Privacy Policy

This privacy policy informs you pursuant to Art. 13 GDPR about the nature, scope and purpose of the processing of personal data within our online offering and the websites and functions connected with it.

1. Controller

Daniel David Ovadia
CastLoop
Eugen-Richter-Str. 159
76187 Karlsruhe, Germany
Email: info@castloop.de

2. Definitions

This privacy policy uses the terminology of the General Data Protection Regulation (GDPR). “Personal data” means all information relating to an identified or identifiable natural person.

3. Purposes and legal bases of the processing

We process personal data for the following purposes:

• Provision of the online offering and its functions (Art. 6 (1) lit. b GDPR)
• Fulfillment of contractual obligations (Art. 6 (1) lit. b GDPR)
• Fulfillment of legal obligations, in particular tax and commercial law retention obligations (Art. 6 (1) lit. c GDPR)
• Safeguarding of legitimate interests — in particular security, abuse prevention, analysis and improvement of our offering (Art. 6 (1) lit. f GDPR)
• Consents, insofar as these have been granted (Art. 6 (1) lit. a GDPR)

No solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) takes place. The AI-assisted selection of clip moments assesses your content, not your person.

4. Server log files & hosting

When our website is accessed, access data is automatically stored in server log files (IP address, date and time, page accessed, user agent, referrer). This data serves technical operational security and is deleted or anonymized after 14 days at the latest.

Hosting: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Data processing takes place exclusively on servers in the European Union (Germany). IONOS also provides the SMTP relay for sending transactional emails as well as VM snapshot backups of the production environment. With the provider there is a data processing agreement pursuant to Art. 28 GDPR.

5. Registration & customer account

To use CastLoop you can create an account. Mandatory details are email address and password; optional are company/channel name, first and last name. The password is never stored in plain text, but stored as a hash using the modern Argon2id method (OWASP 2024 parameters).

Legal basis: Art. 6 (1) lit. b GDPR (performance of the contract). The data is deleted as soon as it is no longer required for the purposes of its collection and no statutory retention obligations conflict.

Providing your email address and a password (or signing in with an email link or via one of the providers named in section 7) and stating whether you act as a business or as a consumer is required to conclude the user agreement; without this information we cannot create an account. For a paid plan we additionally need your billing address (see section 10). There is no statutory obligation to provide the data.

If you open CastLoop via an advertising link that contains a campaign identifier (utm parameters, e.g. source and campaign), we store this identifier with your account when you register. This tells us which advertising leads to registrations. No cookies are set and no data is transmitted to advertising networks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is measuring the success of our advertising. You can object to this (see section 16). On the sign-in and registration pages of app.castloop.de we also record pseudonymous usage events (for example page view, start and submission of the form, click on a sign-in provider and error codes) to see where visitors abandon registration; for this we store a hash of the IP address and browser class, but neither the IP address itself nor e-mail addresses or form contents, we set no cookies, and we delete these events after 90 days (legal basis likewise Art. 6 (1) (f) GDPR, objection see section 16).

Sign-in with an email link. Instead of using a password, you can sign in or register with a link that we send to your email address. For this we process your email address, the selected language and – when you register – your details on your role (business or consumer), on your consent to product news, and the campaign identifier of the advertising link. We do not store the link itself; our server only holds an irreversible hash value together with these details for at most 15 minutes, after which it is deleted. An additional marker without content remains for up to 24 hours so that we can recognise an expired link as such. Each link can only be used once. If you request the link on the registration page, we record the time, the version of the terms and conditions and privacy policy, and a hash value of your IP address as proof of your declaration. If you request the link on the sign-in page for an address that does not have an account yet, opening the link does not create an account. Only when you choose your role on the following page and click “Create account” do we create the account and record these details at the time of that click. When you open the link, your email address is considered confirmed. The sign-in link does not, however, confirm your consent to product news. If you have chosen product news, we send you a separate email with a confirmation link after your account has been created. Your consent only becomes effective when you click that link (double opt-in, see section 11). The legal basis is Art. 6 (1) (b) GDPR.

