سياسة الخصوصية

Who we are

This policy explains how the casii.io website, the Casii desktop app and the Casii MCP server that AI apps connect to (together, “the service”) handle personal data. The service is developed and operated by Ginyo, a software development and operations company registered in Hong Kong. For any privacy question or request, contact support@casii.io.

What we collect

Account data — your email address and, when you sign in with Google, your Google name and profile picture.
Subscription data — the plan you purchased, your order number and payment status. Full card numbers never reach us.
Device and license data — basic device identifiers used to activate your license and enforce plan limits.
Export data — the targets you enter for social media data exports (such as usernames, profile or post links, keywords and locations), the options you choose, your export history and credit usage, and the result files we produce.
AI app connection data — the name, creation time and expiry of each API key you create, and for each AI app you approve through OAuth, the name the app gives itself, the host of its callback address, when you approved it, when it last renewed access and when it was revoked.
Security and log data — IP addresses, and the times of security-related actions such as registering, signing in, creating or revoking API keys, and approving or revoking AI apps.
Support data — anything you choose to send us when you ask for help.
Product analytics — a small number of events (for example a first visit to the site) that help us understand how the service is used.

Your WhatsApp accounts and your customer data

Casii works with WhatsApp accounts that belong to you, on your own computer. Outreach messages are composed and sent locally. Customer records you build with the service, such as leads, notes and conversations, are processed to provide the features you use. We do not sell them and we do not use them for advertising.

Social media data exports

When you run an export, we retrieve information that is publicly visible on the social media or map platform you target, directly or through data collection service providers, and compile it into a CSV or XLSX file for you. Depending on the tool, a file can contain public information about other people and businesses, such as usernames, display names, profile bios, follower counts, posts and comments, business listings, and contact details (email addresses, phone numbers or websites) that are publicly listed on a profile, in a bio or on a business website. We do not guess contact details that are not published.

We process this public information only to produce the files you request. Each file is available through a download link. Anyone who has the complete link can download the file, so share it only with people you trust. The link is not tied to your API keys or connected AI apps and keeps working after you revoke them.

You are responsible for having a lawful basis to use exported data, including for contacting the people or businesses in it.

AI apps and the MCP server

You can connect AI apps and agents to your account through our MCP server, either with an API key you create in the dashboard or by approving the app on our consent page (OAuth). A connected app can use the export tools of your account, for example: browse the available export tools, check export targets, look up locations, hashtags, marketplace areas or ad companies on the target platforms, get prices, create and continue exports using your existing credits, read your export history and progress, get file download links and check your credit balance. It cannot manage your keys, change your account or make payments.

The app sends us the requests it makes for you, such as export targets, lookup queries, options and quantities. We send the app the results of those requests, such as target details, prices, export status, your credit balance and download links. Once information reaches the AI app, its provider handles it under its own privacy policy and terms; we do not control how the app stores or uses it.

OAuth access tokens expire after 6 hours, and a connection that is not renewed for 30 days stops working. We store OAuth tokens only as one-way hashes, and we record approvals and revocations of AI apps, and creation and revocation of API keys, in our security audit log. On the API Keys page of your dashboard you can see and revoke connected apps and create or revoke API keys at any time; revocation applies to new requests immediately. Changing your password or signing out does not disconnect apps or revoke keys.

How we use data

Create and secure your account and let you sign in
Operate your subscription, licenses and plan limits
Run the exports you request and deliver the result files
Let the AI apps you connect act on your account within the limits described above, and keep those connections secure
Provide the support you ask for
Understand, in aggregate, how the site and app are used, and fix problems
Send service messages such as receipts and security alerts

Payments

Credits packs are bought on this site, and subscription plans are activated after you contact us. Payments are processed by third-party payment service providers. We receive your order number and payment status, never your full card number.

Analytics

We keep analytics minimal: a small number of first-party events with no advertising profiles and no sale of data. The site self-hosts its fonts and sets no third-party advertising trackers.

Storage and security

Your WhatsApp sessions run in isolated local environments on your computer. Account, subscription and team-synchronized data is stored on managed infrastructure with access controls and encrypted connections.

How long we keep data

We keep account, subscription and support data while your account is active. If you close your account or ask us to delete your data, we delete it, except the minimum records we must keep for accounting or legal reasons and short-lived backup copies.

Exports — result files do not expire on a schedule; a download link works as long as the file is still available.
API keys — a key stays valid until you revoke it, except temporary keys, which expire after 6 hours.
OAuth connections — access tokens expire after 6 hours, pending approval requests after 30 minutes and authorization codes after 3 minutes; a connection expires after 30 days without renewal.
Revoking an API key or an AI app connection does not delete its record.

Who we share data with

Service providers that help us run the service — hosting, payment processing, email delivery, translation services and AI model service providers — under contract and only for the tasks we give them. When you use translation or AI features, the text involved is sent to these services for processing.
Data collection service providers, which receive the export targets, lookup queries and options you submit, never your API keys, tokens or sign-in details, so they can return the public information for your export.
AI apps you connect, which receive the results of the requests they make on your behalf.
Payment processors, to complete your purchases.
Authorities, only where the law requires it.

We never sell personal data.

Your choices and rights

You can request access, correction or deletion of your personal data, and object to or restrict its use, by writing to support@casii.io. If you are in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority. You can revoke API keys and connected AI apps yourself on the API Keys page of your dashboard. If you signed in with Google, you can remove CAS Manager’s access at any time in your Google account security settings.

Children

Casii is a business tool. It is not directed to children, and we do not knowingly collect personal data from children.

Changes to this policy

When we change this policy, we update the reviewed date at the top of this page. For material changes we also notify account holders by email or in the app.

Contact

Questions about privacy: support@casii.io. Casii is operated by Ginyo.