Privacy Policy

Cassit is a social-media operations service: it schedules, publishes, and measures posts for social accounts that you connect and own. This page describes what data that involves, all of it, and nothing else.

What we store

• Your account: the name and email address from your Google sign-in, used only to operate your workspace, and the name of the Cassit link you arrived by, if any (for example "facebook"), so we know which of our posts bring people in.
• Platform access tokens for the accounts you connect (Facebook Pages, Instagram, Threads, YouTube, TikTok, and the bot token of a Telegram channel). Tokens are encrypted at rest with a dedicated key-encryption key and are decrypted only at the moment a platform call is made on your behalf. They are never logged and never shared.
• Content and metrics: the posts you create in or send through Cassit, and the per-post performance numbers (views, likes, comments, reach) the platforms report back.
• Media you supply for posting, held only through the publish-and-verify window and then erased on a fixed retention schedule (14 days after a verified publish by default; unapproved uploads are erased after 30 days). Deletions are full byte erasure, and every erasure is logged.

The waiting list

When you ask for a place, we keep your email address and the optional note you wrote, plus the name of the Cassit link you arrived by, if any. A keyed hash of your IP address, not the address itself, is kept for up to 30 days to limit abuse. A request still waiting is deleted 180 days after you last asked. Once you are let in, the request is deleted 30 days later. We send you one confirmation email and one invitation. Write to support@cassit.app to be removed sooner.

What we do with it

One thing: run the social accounts you connected, under your control. Draft text may be generated by an AI model, and audio is stripped from any video before an AI model sees it. We do not sell or rent your data, and we share it only with the service providers named under Where it lives. There is no analytics use beyond showing you your own numbers and counting which of our own links people arrived by.

YouTube and Google user data

Cassit uses YouTube API Services. When you connect a YouTube channel, Cassit uploads the videos you schedule to that channel and reads back their statistics, acting only on your behalf. By using Cassit you are agreeing to be bound by the YouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy.

Cassit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data (your channel identity, the upload capability, and the view, like and comment counts on videos Cassit published for you) is used solely to publish and measure the videos you schedule, and to show you which of your own posts performed well. It is never transferred to third parties and never used for advertising.

You can withdraw that access at any time, from either side: disconnect the channel inside Cassit (Setup → the channel → Disconnect), or revoke it directly on Google's third-party connections page. Either one stops all further access immediately. What happens to data already stored is set out under data deletion.

Cookies and what is stored on your device

Cassit sets first-party session cookies when you sign in. They keep you signed in for the length of your session and do nothing else. When you are signed in, Cassit also sets a cookie named cassit_in, holding only the value 1, so our public pages can show "Back to Cassit" instead of "Sign in". It is readable across cassit.app, lasts up to 7 days, and is removed when you sign out or when it expires. If you would rather not have it, choose "Always show Sign in" below and we stop setting it; that choice is kept for a year in a cookie named cassit_in_off.

Cassit sets no advertising cookies, uses no third-party analytics, and does not allow any third party to place, access, or recognise cookies or similar technology on your browser through our pages. Media you post is read from your device only at the moment you choose a file to upload.

Where it lives

Our database is managed Postgres from PlanetScale, hosted in London. Media is stored on Cloudflare R2. Cassit runs on Cloudflare, which handles requests at its edge, wherever the visitor is, so we do not say that all processing stays in the United Kingdom or the EU. Our AI model provider may process data outside the United Kingdom; where it does, the transfer is made under the safeguards UK data protection law requires.

Sub-processors: Cloudflare (hosting, media storage, job queues, logs, and the email we send), PlanetScale (database), Google (sign-in), an AI model provider (which receives post text, comments on your posts, and still frames from video you upload, with audio stripped), and Telegram (only if you link Telegram: the Telegram Bot API carries notification messages and posts to a channel you connect). Each processes data only to provide their service to us. Payments are taken by Onelink (Sold through Link, LLC), which sells Cassit plans to you as merchant of record and handles payment and tax, using Stripe, Inc. as its payment processor. The social platforms you connect are destinations you chose, not sub-processors. For the named list of our sub-processors, write to support@cassit.app.

How we protect your data

In transit. Every connection to Cassit is HTTPS (TLS 1.2 or better). Calls out to platform APIs and in to our database are likewise TLS-only, with full certificate verification.

At rest. The database and media storage are encrypted at rest by the provider. Platform access tokens carry a second, independent layer on top of that: each is encrypted with a dedicated key-encryption key before it is written, decrypted only in memory at the moment a platform call is made on your behalf, and never written to logs, error reports or diagnostics.

Access. Your data is scoped to your workspace, and every read is bounded by it. No request can reach another customer's brands, tokens, content or numbers. Machine access uses per-workspace API keys carrying only the individual permissions you grant, revocable at any time. Diagnostic and bug-report data is filtered against a fixed allowlist before it is stored, so access tokens, post content and media never enter it. Privileged actions are recorded in an audit log you can read.

Retention and deletion. Raw platform payloads are purged after 30 days. Media is erased on the fixed schedule described above. Deletion is full byte erasure, and every erasure is logged. The procedure and its timings are on the data deletion page.

If something goes wrong. If a breach affects your personal data, we will notify you and the UK Information Commissioner's Office as required by law.

Requests from authorities. We disclose customer data to a public authority only when the law requires it. We tell the affected customer first, unless the law forbids it.

Your controls

• Disconnect a channel: Setup → the channel → Disconnect. Cassit asks the platform to revoke its own access and erases the stored token straight away.
• Revoke from the platform's side: for YouTube and any other Google account, Google's third-party connections page; for Facebook and Instagram, Settings → Business Integrations.
• Remove a brand: erases its channels, tokens, content history, publish ledger, insights, and media bytes.
• Delete everything: the procedure and its timings are on the data deletion page.
• Every automated action is bounded by controls you set (whether posts wait for your approval), and everything the system does is auditable in your dashboard.

Contact us

Cassit is operated by Cyguee Limited, registered in England and Wales, company number 17139686.

• Email: support@cassit.app. The fastest route.
• Post: Cyguee Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Cassit is operated by Cyguee Limited, registered in England and Wales (company no. 17139686), 71-75 Shelton Street, London WC2H 9JQ. Questions about this page: support@cassit.app. Effective 2 November 2026.