Privacy policy
Last updated: November 13, 2026
1. Who we are and who this applies to
Fersoft Technologies, LLC, a limited liability company organized in Delaware (file number 10321376), with its address at 1111B S Governors Ave STE 39885, Dover, DE 19904, United States, runs castly (castly.sh), a service for developers and companies to send web push notifications to the people who subscribe on their websites. For any privacy matter, write to hola@castly.sh.
This policy covers two cases:
- Customers (whoever creates an account, and their organization): we are the controller of their account data.
- Our customers' subscribers (whoever accepts notifications from a website that uses castly): that website is the controller, and we are its processor: we only process that data to provide the service to it and following its instructions.
2. If you receive notifications from a website that uses castly
What data: the push subscription your browser creates when you accept notifications (an address at your browser's push service and its encryption keys); the browser and operating system; if the website sends them, its user identifier for you and some tags (for example, your plan or language); if the website marks your browser as a test device, that mark and its label; and the events of each notification: when it was sent, whether it was delivered, whether you clicked it and, if it failed, the push service error code.
What for: to deliver that website's notifications to you and show it whether they arrived. We do not use your data for advertising or sell it, and we do not combine it across websites: if you subscribe to two websites that use castly, each has its own subscription unrelated to the other. The content of each notification travels encrypted to your browser.
Your rights: you can stop receiving notifications anytime by withdrawing permission in your browser settings or from the website itself. To access, correct or delete your data, contact that website. If you write to hola@castly.sh, we will pass your request on to the website and help it answer.
Retention: the subscription, for as long as the website keeps it; delivery events, 30 days. After that, only daily totals without personal data remain. If the website deletes its project or account, we delete your data within 30 days, except what remains temporarily in backups.
3. If you have an account
- Account: name, email address, password protected with a hashing algorithm (never in plain text), language and verification status. If you sign in with Google, we receive your name, your verified email and your Google account identifier; we do not keep Google tokens.
- Organization and projects: names, each project's site URL and icon, plan, monthly usage, opt-in prompt settings, VAPID keys, API keys (for secret keys we only keep a hash), your webhook URL and the record of its calls, and the notifications you send with their content.
- Billing: plan status, Stripe customer and subscription identifiers and the data needed for invoices. Your card details are entered in Stripe, not in castly.
We use them to provide the service you sign up for and manage your account (performance of the contract), process payments and invoices (contract and legal obligations), send you the necessary account, usage and subscription emails, such as the notice when you approach your quota (contract), and protect the service against fraud and abuse (legitimate interest). You can edit your data from the dashboard and ask us for access, rectification, erasure, objection, restriction or portability at hola@castly.sh. We may ask for reasonable information to verify your identity. You can complain to the Spanish Data Protection Agency (aepd.es) or the data protection authority of your country.
4. Security and technical logs
Private VAPID keys and webhook secrets are stored encrypted with AES-GCM, and for secret API keys we only keep a SHA-256 hash. To limit abusive attempts we keep a hash of the IP address with a counter for minutes or hours; never the IP in plain text. The platforms we use generate technical security logs. We use encrypted connections and access controls per organization. No system is infallible; we will handle and report breaches when the law requires it, and tell affected customers without delay.
5. Providers (sub-processors)
- Cloudflare: infrastructure, network, queues, database and email delivery (Cloudflare Email Service). All service data is stored on Cloudflare.
- Stripe: payments, invoices and subscriptions. It may act as an independent controller for some payment data.
- Google: if you choose to sign in with Google, as an identity provider.
To deliver each notification, we send it to the push service of the subscriber's browser (for example, Google's, Mozilla's, Apple's or Microsoft's), which is part of the browser the subscriber chose; the content travels encrypted so that only their browser can read it. Blog articles are written with Cloudflare Workers AI without personal data. Fonts are served from our own servers. Some providers may process data outside the European Economic Area; where the GDPR requires it, we rely on adequacy decisions or valid safeguards such as standard contractual clauses.
6. Cookies and local storage
castly does not use advertising or analytics cookies. We only use technical storage:
__Host-session: keeps you signed in to the dashboard (30 days).google_*: protect the Google sign-in for a few minutes.- Browser local storage: your language and the light or dark theme of the dashboard.
On our customers' websites, the castly SDK stores in the visitor's browser the identifier of their subscription and, for the opt-in prompt, how many pages they have viewed and whether they chose "Not now", for the days the website sets; the <castly-optin> element remembers the same. Telling their visitors about it is up to each website.
7. Retention of customers' data
We keep the account, the organization and its projects while you use the service. Delivery logs are deleted after 30 days. If you ask us to delete your account, we will delete or anonymize its data and your subscribers' data within 30 days, except what we must keep by law (for example, invoices) or what remains temporarily in backups. Email delivery records are kept up to 30 days and attempt counters, hours.
8. Minors
Accounts are for adults. Websites that use castly decide whom they ask for permission to send notifications and are responsible for complying with the rules on minors that apply to them.
9. Changes
We will publish changes on this page and, if they are significant, tell customers by email or in the dashboard.