Castessa

Social media management for agencies

Privacy Policy

Last updated: 16 August 2026

This Privacy Policy explains how the Castessa Social Media Command Centre (the “Service”) collects, uses, and protects information when the campaign team uses it to manage its Facebook Page and Instagram Professional account. The Service is operated by theCastessa campaign team (“we”, “us”).

1. Information we collect

  • Account & login data. The email address of authorised administrators, used only to sign in.
  • Meta (Facebook & Instagram) data. With your permission via Facebook Login, we access data for the connected Page and Instagram account: profile details, published posts, media, captions, and available analytics (reach, views, followers, likes, comments, shares, saves).
  • Access tokens. The Meta access tokens needed to call the Meta APIs on your behalf. These are encrypted at rest and are never exposed to the browser.
  • Content you upload. Images, videos, and captions you choose to publish.

2. How we use information

  • To display consolidated analytics for your connected accounts.
  • To publish content you create to Facebook and/or Instagram at your request.
  • To generate performance reports for your campaign.

We do not sell your data, use it for advertising, or share it for any purpose other than operating the Service.

3. How data is stored and protected

Data is stored in a Supabase (PostgreSQL) database with Row Level Security. Access tokens are encrypted using AES-256-GCM. All communication with Meta happens server-side over HTTPS. Only authorised campaign administrators can access the Service.

4. Third-party services

  • Meta Platforms — Facebook & Instagram data and publishing, per Meta’s Platform Terms.
  • Supabase — authentication, database, and file storage.
  • Vercel — application hosting.

5. Data retention & deletion

We retain analytics and content only as long as needed to operate the Service. You may disconnect a connected account at any time from the Connected Accounts screen, which removes its stored access token. To request deletion of all data associated with your account, see our Data Deletion instructions. Deletion requests are honoured within 30 days.

6. Cookies & analytics

The application uses only essential cookies needed to sign you in and remember the client you are viewing. On our public marketing site we use privacy-friendly, cookieless product analytics (Vercel Web Analytics & Speed Insights) that set no cookies and collect no personally identifiable information.

We also offer Google Analytics 4 to understand how the marketing site is used. Google Analytics sets cookies, so it is loaded only after you accept analytics cookies in our consent banner. If you decline, Google Analytics is never loaded and no analytics cookies are set. You can change or withdraw your choice at any time via the “Cookie settings” link in the site footer.

7. Your rights

You may request access to, correction of, or deletion of your data by contacting us at the email below. Because the Service processes data on connected Meta accounts, you can also manage or revoke the Service’s access from your Facebook settings at any time.

8. Contact

For any privacy question or request, contact us at postme@castessa.app.