Privacy Policy

1. Data Controller

The data controller for personal data collected through the caast.tv website is:

2. Data We Collect

We collect the following categories of personal data:

2.1 Data you provide directly

• Contact / demo request form: first name, last name, professional email address, phone number, company name, industry, message
• Newsletter subscription: email address
• ROI calculator: e-commerce revenue (anonymous, non-identifying data)

2.2 Data collected automatically

• Browsing data: IP address (anonymised), browser type, pages visited, session duration, traffic source
• Cookies and trackers: see section 8. Cookies and Trackers
• Technical data: device type, operating system, screen resolution

2.3 Data we do not collect

We do not collect any "special category" data as defined under Article 9 of the GDPR (political opinions, religious beliefs, health data, biometric data, etc.).

3. Purposes and Legal Bases for Processing

4. Recipients of Your Data

Your personal data is accessible to authorised Caast SAS staff who need it to perform their duties.

We engage sub-processors and technical partners to operate our services. These partners process your data solely for the purposes defined by Caast SAS:

• Hosting: OVHcloud SAS (Roubaix, France)
• Audience analytics: Google Analytics 4 (Google LLC) - anonymised data
• Video streaming: Mux Video / Mux Data (Mux Inc., United States) - SCCs V2 + DPF
• File storage: Amazon Web Services (AWS, Luxembourg) - SCCs V2 + DPF
• Data analytics: Google Cloud BigQuery (Google LLC, France) - EU multi-region
• SMS: SMSFactor (France) - EU multi-region
• Advertising (only with your consent): Meta Platforms Ireland Limited (Ireland), via the Meta pixel; LinkedIn Ireland Unlimited Company (Ireland), via the Insight Tag. See section 8.3.
• Bot protection: Cloudflare Turnstile (Cloudflare, Inc., United States) - analyses technical signals from your browser (IP address, TLS fingerprint, User-Agent header) to tell humans from bots on our forms. Cloudflare acts as a processor when protecting the site, and as a controller when it uses these signals to improve its bot detection. See Cloudflare's Turnstile Privacy Addendum.

We never sell, rent or otherwise transfer your personal data to third parties for their own commercial purposes.

5. Retention Periods

Upon expiry of these periods, your data is deleted or irreversibly anonymised.

6. International Data Transfers

Some of our sub-processors are established outside the European Economic Area (notably in the United States). In such cases, transfers are governed by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adherence to the EU-US Data Privacy Framework (where applicable)

You may obtain a copy of these safeguards by contacting us via our contact form.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

To exercise these rights, contact us via our contact form or by post to our registered address. We will respond within one month.

If you believe your rights have not been upheld, you have the right to lodge a complaint with your national supervisory authority. In France: CNIL (Commission Nationale de l'Informatique et des Libertés) - www.cnil.fr - 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

8. Cookies and Trackers

When you visit caast.tv, cookies and similar trackers may be placed on your browser. A cookie is a small text file stored on your device.

8.1 Strictly necessary cookies

These cookies are essential for the website to function. They cannot be disabled without affecting core functionality. No consent is required for these cookies.

8.2 Analytics cookies

Used to measure website traffic (visit counts, pages viewed, session duration). These cookies require your prior consent.

• Google Analytics 4 (Google) - _ga and _ga_* cookies - retention: 13 months - anonymised data - loaded only if you accept audience measurement

8.3 Marketing cookies

These cookies enable personalised advertising and conversion tracking. These cookies require your prior consent.

• Google Ads - advertising conversion tracking
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) - measuring the effectiveness of our LinkedIn ads: pages visited and successful submission of our forms (trial request, contact, demo). No data entered in the forms is sent to LinkedIn by the tag. Loaded only if you accept advertising.
• Meta pixel (Meta Platforms Ireland Limited) - measuring the effectiveness of our Facebook and Instagram ads: pages visited and successful submission of our forms (trial request, contact, sign-up), to count the requests generated by our campaigns and optimise their delivery. No data entered in the forms (name, email address, Instagram account) is sent to Meta by the pixel. _fbp cookie and, if you arrive from an ad, _fbc - retention: up to 90 days, renewed on each visit - loaded only if you accept advertising.

For the collection of this data by the pixel and its transmission to Meta, Caast SAS and Meta Platforms Ireland Limited are joint controllers (Article 26 GDPR). Meta then processes this data as a controller, under its privacy policy. Transfers to Meta Platforms, Inc. (United States) may occur, governed as described in section 6.

8.4 Managing your preferences

No audience measurement or advertising cookie is set without your consent. On your first visit, a banner lets you accept all, reject all or choose purpose by purpose; declining has no effect on your browsing. Your choice is kept for 6 months, after which you will be asked again.

You can change or withdraw your consent at any time, as easily as you gave it: manage cookies (also available at the bottom of every page). Cookies from declined trackers are then deleted.

For more information on cookie management, visit the CNIL website: cnil.fr.

9. Data Security

Caast SAS implements appropriate technical and organisational measures to protect your personal data against:

• Unauthorised or unlawful access
• Accidental loss, destruction or alteration
• Unauthorised disclosure

These measures include encryption of data in transit (HTTPS/TLS), strict access controls on databases, and regular backups.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Article 34 of the GDPR.

10. Caast Mobile App

The Caast app (iOS and Android) is used to film and broadcast live shopping shows. It collects only what that purpose requires, and it displays no advertising.

10.1 What the app collects

• Your account: email address and name, to identify you on the Caast platform and find your shows.
• The live show itself: the picture and sound you film are broadcast live to the show you selected. That is the very purpose of the app.
• Recordings: every show is recorded on your device. Those files stay there, and are sent to Caast only when you ask for it, or when a control room you paired with requests them.
• Device status: name and model, battery level, temperature, free storage and network link quality. The control room displays this: an operator must know whether a device is about to fail before the show ends.
• Technical diagnostics: actual bitrate, dropped frames, connection losses, to understand what happened when a broadcast degrades.

10.2 What the app does not collect

• No location data: the app requests no location permission.
• No contacts, no calendar, no messages.
• No advertising identifier: the app shows no ads and performs no tracking.
• No videos from your photo library: the app only reads the videos it recorded itself.

10.3 Permissions requested

• Camera and microphone: to film and capture the sound of the show.
• Foreground service: to keep the broadcast alive when the screen turns off; a show interrupted by standby would be an on-air failure.
• Local network (Wi-Fi): to discover the main device or a second camera on your own network. No location data is derived from it.
• Notifications: to display the broadcast status while it runs in the background.

10.4 The link with a second camera or a control room

The link between your main device and a second camera or a tablet acting as a control room never leaves your local network: it is protected by a pairing code only you can see.

10.5 Recipients, retention and deletion

Data goes to the Caast platform and to the video delivery service that carries your broadcast to your viewers. It is sold to no one and serves no advertising. Exchanges with the platform are encrypted (HTTPS, WSS) and the broadcast is sent over RTMPS.

Account data lives as long as the account exists. Recordings stay on your device until you delete them; those sent to the control room follow the retention period of your Caast workspace. To request deletion of your account and its data, contact us through the contact form. Uninstalling the app leaves the recordings on your device, yours to keep or delete.

11. Contact Us

For any questions about this privacy policy or to exercise your rights, please contact us:

We are committed to responding to any request within a maximum of one (1) month. This period may be extended by a further two months where requests are complex or numerous, in which case we will inform you accordingly.