6. Processed content

CastLoop processes content that you actively provide — in particular URLs of YouTube videos or podcast episodes, recordings from connected Twitch or Kick channels and files you upload, as well as the transcripts, clip files, title and caption suggestions generated from them. This content is used exclusively to provide the ordered service and deleted after the contractually agreed retention periods expire (usually 7 days for raw downloads, up to 90 days for generated clips in the context of the recycling feature). The clip files are stored exclusively on EU servers of IONOS SE; a transfer to cloud storage providers outside the EU does not take place.

7. Social login / SSO

To simplify sign-in, we offer single sign-on (SSO) via various identity providers. If you use this option, you are redirected to the respective provider; after successful authentication, we receive a signed ID token (JWT), from which we read exclusively a stable user identifier (sub) and your email address. We receive no password and no unlimited access to your account there. When you sign in with Facebook or Instagram, we receive an authorisation code instead of an ID token; the details are set out in sections 7.4 and 7.5.

7.1 Google Ireland Ltd. — Google Sign-In

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Authentication via Google account (“Sign in with Google”). Processed are sub (stable Google user ID), email address, email confirmation status, optionally name and profile picture URL. Details: policies.google.com/privacy.

7.2 Microsoft Ireland Operations Limited — Sign in with Microsoft

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Authentication via Microsoft account (personal or work/school). Processed are sub (stable Microsoft user ID, not oid), email address and optionally display name. Details: privacy.microsoft.com.

7.3 Apple Distribution International Ltd. — Sign in with Apple

Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Authentication via Apple ID. Processed are sub (stable Apple user ID) and email address.

Note on private relay addresses: Apple offers the “Hide My Email” option. In this case, we receive exclusively an anonymized forwarding address of the form <randomtoken>@privaterelay.appleid.com. We cannot see your real email address in this case; Apple forwards emails transparently to the address you have stored. Details: apple.com/legal/privacy.

7.4 Meta Platforms Ireland Ltd. — Sign-in with Facebook

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. You can sign in or sign up with your Facebook account (“Continue with Facebook”). The sole purpose is signing in to CastLoop and creating or recognising your customer account. We only request the standard permissions public_profile and email. After you consent in the Facebook dialog, we exchange the authorisation code for an access token on our server and use it once to retrieve your app-scoped Facebook user ID (id), your name (name) and your email address (email). We do not store the access token; it is discarded after this request. We store the user ID, so that we can recognise you when you sign in again, the email address as the address of your customer account, and the first and last name from your Facebook name as the name in your customer account. We also use the name to create the default name of your workspace, which you can change at any time. For a new account we send you a link to confirm the email address. If Facebook does not provide an email address, we do not create an account. Connecting Facebook Pages and Instagram accounts for publishing is separate and only happens if you expressly choose it in a separate dialog (sections 8.2 and 8.6). If you request the deletion of your CastLoop data in your Facebook settings, we delete the link to your Facebook account. The legal basis is Art. 6 (1) lit. b GDPR. Meta Platforms Ireland Ltd. may pass data to Meta Platforms, Inc. (USA) (see section 14). Details: facebook.com/privacy/policy.

