Privacy Policy
Version 2026-07-18 · Effective 18 July 2026
This site collects very little. If you join the waitlist, we keep your email address and chosen language so we can tell you when the app launches. If you buy the kit, Gumroad handles the payment and we do not receive your card details. Standard technical logs keep the site running and secure. We do not sell your data or use advertising trackers.
1. Controller and contact
The controller is the individual operator of the CAST project, based in Luxembourg. Privacy questions, rights requests and deletion requests may be sent to team@castvault.net. Full legal operator and service-address information will be added before any account-based commercial service is activated.
2. Who this policy covers
This policy covers visitors to the castvault.net website, people who join the launch waitlist and people who buy The Vault — Party Kit.
3. Data we process
- Waitlist data: the email address and interface language you submit to the launch waitlist. Used only to send launch news about CAST, kept until you ask for deletion or launch communication ends, and never sold or shared for advertising.
- Purchase data (via Gumroad): when you buy the kit, the payment, billing and tax details are collected and processed by Gumroad, Inc. as merchant of record, under Gumroad’s own privacy policy. We receive limited order information (such as that a sale occurred and a buyer email for support and delivery) but not your full card details.
- Support data: the content of any message you send us, so we can respond.
- Technical and security data: records that our hosting and infrastructure providers generate to deliver, diagnose and protect the site, which may include IP address, device/browser details, request time and error information.
4. Purposes and legal bases
| Purpose | Data | Legal basis in the EEA |
|---|---|---|
| Send you launch news you asked for | Waitlist email and language | Your consent, which you can withdraw at any time |
| Deliver the kit and support your purchase | Limited order and support data | Performance of the purchase you requested and legal accounting obligations (payment handled by Gumroad) |
| Keep the site available, secure and free of abuse | Technical and security data | Legitimate interests in operating and protecting the site; legal obligations where applicable |
| Answer your messages | Support data | Legitimate interests in responding and, where relevant, performance of the requested service |
5. Service providers and recipients
The site currently uses:
- Netlify for web hosting and delivery;
- Supabase for the database that stores waitlist entries;
- Gumroad, Inc. as merchant of record for the kit purchase — payment and buyer data entered in the Gumroad checkout are processed by Gumroad under its own privacy policy.
These providers process data only to deliver their service to CAST. We may also disclose limited information where required by law or to protect users or legal rights. CAST does not sell personal data. If new providers (for example, analytics, an email newsletter tool, or the future app’s services) are added, this policy will be updated before relevant personal data is sent to them.
6. International transfers
We prefer European hosting regions where available, but some providers may process security or delivery data in other countries. Where EEA personal data is transferred outside the EEA, the responsible party must use an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses, with supplementary safeguards where required. Contact us to ask about safeguards relevant to your data.
7. Cookies and analytics
The site uses only the storage strictly necessary to remember your language choice and keep the site working. It does not use advertising cookies or optional analytics trackers. If optional analytics or marketing technologies are added later, they will remain disabled until the required choice is offered.
8. Retention
Waitlist data is kept until you ask us to delete it or until launch communication ends. Order records may be retained for the period reasonably needed to meet accounting and legal obligations (and are also held by Gumroad under its own policy). Support messages are kept only as long as needed to handle the request. Technical logs are kept for a limited period for security and diagnostics.
9. Security
We use access controls and restricted database permissions to protect waitlist data, and rely on our providers’ security for hosting and payments. No internet service is perfectly secure. Please report any suspected problem to team@castvault.net.
10. Your data-protection rights
Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and may object to processing based on legitimate interests. Where processing relies on consent (such as the waitlist), you may withdraw it at any time without affecting earlier lawful processing.
Send requests to team@castvault.net. In Luxembourg, you may complain to the Commission nationale pour la protection des données (CNPD); you may also contact the competent authority where you live or work.
11. Changes
The version and date appear at the top. If we make a material change to how existing data is processed, we will update this page, and where new consent is required we will ask for it separately.