Privacy Policy
Effective 27 August 2026 · Version 1.0
1. Controller and contact
Casient is a product of Rundev Studio, operated by Damian Garcia Garcia (Tax ID 48003003W), Av. Verge de Montserrat 26, 43480 Vila-seca, Tarragona, Spain. We are the controller of the personal data described in this policy. Contact us at [email protected].
2. Data we process
We process account and workspace details, including name, email address, agency name and branding; authentication and security data, including hashed passwords, session information, IP address and security logs; billing information and subscription status; and support messages. Payment card details are processed by Stripe, not stored by Casient.
If you connect Google Search Console, we process the OAuth credentials needed to maintain that connection and the read-only data for the properties you select: clicks, impressions, click-through rate, average position, queries, pages (URLs), dates, the list of submitted sitemaps and associated property data. We do not request permission to modify your Google Search Console account.
When you ask the assistant for suggestions on an action, we fetch that one public page of your site to read its current title, meta description and headings. We do not crawl your site or access non-public pages.
If you additionally connect Google Analytics 4, we request separate read-only access (analytics.readonly) and process only aggregated, Organic Search reporting for the properties you map: session counts, key-event counts, revenue totals in the property's own currency, dates and landing pages. We use this aggregated data to prioritise and suggest actions, detect qualifying results and help you build case studies. We do not request edit or user-management permissions, and we do not process visitor-level data, audiences or advertising identifiers.
We also process the case-study text, client display name, milestones and metrics that you create or choose to publish.
3. Purposes and legal bases
We use this data to create and secure your account, provide the Service, connect and analyse the Google Search Console properties you authorise, generate and host case studies, process subscriptions, answer support requests and meet legal obligations. These activities are generally necessary to perform our contract with you, comply with law, or pursue our legitimate interests in operating and securing the Service. We use non-essential analytics and marketing technologies only with your consent; see our Cookie Policy.
4. Sharing and international transfers
We share data only with service providers needed to operate Casient: SW Hosting (hosting in Spain), Google (Google Search Console and, where consented, Google Analytics 4), Stripe (payments), Zoho Mail (email), GoDaddy (domain services), OpenAI (optional AI-assisted drafting and suggestions, which receive the page URL, its current title, description and headings, and the related search queries), and providers of marketing pixels that you accept through our consent tool. These providers act under their own terms or as our processors, as applicable. Some may process data outside the EEA; where required, we rely on an adequacy decision or appropriate safeguards such as standard contractual clauses. We do not sell personal data.
5. Publication and your responsibilities
A case study, result card or client report becomes reachable only when you choose to publish it or create its link, and stops being reachable when you revoke it. Anyone with its public URL may then access the information shown there. You are responsible for ensuring that you have a lawful basis and the necessary permissions to connect client properties, upload content, and publish personal data or client information through Casient.
6. Security measures
We use technical and organisational measures appropriate to the sensitivity of the data described in this policy. All traffic to Casient is encrypted in transit (HTTPS/TLS). OAuth access and refresh tokens for Google Search Console and Google Analytics 4, and other credentials, are encrypted at rest in our database and are never exposed in the application's user interface, logs or API responses. Access to production data is restricted to the personnel who need it to operate the Service, is logged, and is protected by authenticated, rate-limited endpoints. Payment card data is never handled or stored by Casient directly; it is processed by Stripe. We do not sell, rent, or use Google user data for advertising, and we do not allow humans to read Google API data except as strictly necessary for security purposes, to comply with law, with your consent, or as part of the specific, limited product features described in section 2.
7. Retention
We retain account and Service data while your account is active. After account deletion, we delete or anonymise it within 30 days, unless it must be retained longer for legal, accounting, fraud-prevention or dispute-resolution purposes. Encrypted backup copies may remain until overwritten in the ordinary backup cycle, for no longer than 90 days. Security logs are retained for up to 12 months. You can disconnect Google Search Console or delete imported data in Settings; disconnecting without deletion preserves historical data and published case studies.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent at any time by emailing [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency or your local supervisory authority.
9. Changes
We may update this policy when the Service or applicable law changes. We will post the new version here and, where required, notify you before it takes effect.