7.5 Meta Platforms Ireland Ltd. — Sign-in with Instagram

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. You can sign in or register with your Instagram professional account (business or creator account) (“Continue with Instagram”, Instagram API with Instagram Login). After you agree in the Instagram dialog, we exchange the authorisation code on our server for an access token and that token for a long-lived access token. With it we retrieve your app-scoped Instagram user identifier, the identifier of your Instagram account, your username, the display name, the account type and the address of the profile picture. Instagram does not send us an email address. If we do not yet know your Instagram account, we do not create a customer account at first. We keep the retrieved data for at most 15 minutes in a single-use sign-in process, the access token only in encrypted form. The customer account is only created once you enter your email address, choose your role and tap “Let's go” in the “Complete your account” step. We send a link to the address you entered so that you can confirm it. We store the Instagram user identifier to recognise you at later sign-ins, the email address you entered as the address of your customer account and the username as the default name of your workspace, which you can change at any time. With the long-lived access token we connect your Instagram account as a publishing target in the same step. We store the token in encrypted form as described in section 8.2, together with the identifier, username, display name and profile picture of the account; you can disconnect it at any time. If you remove CastLoop in your Instagram settings or request the deletion of your data there, we delete the link to your Instagram account. Your customer account remains, and you then sign in with an email link. The “Complete your account” step also applies to sign-in with Facebook (section 7.4), there without entering an email address. The legal basis is Art. 6 (1) lit. b GDPR. Meta Platforms Ireland Ltd. may pass data to Meta Platforms, Inc. (USA) (see section 14). Details: privacycenter.instagram.com/policy.

Legal basis for SSO: Art. 6 (1) lit. b GDPR (performance of the contract / pre-contractual measures).

8. Multi-platform posting (OAuth tokens & publications)

The core service of CastLoop is the automated publication of the generated clips on social media platforms connected by you. To do this, you provide us with OAuth access tokens of the respective platform. Your platform passwords are at no time viewed or stored by us.

Encryption of the tokens: OAuth access and refresh tokens are stored in our database exclusively encrypted with AES-256-GCM (“envelope encryption”), bound to a row-specific additional-authenticated-data context (tenant ID, social account ID, platform). A leak of the database without access to the separately stored key material thus remains useless.

8.1 Google Ireland Ltd. — YouTube / YouTube Shorts

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. CastLoop uses the YouTube Data API v3 exclusively on the YouTube channel connected by you via the following OAuth scopes:

• https://www.googleapis.com/auth/youtube.readonly — reading your own channel and video metadata (channel ID, title, thumbnail, video list with title, description, length, publication date). Used to enable you in the dashboard to select from which long-form videos CastLoop should extract short clips. Only the endpoints channels.list, playlistItems.list and videos.list are called; via videos.list or videos.batchGetStats we also retrieve the view, like and comment counts of the Shorts uploaded through CastLoop in order to show them to you in the dashboard.
• https://www.googleapis.com/auth/youtube.upload — uploading the short clips you have approved (up to 3 minutes, vertical format) as YouTube Shorts to your own channel. Only the endpoint videos.insert is called. No automatic upload takes place without your prior approval and scheduling.

When you connect a channel, we additionally request the standard permissions openid, email and profile. They serve exclusively to assign the connected YouTube channel to the correct Google account; they are not used to sign in to CastLoop.

At the time of upload, the clip file (MP4), the title you have assigned, the description, tags and the publication time are transmitted. The long-form original videos do not leave our servers at any time.

Limited Use — use assurance pursuant to the Google API Services User Data Policy (incl. Limited Use Requirements):

• We use the data received via the YouTube API exclusively to provide you with the function shown in the dashboard (clip selection, short upload).
• We do not sell data received via the YouTube API to third parties.
• We do not use data received via the YouTube API to display advertising or to personalize advertising.
• We do not train AI/ML models with the content received via the YouTube API.
• Human access (employees / contractors) to the data takes place exclusively (a) with your express consent, (b) for security purposes (e.g. investigation of an abuse or security incident), (c) to fulfill legal obligations or (d) if the data is anonymized/aggregated for internal operations.

You can deauthorize the YouTube channel at any time via Dashboard → Channels → Disconnect or revoke the connection directly in the Google account under “Third-party apps with account access”. After disconnection, the associated OAuth tokens are deleted immediately; YouTube Shorts already uploaded remain on your channel and can be managed by you as usual.

