Privacy Policy

Introduction

This Privacy Policy describes how the Kastapp.xyz web application and its associated browser extension (Kast Sync Engine) collect, use, protect, and process the personal data of its users.

Kast is a Personal Branding OS: content scheduling, AI-assisted drafting, engagement analytics, and lead qualification from your own LinkedIn and X accounts. By using Kastapp.xyz or the extension, you agree to the practices described below.

1. Data controller

The data controller is Mehdi Amrani, a sole trader operating under the trade name Scalify, publisher of Kastapp.xyz, whose establishment is located at 4 allée de la Fresnerie, 78330 Fontenay-le-Fleury, France (SIRET 888 856 473 00028).

For any questions about this policy or your data, contact us by booking a meeting at https://cal.com/scalify-dc7swu/meet-the-team-kast, or by post to our registered office: 4 allée de la Fresnerie, 78330 Fontenay-le-Fleury, France.

2. Data we collect

Depending on the features you enable, we may process the following categories of data:

• Account data: name, email address, password (hashed), preferences, and workspace settings.
• Content data: post drafts, scheduled or published posts, associated media, AI voice calibrations.
• Engagement data: aggregated metrics from your publications (views, likes, comments, shares) and public profiles of people who react to, comment on or repost your content, or who interact the same way with the publications you choose to follow.
• Data you ask Kast to read: the public profile of a contact whose record you complete, and the public publications of the profile you pick as a writing reference.
• Your own LinkedIn profile: headline, summary, experience, skills and location, read only when you import your history from your LinkedIn activity page (the extension's "Importer mon historique" button), to tune your prospect filter.
• OAuth connection data: encrypted tokens for LinkedIn publishing (and X when applicable), never stored in plain text.
• Technical data: access logs, session identifiers, extension version, IP address on API requests.
• Billing data: handled by SquidLane and its payment processor; we do not store your card numbers.

3. Browser extension - local architecture

The Kast Sync Engine extension acts as a local background client. It uses your browser's active session (LinkedIn and X session cookies) only on your device, and only after you turn sync on.

What it reads: your publications and their statistics (views, reactions, comments, shares), and the people who react to, comment on or repost them. On your request, from Kast: the publications you choose to follow and the people who react to, comment on or repost them, the public profile of a contact whose record you complete, the public publications of the profile you pick as a writing reference, and your own LinkedIn profile (headline, summary, experience, skills, location) when you import your history from your activity page ("Importer mon historique" button), to tune your prospect filter. To stay compatible when LinkedIn changes its site, it also records the technical name of the few LinkedIn requests it uses itself, never their content. It never posts, comments, reacts or sends messages on your behalf.

Automatic refresh: once you turn sync on, and while Chrome is open, the extension re-reads your recent publications (under 7 days old) every 6 hours and older ones once a day, with the people who react to them. You can turn this automatic refresh off in the extension window; a post published through Kast is then still read once, about an hour after publication, and reads already queued finish. Sync itself can be turned off at any time, from the extension or from Kast's settings: nothing more from LinkedIn or X is read or sent, even in the middle of a sync.

Crucially: raw session cookies are never transferred to, nor stored on, our servers. Only the result of these reads (statistics, public profiles, texts of publications and comments, and the numeric id of your X account, which links it to your Kast account) is sent to our backend to populate your Kast account.

To sign its requests to X the way the site requires, the extension may also read the x.com page of your session and a public X file. That computation happens on your device: nothing from those pages is transmitted.

This architecture limits exposure of your session credentials and avoids cloud-based scraping of your social accounts.

4. Purposes of processing

We use your data to:

• Provide and improve Kast services (scheduling, Content Lab, analytics, leads, outreach).
• Authenticate your account and secure access to the app and extension.
• Sync interactions from your posts, and from the posts you follow, into your sales pipeline.
• Complete a contact's record on your request, describe the writing style of the profile you pick as a reference, and tune your prospect filter from your own profile.
• Process payments and manage your subscription.
• Send transactional communications (email verification, password reset, product alerts).
• Comply with legal obligations and prevent abuse.

5. Legal basis (GDPR)

Processing is based on:

• Contract performance when you use Kastapp.xyz.
• Your consent for certain optional features (e.g. non-essential cookies, marketing communications).
• Our legitimate interest in security, fraud prevention, and product improvement.
• Our legitimate interest, and that of our professional users, in processing the public profiles of people who have interacted with their publications or with the publications they follow, and of the profiles they choose to complete or to pick as a writing reference (see section 5a).
• Applicable legal obligations (accounting, responses to authorities).

