Recast AI

Privacy Policy

Last updated: June 11, 2026 · Effective: June 11, 2026

1. Scope and who we are

This Privacy Policy describes how Recast Agency ("Recast AI," "we," "us") collects, uses, stores, and shares information in connection with the Recast AI platform at app.recast-agency.com (the "Service"), a private, invitation-only operating platform for Recast AI's team, clients, and partners. By using the Service you agree to this Policy and our Terms of Service. Questions: support@recast-agency.com.

2. Information we collect

Account information. Name, email address, role, and workspace membership, provisioned when you are invited.
Workspace content. Information you or your team submit: client records, leads, actions, tickets, notes, files, and related operational data.
Google user data. Only if you choose to connect a Google product — detailed in Section 4.
Usage and technical data. Standard server logs (IP address, timestamps, requested routes, user-agent) and in-product audit events, used for security, reliability, and support.

We collect information directly from you, automatically through your use of the Service, and from third-party services you choose to connect.

3. How and why we use information

To provide, operate, secure, and support the Service and its role-scoped features.
To administer accounts, workspaces, and integrations you request.
To maintain audit logs of administrative and security-relevant actions.
To communicate with you about the Service.
To comply with law and enforce our Terms.

We do not sell personal information, and we do not use your workspace content or Google user data for advertising.

4. Google user data

You may optionally connect Google products (such as Google Calendar, Drive, Docs, Sheets, Slides, Forms, Google Analytics, and Search Console) to your workspace via Google sign-in (OAuth). When you do:

What we access. We request the narrowest scopes needed for the feature you enable, defaulting to read-only access. Examples: reading calendar events to show availability; reading spreadsheets you select for lead tracking; reading Analytics and Search Console reports for performance summaries. Write access (for example creating a calendar event) is requested separately and only with your explicit approval.
How we use it. Google user data is used solely to provide user-facing features of the Service to you and your workspace. We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.
How we store it. OAuth access and refresh tokens are encrypted at rest on our servers. Data retrieved from Google APIs is processed to render the feature and is not retained beyond what the feature requires.
How we share it. We do not sell Google user data, do not share it with advertisers or data brokers, and do not transfer it to third parties except as necessary to provide the feature you requested, to comply with applicable law, or as part of a merger or acquisition with notice to you.
Human access. Recast AI staff do not read your Google user data except with your consent (for example, support you request), for security investigation, or where required by law.
Deletion and revocation. Disconnecting a Google product in the Service deletes its stored tokens immediately. You may also revoke access at any time at myaccount.google.com/permissions, and may request deletion of associated workspace data at the contact below.

Limited Use disclosure. Recast AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. OAuth relay for client deployments

Some Recast AI clients operate their own separately hosted applications. For those deployments, Recast AI may act as an OAuth relay: the client application begins a Google sign-in that returns to our callback address, and we forward the resulting authorization code to that client application over a signed, allowlisted route. In this relay role, Recast AI does not exchange the authorization code, does not receive access or refresh tokens, and does not store any Google user data belonging to the client application's users. The client application's own privacy policy governs its use of that data.

6. How we share information

Within your workspace — according to roles and visibility settings controlled by workspace administrators.
Service providers — infrastructure vendors (hosting, networking) processing data on our instructions to run the Service.
Third-party services you connect — at your direction, as described in Section 4.
Legal — when required by law, to protect rights and safety, or to enforce our Terms.
Business transfers — in a merger, acquisition, or sale of assets, with notice to you.

7. Cookies

The Service uses an essential, HTTP-only session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

8. Retention

Workspace data is retained while your workspace is active and as needed for legitimate business or legal purposes. OAuth tokens are deleted when you disconnect a product or your account is deactivated. Server logs are retained for a limited operational window. You may request deletion at the contact below; we will honor verified requests except where retention is required by law.

9. Your privacy rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise rights, email support@recast-agency.com from the address associated with your account; we will verify and respond within the time required by applicable law. We do not discriminate against you for exercising privacy rights.

10. Security and breach notification

All traffic is encrypted in transit (HTTPS/TLS).
OAuth tokens and API keys are encrypted at rest; secrets are excluded from logs.
Access is invitation-only and role-scoped; administrative actions are audit-logged; sessions can be revoked by administrators.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify affected users and authorities as required by applicable law.

11. Children

The Service is a business tool, not directed to children under 13 (or the applicable age of digital consent). We do not knowingly collect children's personal information; if you believe a child has provided it, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy as the Service evolves. Material changes will be posted on this page with an updated date, and workspace owners will be notified. Continued use after the effective date constitutes acceptance.

13. Contact

Recast Agency — support@recast-agency.com