Data retention: Video metadata received via the YouTube API (e.g. title, thumbnail) is stored for at most 30 days; after that it is automatically either refreshed against the current state on YouTube or deleted. If a source video is deleted on YouTube, we remove the associated metadata at the next reconciliation. If you disconnect the channel in the dashboard, this data is deleted within 7 days; if you revoke authorization via your Google account settings, within 30 days.

General privacy information from Google: policies.google.com/privacy.

By using CastLoop's YouTube features you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms).

8.2 Meta Platforms Ireland Ltd. — Instagram

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Publication of Reels and Stories via the Instagram Graph API. Details: facebook.com/privacy/policy.

Alternatively, you can connect Instagram without a Facebook Page by signing in directly with your Instagram professional account (Instagram API with Instagram Login). The recipient is then also Meta Platforms Ireland Ltd. In both cases the clip and the post text are transmitted; we store the OAuth token (encrypted, see section 8 above) as well as the ID and username of the Instagram account. In addition, we retrieve metrics of the published posts (e.g. views, likes, comments) in order to show them to you in the dashboard.

8.3 TikTok Technology Ltd. — TikTok

TikTok Technology Limited (ByteDance group), 10 Earlsfort Terrace, Dublin 2, Ireland. Publication via the TikTok Content Posting API. Details: tiktok.com/legal/privacy-policy.

8.4 LinkedIn Ireland Unlimited Company — LinkedIn

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Publication of video posts via the LinkedIn Marketing Developer Platform. Details: linkedin.com/legal/privacy-policy.

8.5 X Corp. — X (formerly Twitter)

X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Publication via the X API v2. X Corp. is based in the USA; data transfers to the USA are unavoidable for the use of the X platform. The safeguarding takes place on the basis of the EU standard contractual clauses (SCC 2021/914). Details: x.com/privacy.

8.6 Meta Platforms Ireland Ltd. — Facebook

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Publication of Facebook page video posts via the Facebook Graph API. Privacy information: facebook.com/privacy/policy.

8.7 Meta Platforms Ireland Ltd. — Threads

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Publication of Threads posts via the Threads Graph API. Since Threads is a Meta product, the same privacy policy applies as for Instagram: facebook.com/privacy/policy.

8.8 Bluesky Social, PBC — Bluesky

Bluesky Social, PBC, Seattle, Washington, USA. Publication of video posts via the AT Protocol (OAuth). Bluesky is based in the USA; transfers are safeguarded on the basis of the EU Standard Contractual Clauses (SCC 2021/914). Details: bsky.social/about/support/privacy-policy.

8.9 Mastodon — operator of the chosen instance

Mastodon is a decentralised network. The recipient of the data is the operator of the instance the user selects when connecting (for mastodon.social: Mastodon gGmbH, Germany). Publication happens via the Mastodon API with an OAuth authorisation of the respective instance; its registered office and privacy notices follow from the chosen instance.

8.10 Tumblr, Inc. — Tumblr

Tumblr, Inc. (Automattic group), 60 29th Street #343, San Francisco, CA 94110, USA. Publication via the Tumblr API. Tumblr is based in the USA; transfers are safeguarded on the basis of the EU Standard Contractual Clauses (SCC 2021/914). Details: tumblr.com/privacy/en_eu.

8.11 Telegram FZ-LLC — Telegram

Telegram FZ-LLC, Dubai, United Arab Emirates (EU data protection representative: Telegram UK Holdings Ltd, London). Publication happens via the Telegram Bot API into the channel the user connected; the clip, the accompanying text and the channel id are transmitted. Telegram processes data outside the EU; transfers are safeguarded on the basis of the EU Standard Contractual Clauses (SCC 2021/914). Details: telegram.org/privacy.