5a. If you are not a Kast user

This section is addressed to people whose profile appears in Kast without them holding an account. It constitutes information under Article 14 GDPR, as the collection is indirect.

What data. The publicly visible information on your LinkedIn or X profile (name, headline, company, industry, location, photo, biography, audience), the text of the comment you published, the text of your public publications if your profile is picked as a writing reference, and, if that service is enabled for Kast, a professional email address and phone number obtained from a specialized provider, when our user requests it or your profile becomes a priority in their score.

Where it comes from. From your public interactions (like, comment, share, repost) with that user's publications or with publications they chose to follow; from your public profile, if they ask to complete your record; from your public publications, if they pick your profile as a writing reference. The reads made by the extension, with that user's session, are each triggered by an action of theirs: syncing their publications, following a post, completing a record, picking a writing reference. Once your interaction has been collected, two additions may happen on the server side, without another click from them: our provider Apify reading your public X profile, after an X sync; and, if that service is enabled for Kast, Dropcontact looking up your professional contact details when your profile becomes a priority in their score. We do not browse your profile outside of these cases.

Why. To allow that professional to identify, among the people who have publicly shown an interest in their publications or in the ones they follow, those who may be relevant to their business. If your profile is picked as a writing reference, your publications are used to describe a style (tone, structure): Kast does not republish them. This processing has a strictly professional (B2B) purpose.

Your rights. You may request access to, rectification or erasure of your data, or object to the processing, at any time and without having to give reasons, by booking a meeting at https://cal.com/scalify-dc7swu/meet-the-team-kast or by post to our registered office: 4 allée de la Fresnerie, 78330 Fontenay-le-Fleury, France. An erasure request is applied across the entire platform: your identity is added to a suppression list that prevents any further collection, including by other users. That list contains only a cryptographic fingerprint, never your identifier in plain text.

6. Sharing and subprocessors

We do not sell your personal data. We may share it with providers strictly necessary to operate the service:

These providers are bound by confidentiality obligations and may only use your data for the defined purposes.

• Hosting of the website, the application and the database (Hetzner Online GmbH, servers in the European Union).
• Payments (SquidLane and its payment processor).
• Transactional email (Resend).
• AI (Anthropic, OpenAI) for content generation and analysis - only text you submit.
• Professional email and phone lookup (Dropcontact), if that service is enabled for Kast: the most qualified contacts (whose score became high) are completed automatically, others on your request. Name, company and profile address are sent; the email found, the phone number and the LinkedIn profile address are kept.
• Collection of public X profiles (Apify): automatically after an X sync, for newly collected people (in batches of up to 100), and on your request for a selection of contacts; their recent posts, on your request only. LinkedIn profiles, for their part, are only read by the extension, with your session, on your request.
• Outreach tools (e.g. Instantly, Lemlist) when you push contacts from Kast.

7. Retention

Account and content data are retained while your account is active. After account deletion, we delete or anonymize your data within a reasonable period, except where legal retention is required (e.g. billing records).

Technical logs are kept for a limited time for security and diagnostics.

Raw collection data is automatically purged within 72 hours. Analytics history is retained for 400 days.

When a person requests the erasure of their data, only a cryptographic fingerprint of their identifier is retained, with no time limit. That retention is necessary to guarantee the request is honored over time: without it, a later sync would recreate the erased record.

8. Security

We apply appropriate technical and organizational measures: OAuth token encryption, HTTPS, password hashing, role-based access control, and limiting sensitive data transiting our servers (notably via the extension's local architecture).

No security measure is perfect; please protect your credentials and report any suspicious activity.

9. Your rights

Under the GDPR and applicable laws, you have rights of access, rectification, erasure, restriction, objection, and portability regarding your personal data.

To exercise these rights, you may contact our technical team directly by booking a meeting at https://cal.com/scalify-dc7swu/meet-the-team-kast, or by post to our registered office: 4 allée de la Fresnerie, 78330 Fontenay-le-Fleury, France.

You may also lodge a complaint with the competent data protection authority (the CNIL in France).

10. International transfers

Some subprocessors may be located outside the European Economic Area. In that case, we ensure appropriate safeguards are in place (standard contractual clauses or adequacy decisions).

11. Changes

We may update this policy to reflect changes to Kastapp.xyz or legal requirements. The last updated date appears at the top of this page. Material changes will be notified by email or in-app when required.