What we hold,and why.

This website

This site sets no cookies, and neither do the services it uses. The one cookie you may have comes from the FABLS app after you sign in; it is described just below. No scripts from other companies. Every page loads scripts only from this website and from two services run by Castomo: Observer (observer.castomo.com) and the chat button (chat.castomapi.com). The typefaces are served from this domain rather than from anybody else's, so opening a page here does not tell any other company that you did.

One cookie, only after you sign in to the app. When you sign in to the FABLS app (app.fabls.io), the app leaves one cookie in your browser, named castomo_user. It holds the part of your e-mail address before the @ sign (at most 40 characters), so that this site can show it on the header button in place of “Open FABLS”. It is set only after you sign in, never for a visitor who has not, and it is only a label: it grants no access, and this website's server does not use it. Its domain is fabls.io, so your browser sends it to this site and to app.fabls.io and api.fabls.io, and to nobody outside fabls.io; it is not used for tracking. It lasts 30 days, renewed each time you visit the app, and is removed when you sign out. You can also remove it yourself by clearing your browser's site data for fabls.io. This website's own pages and scripts set no cookies; the header script only reads this one.

Analytics: Observer. We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.

Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.

We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.

Chat assistant. Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.

When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.

The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.

We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.

Your colour, text-size, spacing and motion preferences are stored in your own browser's local storage and never leave it. Clearing your site data removes them.

Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.

The demo on the home page is the one exception, and only if you use it. What you write about your business, the channels and posts a week you pick, and the month planned from them are sent to castomapi-try, our own service, run by Castomo P.S.A. on servers in the European Union, and kept as a draft for 30 days so you can come back to it. After 30 days an unsaved draft is deleted. The draft is opened by a key kept in your browser's local storage under a name beginning fbl: (not a cookie), and nobody else can open it unless you share a link to it; if you sign in to keep the month, that sign-in is kept there too. Your internet address is used only to stop the demo being abused — an hourly limit held in the service's memory and never written down.

A month planned from your description is written by an AI model: the description goes, through the OpenRouter routing service, to one of the model providers it lists, and some of those — free models in particular — may keep what they receive under their own terms. That is the demo; drafting inside FABLS is described further down. So describe the business, not anybody's personal data; the demo does not need any.

If you save the month to a castomo account, from then on it belongs to that account and is covered by the next section, The FABLS service: it stays until you delete it or the account.

The web server keeps ordinary access logs for a short period, as any web server does, for security and for diagnosing faults. There is no profile behind them and nothing is combined with anything else.

What a drafting step sends, and where

Drafting uses language models, and a draft is produced by sending a model the material it needs: the writer's persona and skills, the slot's channel and format, the campaign's brief and the brand facts you supplied.

Drafting a reply to a comment sends a model the post's writer, the comment, the thread it belongs to and the post it sits under — and nothing about the person who wrote it beyond what FABLS keeps: the name the platform shows and their words.

What it does not send is everything else on your account. A draft for one business does not carry another business's material — which is the specific thing that matters if you are running several clients on one account.

Model providers are processors under contract, and the material is used to produce your draft rather than to train anybody's model. Where a model runs matters to some businesses; if it matters to yours, ask before you start rather than after.

Who else sees anything

The channels you connected. Publishing means sending your post to the channels you connected (Facebook, Instagram, your WordPress site, YouTube, TikTok, Pinterest, Threads, LinkedIn or X), and those platforms then hold it under their own terms. A reply to a comment is sent the same way, under the comment it answers. That is the point of publishing, and it is worth saying plainly.

castomAPI. The platform underneath, run by the same company, carries the posting, the looks for new comments and the replies, and the AI requests that drafting makes.

Google, if you connect Google Ads. Creating a campaign sends Google the campaign, ad groups, keywords and ad text you enter, and reading its performance brings numbers back, all on your own Google Ads account and under Google's own terms. castomAPI carries those calls and keeps your Google sign-in encrypted; FABLS does not hold it. You connect it yourself and can disconnect it whenever you like.

Nothing is sold. Apart from the Google Ads account you connect yourself, nothing is passed to an advertising network, and there is none involved in any other part of this.

How long, and how to get it back or removed

Your writers, plans, drafts and publishing history are kept while your account exists, because a report about November cannot be produced from a database that has forgotten November. Access logs are short-lived. Billing records are kept for as long as tax law requires, which is not a decision we get to make.

You can ask for a copy of what we hold — including a chat conversation, if you started one — a correction of something wrong, or a deletion. Write to hello@castomo.com and say which; it reaches a person. Deleting your account removes your writers, plans and drafts across the family — one account means one deletion rather than seven.

Comments collected in the inbox are kept with the brand: deleting the brand deletes them, and so does erasing the account of the person who connected the channel they came from. Disconnecting a channel keeps them.

Step-by-step instructions for deleting your account, a brand or a channel's connection, and for withdrawing FABLS's access at each platform, are on Data deletion. Deleting the account does not by itself delete the sign-ins castomAPI keeps for your channels: disconnect them first, as that page explains.

Posts already on Facebook, Instagram, your own site or any other channel you connected are not ours to remove. They are on your channels, under your control, and deleting them is done there.