8.12 Twitch Interactive, Inc. — Twitch (source)

Twitch Interactive, Inc. (an Amazon company), 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA. CastLoop uses the Twitch API on a read-only basis to fetch the video-on-demand recordings (VODs) from the Twitch channel you connected, as source material for clip creation. The OAuth authorisation grants us read-only access to the channel's identity only; no write access to your Twitch account occurs. The recordings themselves are loaded via Twitch's public infrastructure. The following data is transmitted and/or stored: the OAuth token (encrypted, see section 8 above), the channel id and name, and metadata of the recordings (title, length, publish date). Twitch Interactive, Inc. is based in the USA; processing also takes place there. Transfers are safeguarded on the basis of the EU Standard Contractual Clauses (SCC 2021/914). Details: twitch.tv/p/en-gb/legal/privacy-notice.

8.13 Vimeo.com, Inc. — Vimeo (target)

Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA. CastLoop uploads the clips you approve to the Vimeo account you connected via the Vimeo API. The OAuth authorisation covers the scopes public, private, upload and edit. At upload time, the video file, the title and description you provide, and your Vimeo user id/profile link are transmitted; we additionally retrieve the views, likes and comments of published videos to display them to you as performance metrics in the dashboard. Vimeo.com, Inc. is based in the USA; processing also takes place there. Transfers are safeguarded on the basis of the EU Standard Contractual Clauses (SCC 2021/914). Details: vimeo.com/privacy.

8.14 Kick Streaming Pty Ltd — Kick (source)

Kick Streaming Pty Ltd, 2/287 Collins Street, Melbourne VIC 3000, Australia. CastLoop uses the Kick API on a read-only basis (scopes user:read and channel:read) to verify the identity of your Kick channel when you connect it. The access token granted for this is revoked at Kick immediately after that check and is not stored; no write access to your Kick account occurs. The recordings of your finished streams (VODs) are then loaded via Kick's public infrastructure; only recordings of the channel you connected are processed. Stored data: the channel id and name (slug) and metadata of the recordings (title, length, publish date). Kick Streaming Pty Ltd is based in Australia; according to its own policy, Kick also processes data in the USA. Transfers are safeguarded on the basis of the EU Standard Contractual Clauses (SCC 2021/914). Details: kick.com/privacy-policy.

Legal basis for posting: Art. 6 (1) lit. b GDPR (performance of the contract). The respective platform is an independent controller under data protection law for the processing on its systems.

8.15 Pinterest Europe Ltd. — Pinterest (target)

Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. If you connect a Pinterest account, CastLoop publishes the clips you have approved as video Pins via the Pinterest API on a board of your choice. The OAuth authorisation covers the permissions pins:read, pins:write, boards:read, boards:write and user_accounts:read. We transmit the video file, title, description and the chosen board; we store the OAuth token (encrypted, see section 8 above) as well as the ID and name of your Pinterest account. Pinterest Europe Ltd. may pass data on to Pinterest, Inc. (USA); this transfer is safeguarded on the basis of the EU Standard Contractual Clauses (SCC 2021/914). The legal basis is Art. 6 (1) (b) GDPR. Details: policy.pinterest.com/privacy-policy.

8.16 Podcast RSS feeds — Podcast (source)

If you connect a podcast via the address of its RSS feed, our server retrieves the public feed and the audio or video files linked in it from the respective podcast host; the host receives the IP address of our server, not yours. No access token is involved. To ensure that only your own shows are processed, we compare the owner email address stated in the feed with the email address of your account or check a verification code that you enter in the description of the show. We store the feed address, the title of the show and metadata of the episodes (title, length, publication date). The legal basis is Art. 6 (1) (b) GDPR.

9. AI-assisted processing (transcription & clip analysis)

For the automatic creation of transcripts, the detection of exciting moments and the generation of hook/title variants, we use AI-based methods. Audio/text transcripts as well as relevant metadata of the respective video are transmitted. The processing takes place within the EU or – where processors in a third country are involved – on the basis of EU standard contractual clauses (Art. 46 GDPR). The content is processed exclusively to provide the function and not used to train AI models.

Legal basis: Art. 6 (1) lit. b GDPR (performance of the contract).

