Privacy Policy
Effective and last updated: September 23, 2026
The short version. We collect what we need to run Casturi, we don't sell or share your personal information for advertising, and we don't use advertising or analytics cookies. Casturi API requests are never used for training and their content isn't stored. During the invited beta, Casturi Chat conversations may be used to improve our models, and you can opt out at any time by emailing privacy@casturiai.com.
1. Who we are
This Privacy Policy explains how Casturi AI ("Casturi AI," "we," "us" or "our") collects, uses, shares and protects personal information when you use our website, Casturi Chat, Casturi Code and the Casturi API (together, the "Services").
Casturi AI decides why and how your personal information is processed. Under the laws that use these terms, that makes us the controller (EU and UK GDPR), the data fiduciary (India's Digital Personal Data Protection Act, 2023) and the business (US state privacy laws). If you use the Casturi API to process other people's data inside your own product, you are responsible for that data and we process it on your instructions.
Contact for anything in this policy: privacy@casturiai.com.
2. Information we collect
Information you give us
- Account details: name, email address and password. Passwords are stored only as a salted hash. If you sign in with Google, we receive your Google account ID, name, email address and profile picture.
- Access requests: the email, name or company, interest and reason you enter in the request-access form, and the invite code you use to sign up.
- Content: the messages, prompts and files you send in Casturi Chat and the responses Casturi generates; the instructions, files and settings of agents you build; memories you ask Casturi to keep; and the prompts and project context you send through Casturi Code or the Casturi API.
- Communications: messages you send to our support, privacy or legal addresses.
Information collected automatically
- Usage and log data: IP address, browser and device type, pages and features used, timestamps, error reports, and message and token counts used to apply plan limits.
- Approximate location: the country or region we can infer from your IP address. We don't collect precise location.
- Cookies and local storage: only the ones needed to sign you in, keep the Services secure and remember your choices. See our Cookie Policy.
We don't ask for sensitive information such as health, financial account, biometric, religious or political data. Please don't include it in your content unless you need to, and only when you have the right to share it.
3. How we use it and why
The last column gives the legal basis under EU and UK law. In India we rely on your consent or on the legitimate uses the DPDP Act allows. In other places we rely on the notices in this policy.
| Purpose | Information used | Legal basis (EU/UK) |
|---|---|---|
| Create and secure your account, sign you in, apply invites and plan limits | Account details, access requests, usage data | Performing our contract with you |
| Provide the Services: run conversations, agents, web search, code tools and the API, and keep your chat history | Content, usage data | Performing our contract with you |
| Improve Casturi models during the invited beta (see section 4) | Casturi Chat conversations | Legitimate interests, with a right to object at any time |
| Keep the Services safe: prevent abuse, fraud and attacks, and debug errors | Usage and log data, content where needed to investigate | Legitimate interests |
| Answer your requests and send service messages, such as your invite | Contact details, communications | Performing our contract, or taking steps at your request |
| Meet legal obligations and enforce our terms | Any of the above, as required | Legal obligation, or legitimate interests |
We don't use your information for targeted advertising, and we don't send marketing email without your permission.
4. Model training during the beta
During the invited beta, Casturi Chat conversations may be reviewed and used to train, evaluate and improve Casturi models, including the supervised training cycle described on our homepage.
- Casturi API: never used for training, and request content isn't stored once the response is delivered.
- Casturi Code: sends your requests to Casturi models through the Casturi API, so the Casturi API rules apply.
- Opting out: email privacy@casturiai.com from your account's email address. We'll stop using your future Casturi Chat conversations for training. In India this withdraws the consent you gave when you signed up; elsewhere it's your right to object. Opting out doesn't change how the Services work for you.
5. AI output and automated decisions
Casturi generates responses automatically, and they can be inaccurate or incomplete. Check important output before you rely on it. We don't make decisions about you that have legal or similarly significant effects based solely on automated processing. Plan limits and security controls are applied automatically, and you can ask us to review any decision about your account.
6. Who we share it with
We don't sell personal information. We don't share it for cross-context behavioural advertising or targeted advertising. We share it only as follows:
- Service providers that host and run the Services for us under contracts that limit their use of your data: cloud hosting and infrastructure (Google Cloud), and email delivery when we send you messages.
- Google, if you choose to sign in with Google. Google handles that sign-in under its own privacy policy.
- Web search engines, when you use web search. The search terms Casturi creates for your question are sent to public search engines to fetch results. Your conversation itself isn't sent.
- People you choose to share with, for example when you create a shared link to a conversation or share an agent.
- Legal and safety reasons: when the law requires it, or to protect the rights, safety and property of our users, the public or Casturi AI.
- Business transfers: as part of a merger, acquisition or sale of assets, with notice to you and the same protections.
