lodge a complaint with your local data-protection authority.

9. Security

Traffic is served over TLS. Passwords are hashed with a per-user salt (scrypt). API keys are secret credentials; treat them like passwords. No system is perfectly secure, but we design for least exposure (body-free logs, transient source handling, private network binding behind a reverse proxy).

10. Changes & contact

We may update this policy as the product evolves; the "last updated" date above reflects the latest version, and material changes will be communicated in-app or by email. Questions? Use the contact page.