10. Payment processing

The payment processing is carried out via Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands). The data required for payment processing (amount, payment method, email, billing address) is transmitted to Mollie. Mollie is itself a controller within the meaning of the GDPR for the processing of the payment data. Further information can be found in the Mollie privacy policy.

Legal basis: Art. 6 (1) lit. b GDPR (performance of the contract), Art. 6 (1) lit. c GDPR (statutory retention obligations under § 257 HGB, § 147 AO).

We create invoices ourselves on our servers; for this we process your name or company, billing address, your VAT ID where applicable, and the data of the respective payment. If you provide a VAT ID, we verify its validity via the VAT Information Exchange System (VIES) of the European Commission; only the country code and the VAT ID are transmitted. The legal basis is Art. 6 (1) (b) and (c) GDPR (performance of the contract, VAT obligations).

11. Email dispatch

For sending transactional emails (registration confirmation, password reset, invoices, notifications about clips) we use the SMTP relay of IONOS SE (see section 4). A separate dispatch service provider outside the EU is not used. The dispatch takes place exclusively over TLS-encrypted connections (TLS 1.2 or higher).

If you consented at registration to receive product news by email (new features, tips for getting started and reminders, for example if you have not added a video a few days after registering), the consent only becomes effective when you click the confirmation link (double opt-in); we store the time as proof. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future, for example via the unsubscribe link in every email or in the settings.

12. Cookies & comparable technologies

Our marketing website castloop.de sets no cookies and embeds no analytics or advertising services; it only stores your language choice and, where applicable, your cookie settings in your browser's local storage. The application app.castloop.de uses exclusively technically necessary cookies and local storage entries (in particular an HttpOnly cookie for the refresh token, a short-lived cookie securing sign-ins and account connections, and your language and display choice). No consent is required for this pursuant to § 25 (2) no. 2 TDDDG. Further details can be found in our cookie policy.

13. Recipients of the data / processors

The following service providers process personal data on behalf or as independent controllers (in the case of social media platforms and Mollie):

• IONOS SE (Montabaur, DE) — hosting infrastructure, SMTP relay, VM snapshot backups
• Mollie B.V. (Amsterdam, NL) — payment processing & invoice handling
• Google Ireland Ltd. (Dublin, IE) — YouTube Data API, Google Sign-In
• Microsoft Ireland Operations Ltd. (Dublin, IE) — authentication via Microsoft account
• Apple Distribution International Ltd. (Cork, IE) — authentication via Apple ID
• Meta Platforms Ireland Ltd. (Dublin, IE) — sign-in with Facebook and Instagram (Facebook Login, Instagram Login), Instagram, Facebook and Threads publications
• TikTok Technology Ltd. (Dublin, IE) — TikTok publications
• LinkedIn Ireland Unlimited Company (Dublin, IE) — LinkedIn publications
• X Corp. (San Francisco, USA) — X/Twitter publications (data processing also in the USA, secured by SCC 2021/914)
• Bluesky Social, PBC (Seattle, USA) — Bluesky publications (data processing also in the USA)
• Operator of the Mastodon instance chosen by the user (decentralised; for mastodon.social: Mastodon gGmbH, DE) — Mastodon publications
• Tumblr, Inc. (Automattic group, San Francisco, USA) — Tumblr publications (data processing also in the USA)
• Telegram FZ-LLC (Dubai, UAE) — Telegram publications (data processing also outside the EU)
• Twitch Interactive, Inc. (San Francisco, USA) — read access to your Twitch channel as a source (data processing also in the USA, secured by SCC 2021/914)
• Kick Streaming Pty Ltd (Melbourne, Australia) — read access to your Kick channel as a source (data processing in Australia and the USA, secured by SCC 2021/914)
• Vimeo.com, Inc. (New York, USA) — Vimeo publications (data processing also in the USA, secured by SCC 2021/914)
• Pinterest Europe Ltd. (Dublin, IE) — Pinterest publications, if you connect a Pinterest account
• European Commission (Brussels, BE) — verification of the VAT ID via the VAT Information Exchange System (VIES), only if you provide a VAT ID

We conclude a data processing agreement (DPA) pursuant to Art. 28 GDPR with all processors; corporate customers can, for their part, conclude a DPA with us (see DPA template).

