Your data,plainly.

Last updated 20 September 2026

Who is responsible

Castomo prosta spółka akcyjna (Castomo P.S.A.), Wrocław, Poland, is the controller of the personal data described in this notice. It designs and runs Builder. The registry details are below and in the footer of every page. For anything in this notice — a question, a request to see, correct or delete your data, an objection — write to hello@castomo.com.

What this notice covers

This notice covers the website at builder.castomo.com and the designer you open from it, at builder.castomo.com/editor/. Both are served from the same address, so they share the device storage listed below. Signing in is handled by the Castomo account service at accounts.castomo.com, which other Castomo products use as well.

Giving us your data is voluntary. You can look around the website and use the designer without an account; your design then stays in your browser. Without an account you cannot save designs to it, share them or join a room.

Visiting the website

The pages are delivered by a web server run by MyDevil, a hosting provider in Poland. Like any web server it records each request: your IP address, the time, the page asked for and your browser's description of itself. We need this to deliver the site and keep it secure, which is our legitimate interest (Article 6(1)(f) GDPR).

These pages load no fonts, scripts or images from other companies. The only requests to other servers are to Castomo's own analytics and chat servers, described next.

Analytics: Observer

We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.

Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.

We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.

Chat assistant

Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.

When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.

The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.

We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.

Your account

To save designs to an account, share them or use rooms, you sign in with a Castomo account. You type your password only at accounts.castomo.com — never on builder.castomo.com. When you sign in, the designer receives from the account service your account id, your e-mail address, your name if you have set one, and two tokens (an access token and a refresh token) that prove you are signed in. They are kept in your browser's local storage until you sign out. Signing out ends the session at the account service as well.

Each time the designer opens and nobody is signed in, it quietly asks the account service, in a hidden frame, whether this browser already has a Castomo session. That is how someone who signed in to another Castomo product is signed in here without a click. The request reaches the account service like any other, so it sees your IP address; if there is no session, nothing else happens.

The account service keeps its own session cookie (__Host-csso) in your browser so that you stay signed in across Castomo products. The website and the designer set no cookies of their own.

Saved designs

A design you save to your account is stored, with its name, in Castomo's document service (db.castomapi.com) as a JSON document under your account. Only you, as the owner, can read it there directly. The document is the whole design: levels, walls, openings, roof, objects, terrain, planting, roads, look, and the settings of the sun study — including the place or the latitude and longitude you choose for it, so a design may say roughly where your plot is. Enter only a location you are happy to have stored.

Separately, while you work, the designer keeps an automatic copy of the open design in your browser's local storage, with or without an account. That copy never leaves your device on its own. Designs you export as .webhome.json go to your own device, and a file you open from your device is read in your browser and is not uploaded.

Sharing, rooms and invitations

When you share a design you choose a role for the other person — viewer or editor — and, for an editor, the areas they may change. The share (who, which design, which role and areas) is kept in Castomo's live service (live.castomapi.com) until you remove it in the Share panel. To invite someone who has no account you enter their e-mail address; it is used to send them a single-use invitation link and to record the share. If you were invited to a design, your e-mail address reached us from the person who invited you.

While a saved design is open and you are signed in, the designer joins that design's room on the live service. The other people who have access to the same design then see your name (your account name, or the part of your e-mail address before the @ if you have not set one), your role and the areas you may change, the figure you picked, a colour derived from your account id, where your figure stands (sent up to about 12 times a second, in every camera view) and the changes you make. Rooms also have a thread: messages you write there are stored with the design and are visible to everyone who has access; the latest ones load when a design is opened. The live service also keeps a history of a design, one line for each save such as "move wall", with the design's name, which people with access can read.

When a design is shared with you, its name is remembered in your browser so that your list opens quickly.

Voice

Voice is optional. It starts only when you press the microphone button, and your browser asks for permission first. Audio travels directly between the browsers of up to eight people (WebRTC). It does not pass through Castomo's servers and we do not record it; the live service only relays the messages the browsers use to set the connection up. Switching the microphone off stops the audio track, so your browser's recording indicator goes off.

To find a route between browsers, yours contacts public STUN servers run by Google (stun.l.google.com) and Cloudflare (stun.cloudflare.com), which see your IP address. Everyone in the voice group can also see the other participants' IP addresses; direct connections work that way. There is no relay server, so on some strict networks a connection cannot be made.

AI Studio

AI Studio is optional. When you ask it to furnish a room, the designer sends to Castomo's model gateway (proxy.castomui.com): the sentence you typed; a description of the level being furnished — the outlines of its rooms as corner coordinates, wall centre lines and thickness, the ceiling height, and the ids and positions of objects already placed on that level; and a shortlist of catalogue models. It does not send the design's title, file names, other levels or any account details, and the request carries no sign-in token. The gateway sees the request like any server does, including your IP address.

The gateway passes the request to an AI model provider. Which providers answer is decided by the gateway's operator and can change; the providers used or possible are OpenAI, Anthropic, Google, xAI, Moonshot AI and OpenRouter, and some of them may process data outside the European Economic Area. The reply is a list of placements — place, move or remove a piece of furniture — that the designer checks before applying it to your design as a single step you can undo. Please do not put personal data in what you type.

Who receives data, and where

• Castomo's own services, operated by Castomo P.S.A.: the account service (accounts.castomo.com), the document service (db.castomapi.com), the live service (live.castomapi.com), the model gateway (proxy.castomui.com), Observer (observer.castomo.com) and the chat (chat.castomapi.com). Observer's server is in Frankfurt and the chat's in Amsterdam, both with the hosting provider UpCloud.
• MyDevil (Poland), which hosts the website and the designer's files.
• AI model providers for the chat and for AI Studio, as described in those sections.
• Google and Cloudflare, whose STUN servers see your IP address when you use voice.
• Other people in a room or with a share, as described in the sharing and voice sections.
• Public authorities, where the law requires us to disclose data.

Some AI model providers and the STUN servers may process data outside the European Economic Area. Where that happens, the transfer is covered by the safeguards Chapter V of the GDPR requires, such as standard contractual clauses; write to us if you would like details.

How long data is kept

• Observer: raw records 24 hours, totals 25 months.
• Chat: until 180 days after the visitor's last visit.
• In your browser: until you sign out, replace or clear it, or clear your browser's site data — see the list.
• Saved designs, shares, room messages and history: for as long as the design and your account exist. You can remove a share yourself, and you can ask us at any time to delete your designs, shares and room messages.
• Web server request log: kept by the hosting provider under its own log settings.

We have not set a fixed period for the last two items and do not publish one here. If we do, it will be added to this list.

What is stored on your device

Builder writes the items below to your browser's storage. They are needed for something you asked for — staying signed in, keeping your work, remembering a setting — and none is used for tracking or advertising. You can delete all of them in your browser's settings; the designer then forgets your settings and any unsaved local copy.

Observer stores nothing on your device. The account service's session cookie is described under Your account.

Why we may process it

Your rights

You have the right to access your data and receive a copy, to have it corrected or erased, to have its processing restricted, to receive the data you gave us in a structured, machine-readable form where we process it under a contract, and to object to processing based on our legitimate interests, on grounds relating to your situation. If we ever ask for your consent, you can withdraw it at any time.

To use any of these rights write to hello@castomo.com. We reply within one month.

You also have the right to complain to the supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or the authority in the EU country where you live or work.

No automated decisions. We do not take decisions about you based solely on automated processing that have legal or similarly significant effects. AI Studio only proposes where furniture goes, and you can undo what it does.

Changes to this notice

If what we do with data changes, we will update this page and its date. The Polish version is Polityka prywatności.