Legal

Privacy Policy

Last updated: July 21, 2026

1. Overview

This Privacy Policy explains how E-Green Apps Company Limited, operator of Recasten (the "Service", "we", "us", "our"), collects, uses, discloses, and protects information when developers and businesses ("Customer", "you") use the Service, and when Customer connects social media accounts through the Service on behalf of its own end users.

2. Data we collect

We collect the following categories of data:

• Account data: name, email address, company name, and billing details provided when creating a Recasten account.
• API usage data: requests made to our API, timestamps, response codes, and volume, used for billing, rate limiting, and reliability monitoring.
• Content submitted for publishing: captions, media files, and scheduling metadata that Customer submits through the API to be posted to connected Platforms.
• Connected account tokens: OAuth access tokens and related identifiers issued by each Platform when Customer or an end user authorizes Recasten to publish on their behalf.
• Support communications: messages sent through our contact form or by email.

3. Data from connected platforms

When an account is connected via a Platform's OAuth flow, we receive and process the minimum data necessary to publish content and return analytics, which may include: the account's public profile identifier and display name, publishing permissions granted, post identifiers returned after publishing, and performance metrics such as impressions, likes, comments, and shares for content published through the Service. We do not access private messages, contact lists, or data outside the scope of the permissions explicitly granted during authorization.

4. How we use data

• To authenticate API requests and route publishing requests to the correct Platform;
• To deliver content to connected accounts and retrieve analytics on Customer's behalf;
• To operate, maintain, and improve the reliability of the Service;
• To calculate usage for billing purposes;
• To respond to support requests;
• To detect, investigate, and prevent fraud, abuse, or violations of these policies or Platform policies.

We do not sell personal data, and we do not use content submitted for publishing to train third-party machine learning models.

5. Legal basis for processing

Where applicable data protection law requires a legal basis, we rely on: performance of a contract (providing the Service Customer signed up for), legitimate interests (securing and improving the Service), and consent obtained through each Platform's OAuth authorization flow for the specific permissions granted.

6. How we share data

We share data only as necessary to operate the Service:

• With the Platforms: content and metadata necessary to complete a publish request or retrieve analytics is sent to the relevant Platform (e.g., Meta, TikTok, YouTube/Google, X, LinkedIn, Pinterest) under that Platform's own terms and privacy policy.
• With infrastructure providers: hosting, database, and email-delivery providers that process data on our behalf under contractual confidentiality obligations.
• For legal reasons: where required to comply with law, enforce our Terms, or protect the rights, safety, or property of Recasten, our customers, or others.

We do not share connected-account tokens or published content with any third party for their own independent marketing purposes.

7. Data retention

Account and billing data is retained for as long as the account is active and as required for legal and accounting purposes thereafter. Media submitted for publishing is retained only as long as needed to complete delivery and short-term retry handling, and is deleted on a rolling basis afterward. OAuth tokens are retained until the connected account is disconnected by Customer, revoked by the end user through the Platform, or found invalid by the Platform.

8. Security

We use industry-standard safeguards, including encryption in transit, access controls limiting who can view credentials and content, and monitoring for unauthorized access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights and data deletion

Depending on your jurisdiction, you may have the right to access, correct, export, or delete personal data we hold about you, and to withdraw consent for a connected account at any time by disconnecting it. To exercise these rights or request deletion of your data, see our Data Deletion instructions or email [email protected].

10. Children's privacy

The Service is intended for use by businesses and developers and is not directed to individuals under the age of 16. We do not knowingly collect personal data from children.

11. International transfers

Data may be processed and stored in countries other than your own, including Thailand and countries where our infrastructure providers operate. Where required, we rely on appropriate safeguards for such transfers.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date.

13. Contact

Questions about this Privacy Policy or requests regarding your data can be sent to [email protected]. Full company details are listed in the site footer.