Casturi models run on infrastructure we operate. We don't send your Casturi Chat, Casturi Code or Casturi API content to third-party AI model providers.
7. International transfers
Our servers are in the United States, and our service providers may process data in other countries. When we transfer personal information from the EU, EEA or UK to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum. We don't transfer data from India to any country the Government of India has restricted. For Australian users, the countries your information is likely to be disclosed to are the United States and the countries where our hosting provider operates, and we take reasonable steps so that recipients handle it consistently with the Australian Privacy Principles.
8. How long we keep it
| Information | How long |
|---|---|
| Account details | While your account is open, then deleted or anonymised, except what we must keep by law. |
| Casturi Chat conversations, files, agents and memories | Until you delete them or your account is closed. Temporary chats aren't kept in your history. |
| Casturi API and Casturi Code request content | Not stored after the response is delivered. |
| Usage records: counts, timestamps, errors | As long as needed for limits, billing, security and legal obligations. |
| Access requests | Until you're invited, or up to 12 months if you're not. |
| Backups | Deleted data can remain in backups for a limited period until those backups are removed. |
9. Security
We protect your information with TLS encryption in transit, hashed passwords, encryption of stored credentials, access controls limited to staff who need it, and an audit log of administrative actions. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live, you can ask us to:
- confirm whether we process your personal information and give you a copy;
- correct, complete or update it;
- delete it;
- give it to you, or another service, in a portable format;
- stop or limit certain uses, including model training;
- withdraw consent you've given, as easily as you gave it; and
- review a decision about your account.
How to ask: email privacy@casturiai.com from your account's email address. You can also delete individual conversations yourself at any time. We'll verify your identity before acting, and we won't treat you differently for using your rights. We respond within one month, or sooner where the law requires, and we'll tell you if we need more time and why. If we decline your request, we'll explain why and how to appeal. Reply to our decision within 60 days and a different person will review it.
11. EU, EEA and UK
You have the rights listed in section 10 under the EU General Data Protection Regulation and the UK GDPR, including the right to object to processing based on our legitimate interests. You can also complain to your local data protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to resolve your concern first. Where the law requires us to have a representative in the EU or the UK, we'll list their details here.
12. United States
This section applies to residents of California and other US states with consumer privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas and Oregon.
- Categories we collect: identifiers (name, email, IP address, account ID); internet and network activity (usage and log data); approximate geolocation; the content of your communications with the Services; and account login credentials. We use login credentials only to provide and secure your account, not to infer characteristics about you. Sources, purposes and retention are described above.
- Disclosures: in the past 12 months we disclosed these categories only to the service providers and recipients listed in section 6, for business purposes.
- No sale, no sharing: we don't sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising, and we haven't done so in the past 12 months. We have no actual knowledge of selling or sharing the data of anyone under 16.
- Your rights: to know, access, correct and delete your personal information; to opt out of sale, sharing, targeted advertising and profiling; and not to be discriminated against for using these rights. You can use an authorised agent, and we'll ask for proof of their authority. If we deny your request, you can appeal as described in section 10, and if we deny the appeal you can contact your state Attorney General.
- Global Privacy Control: we honour the GPC signal as an opt-out of sale and sharing for your browser. You can also manage choices any time with .
13. India
Under the Digital Personal Data Protection Act, 2023 and its rules, you (the Data Principal) can ask for a summary of your personal data and how we process it, correction, completion, updating and erasure of your data, and grievance redressal. You can also nominate someone to act for you if you die or become unable to act. Where we rely on your consent, you can withdraw it at any time as easily as you gave it. Withdrawal doesn't affect processing that happened before it.
Grievance contact: Grievance Officer, Casturi AI, privacy@casturiai.com. We'll respond within the time the rules require, and in any case within 90 days. If you're not satisfied with our response, you can complain to the Data Protection Board of India.
14. Australia
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can ask to access or correct the personal information we hold about you. Because Casturi requires an account, we can't offer the Services anonymously or under a pseudonym. To make a privacy complaint, email privacy@casturiai.com. We'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
15. Children
The Services are for people aged 18 or over, and we don't knowingly collect personal information from anyone under 18. If you think a child has given us information, email privacy@casturiai.com and we'll delete it.
16. Cookies
We use only the cookies and local storage needed to sign you in, keep the Services secure and remember your choices. We don't use advertising or analytics cookies. If that changes, they'll stay off until you agree. Read the Cookie Policy or open .
17. Changes to this policy
We'll post any update here with a new date. If a change is significant, for example a new use of your data, we'll tell you in the Services or by email before it takes effect, and ask for your consent where the law requires it.
18. Contact us
Casturi AI. Privacy questions, requests and grievances: privacy@casturiai.com. Everything else: support@casturiai.com.