14. Third-country transfers

Wherever possible, we process personal data within the European Union or the European Economic Area. In the following cases, a transfer to third countries (in particular to the USA) is unavoidable:

• X Corp. (USA) — when publishing clips on X
• Meta Platforms, Inc. (USA) — when signing in with Facebook and when publishing on Instagram, Facebook or Threads, insofar as Meta Ireland passes data to its US parent company
• TikTok Inc. / ByteDance Ltd. (USA / Singapore) — for TikTok publications, insofar as data is passed to group companies
• Apple Inc. (USA) — for Sign in with Apple, insofar as Apple Distribution International Ltd. passes data to its US parent company
• Google LLC (USA) — insofar as Google Ireland Ltd. passes data to its US parent company
• Microsoft Corporation (USA) — insofar as Microsoft Ireland Operations Ltd. passes data to its US parent company
• Bluesky Social, PBC (USA) — when publishing clips on Bluesky
• Tumblr, Inc. / Automattic Inc. (USA) — for Tumblr publications
• Telegram FZ-LLC (Dubai, UAE) — for Telegram publications
• Twitch Interactive, Inc. (USA) — for read access to the connected Twitch channel as a source
• Kick Streaming Pty Ltd (Australia) — for read access to the connected Kick channel as a source
• Vimeo.com, Inc. (USA) — for Vimeo publications
• Operator of the chosen Mastodon instance — only if the user connects an instance operated outside the EU
• Pinterest, Inc. (USA) — for Pinterest publications, insofar as Pinterest Europe Ltd. passes data on to its US parent company

For these third-country transfers, the safeguarding takes place on the basis of the EU standard contractual clauses (SCC) pursuant to Commission Implementing Decision (EU) 2021/914 of the European Commission. Google, Microsoft, Meta and Apple are additionally certified under the EU-US Data Privacy Framework (DPF) and offer corresponding transfer commitments. If required, we provide you with copies of the concluded SCC upon request.

Legal basis: Art. 46 (2) lit. c GDPR.

15. Storage period

We process and store personal data only for as long as this is required to achieve the processing purpose or statutory retention obligations (in particular § 257 HGB: 10 years for accounting records / invoices, § 147 AO: 6 or 10 years for tax-relevant documents) exist.

In particular: server log files are deleted or anonymised after 14 days at the latest (section 4). After an account deletion the account is blocked immediately; the data is deleted from the production database after 30 days at the latest. Deleted data may still be contained in our encrypted backups (daily backups are kept for 14 days, weekly ones for 8 weeks and monthly ones for 12 months) until the respective backup is deleted in rotation, at the latest 13 months after deletion from the production database. Backups are only used to restore operations after an outage. Details can be found on the data deletion page.

Cancellation notices received via the cancellation button (section 19) are kept as received commercial letters for six years (Section 257 (1) no. 2, (4) and (5) HGB; Section 147 (1) no. 2, (3) and (4) AO). The period begins at the end of the calendar year in which the cancelled contract ends; if we cannot match a notice to a contract, at the end of the calendar year in which it was received. After that we delete the notice automatically. We delete the hash of the IP address after only 30 days.

16. Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Withdrawal of consents granted with effect for the future (Art. 7 (3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Self-service in the dashboard: You can manage your data yourself at any time via the dashboard:

• Data export (Art. 15 GDPR) — under Settings → Export data you can download a machine-readable copy of your personal data (JSON).
• Account deletion (Art. 17 GDPR) — under Settings → Delete account you can permanently remove your account. The account is blocked immediately and deleted from the production database after 30 days at the latest; the data disappears from the backups when they are deleted in rotation (see section 15).

