Privacy Policy

Cassit is a social-media operations service: it drafts, schedules, publishes, and measures posts for social accounts that you connect and own. This page describes what data that involves — all of it, and nothing else.

What we store

• Your account: the name and email address from your Google sign-in, used only to operate your workspace.
• Platform access tokens for the accounts you connect (Facebook Pages, Instagram, YouTube, TikTok). Tokens are encrypted at rest with a dedicated key-encryption key and are decrypted only at the moment a platform call is made on your behalf. They are never logged and never shared.
• Content and metrics: the posts Cassit drafts or publishes for you, and the per-post performance numbers (views, likes, comments, reach) the platforms report back.
• Media you supply for posting, held only through the publish-and-verify window and then erased on a fixed retention schedule (14 days after a verified publish by default; unapproved uploads are erased after 30 days). Deletions are full byte erasure, and every erasure is logged.

What we do with it

One thing: run the social accounts you connected, under your control. Draft text may be generated with the Google Gemini API; audio is stripped from any video before an AI model sees it, and media of minors is never processed or published without an explicit human approval for that specific post. We do not sell, rent, or share your data with anyone for advertising or any other purpose. There is no analytics use beyond showing you your own numbers.

YouTube and Google user data

Cassit uses YouTube API Services. When you connect a YouTube channel, Cassit uploads the videos you schedule to that channel and reads back their statistics, acting only on your behalf. By using Cassit you are agreeing to be bound by the YouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy.

Cassit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data — your channel identity, the upload capability, and the view, like and comment counts on videos Cassit published for you — is used solely to publish and measure the videos you schedule, and to show you which of your own posts performed well. It is never transferred to third parties and never used for advertising.

You can withdraw that access at any time, from either side: disconnect the channel inside Cassit (Setup → the channel → Disconnect), or revoke it directly on Google's third-party connections page. Either one stops all further access immediately. What happens to data already stored is set out under data deletion.

Cookies and what is stored on your device

Cassit sets first-party session cookies when you sign in. They keep you signed in for the length of your session and do nothing else. Cassit sets no advertising cookies, uses no third-party analytics, and does not allow any third party to place, access, or recognise cookies or similar technology on your browser through our pages. Media you post is read from your device only at the moment you choose a file to upload.

Where it lives

Data is stored in the United Kingdom/EU (managed Postgres in London; media on Cloudflare R2). Sub-processors: Cloudflare (hosting, storage), PlanetScale (database), Google (Gemini API for text drafting). Each processes data only to provide their service to us.

How we protect your data

In transit. Every connection to Cassit is HTTPS (TLS 1.2 or better). Calls out to platform APIs and in to our database are likewise TLS-only, with full certificate verification.

At rest. The database and media storage are encrypted at rest by the provider. Platform access tokens carry a second, independent layer on top of that: each is encrypted with a dedicated key-encryption key before it is written, decrypted only in memory at the moment a platform call is made on your behalf, and never written to logs, error reports or diagnostics.

Access. Your data is scoped to your workspace, and every read is bounded by it — no request can reach another customer's brands, tokens, content or numbers. Machine access uses per-workspace API keys carrying only the individual permissions you grant, revocable at any time. Diagnostic and bug-report data is filtered against a fixed allowlist before it is stored, so access tokens, post content and media never enter it. Privileged actions are recorded in an audit log you can read.

Retention and deletion. Raw platform payloads are purged after 30 days. Media is erased on the fixed schedule described above. Deletion is full byte erasure, and every erasure is logged — the procedure and its timings are on the data deletion page.

If something goes wrong. If a breach affects your personal data, we will notify you and the UK Information Commissioner's Office as required by law.

Your controls

• Disconnect a channel — Setup → the channel → Disconnect. Cassit asks the platform to revoke its own access and erases the stored token straight away.
• Revoke from the platform's side — for YouTube and any other Google account, Google's third-party connections page; for Facebook and Instagram, Settings → Business Integrations.
• Remove a brand — erases its channels, tokens, content history, publish ledger, insights, and media bytes.
• Delete everything — the procedure and its timings are on the data deletion page.
• Every automated action is bounded by controls you set (approval requirements, spend ceilings), and everything the system does is auditable in your dashboard.

Contact us

Cassit is operated by Cyguee Limited, registered in England and Wales, company number 17139686.

• Email: support@cassit.app — the fastest route, answered by a person within two working days.
• Post: Cyguee Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Cassit is operated by Cyguee Limited, registered in England and Wales (company no. 17139686), 71-75 Shelton Street, London WC2H 9JQ. Questions about this page: support@cassit.app. Effective 20 July 2026.