Privacy Policy
Last updated : July 8, 2026
Introduction
This Privacy Policy describes how the Kastapp.xyz web application and its associated browser extension (Kast Sync Engine) collect, use, protect, and process the personal data of its users.
Kast is a Personal Branding OS: content scheduling, AI-assisted drafting, engagement analytics, and lead qualification from your own LinkedIn and X accounts. By using Kastapp.xyz or the extension, you agree to the practices described below.
1. Data controller
The data controller is Kast Technologies, publisher of Kastapp.xyz.
For any questions about this policy or your data, contact us at contact@kastapp.xyz.
2. Data we collect
Depending on the features you enable, we may process the following categories of data:
- Account data: name, email address, password (hashed), preferences, and workspace settings.
- Content data: post drafts, scheduled or published posts, associated media, AI voice calibrations.
- Engagement data: aggregated metrics from your publications (views, likes, comments, shares) and public profiles of people who interacted with your content.
- OAuth connection data: encrypted tokens for LinkedIn publishing (and X when applicable), never stored in plain text.
- Technical data: access logs, session identifiers, extension version, IP address on API requests.
- Billing data: handled by Stripe; we do not store your card numbers.
3. Browser extension - local architecture
The Kast Sync Engine extension acts as a local background client. It uses your browser's active session (LinkedIn and X session cookies) only on your device to query graphQL and analytics endpoints for your own posts.
Crucially: raw session cookies are never transferred to, nor stored on, our servers. We only transmit the resulting engagement metrics (like/view counts, public interactor profiles) to our backend to populate your Kast dashboard.
This architecture limits exposure of your session credentials and avoids cloud-based scraping of your social accounts.
4. Purposes of processing
We use your data to:
- Provide and improve Kast services (scheduling, Content Lab, analytics, leads, outreach).
- Authenticate your account and secure access to the app and extension.
- Sync interactions from your posts into your sales pipeline.
- Process payments and manage your subscription.
- Send transactional communications (email verification, password reset, product alerts).
- Comply with legal obligations and prevent abuse.
5. Legal basis (GDPR)
Processing is based on:
- Contract performance when you use Kastapp.xyz.
- Your consent for certain optional features (e.g. non-essential cookies, marketing communications).
- Our legitimate interest in security, fraud prevention, and product improvement.
- Applicable legal obligations (accounting, responses to authorities).
7. Retention
Account and content data are retained while your account is active. After account deletion, we delete or anonymize your data within a reasonable period, except where legal retention is required (e.g. billing records).
Technical logs are kept for a limited time for security and diagnostics.
8. Security
We apply appropriate technical and organizational measures: OAuth token encryption, HTTPS, password hashing, role-based access control, and limiting sensitive data transiting our servers (notably via the extension's local architecture).
No security measure is perfect; please protect your credentials and report any suspicious activity.
9. Your rights
Under the GDPR and applicable laws, you have rights of access, rectification, erasure, restriction, objection, and portability regarding your personal data.
To exercise these rights, you may contact our technical team directly at contact@kastapp.xyz.
You may also lodge a complaint with your local data protection authority.
10. International transfers
Some subprocessors may be located outside the European Economic Area. In that case, we ensure appropriate safeguards are in place (standard contractual clauses or adequacy decisions).
11. Changes
We may update this policy to reflect changes to Kastapp.xyz or legal requirements. The last updated date appears at the top of this page. Material changes will be notified by email or in-app when required.