Alternatively, an informal message to info@castloop.de suffices.

Right to object under Art. 21 GDPR. Insofar as we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR, for example for security and abuse prevention, for measuring the success of our advertising or on the public checking page), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal objection to info@castloop.de is sufficient.

17. Competent supervisory authority

The data protection supervisory authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de. A complete list of the state data protection commissioners can be found at the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

18. Public checking page for the AI marking

On the page castloop.de/ki-pruefung you can upload a video file without an account and without signing in to have it checked for a signed marking for AI-generated content (C2PA) applied by CastLoop. The check is open to everyone because Art. 50(2) of Regulation (EU) 2024/1689 requires that the marking can be verified.

The uploaded file (at most 50 MB) is processed exclusively for this check. It is placed under a randomly assigned name temporarily in the working memory and in a temporary directory of our server, read for the marking and deleted immediately after the check, even if the check fails. The original file name is not kept. The file is not stored permanently, its content is not analysed, it is not passed on to third parties and it is not used to train AI models.

You receive the result in your browser. The application log of our interface keeps only the result in summarised form (marking found, not found or not verifiable) for a check, together with the method, path, response status and duration of the request, but no file content, no file name and no IP address. As with every access to our servers, your IP address is recorded in the server log files (see section 4). To prevent abuse we also count the number of checks per IP address (per network prefix for IPv6) in a temporary store; this counter expires automatically once no further check has been made for 15 minutes.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to make the legally required verifiability of the marking available to everyone and to protect the checking page against abuse and overload. If you use the check as a customer within the scope of your contract with us, the legal basis is Art. 6(1)(b) GDPR. Uploading the file is voluntary; without it the check cannot be carried out. You have the right to object to the processing under Art. 21 GDPR (see section 16).

19. Cancellation via the cancellation button

Using the “Cancel contracts here” button on the page castloop.de/kuendigen, you can cancel your contract without signing in (Section 312k of the German Civil Code, BGB). We process the details from the form: your name, the email address of your CastLoop account, the type of cancellation and, for a cancellation for cause, the reason, the contract or plan, the requested date and, if provided, your workspace or customer reference. In addition, we process the date and time of receipt and the language of the page.

We process this data to match the cancellation to your contract, carry it out and confirm its receipt to you by email straight away. To do so, we compare the email address with our customer accounts. If your subscription runs via Mollie, we notify Mollie that it has ended (see section 10); we send the confirmation as described in section 11. If the cancellation cannot be matched automatically, we review it by hand. To protect against misuse, the confirmation contains a link with which the account holder releases the cancellation; only then, or after we have verified your identity, do we end the subscription. The date on which the cancellation takes effect does not change.

The legal basis is Art. 6 (1) (b) GDPR (performance and termination of the contract) and Art. 6 (1) (c) GDPR in conjunction with Section 312k BGB (statutory obligation to provide the cancellation button and to confirm receipt).

To prevent abuse, we store for each notice a hash of your IP address formed with a secret value, not the IP address itself, and delete it after 30 days. We also count submissions per IP address in a cache that expires after one hour. The legal basis for this is Art. 6 (1) (f) GDPR; our legitimate interest is protecting the page and other people’s mailboxes from mass submissions.

We keep the notice as a received commercial letter for six years, counted from the end of the calendar year in which the cancelled contract ends (Section 257 (1) no. 2, (4) and (5) HGB; Section 147 (1) no. 2, (3) and (4) AO; see section 15). If we cannot match it to a contract, the period begins at the end of the calendar year in which it was received. After that we delete it automatically. The legal basis for keeping it is Art. 6 (1) (c) GDPR. Providing the details is voluntary; without a name and email address, however, we cannot match or confirm the cancellation. You can also cancel informally by email to info@castloop.de.

20. Currency

This privacy policy is continuously adapted to legal and technical developments.

As of: 27 October 2026 · Version 2.2 (content of product news clarified in section 11)