Privacy Policy

Who this policy covers

Castillo Developments provides custom software and application development services through castillodevelopments.com. This policy covers our website, request process, and client portal. Applications we build for customers may have their own privacy policies and data practices.

For privacy questions or requests, contact ecastle612@gmail.com.

Information we collect and why

• Contact and project information. Your name, email, business details, requested features, design and color preferences, uploaded branding, clarification answers, and project messages help us assess feasibility, prepare an offer, and deliver the agreed work.
• Account information. Sign-in identity and invitation records let us verify who you are and restrict access to the correct client project.
• Commercial records. Offers, agreements, signature status, approvals, invoices, payment status, and payment-provider references support contracts, billing, and project administration. Card details are entered through Stripe; our application does not store your full card number or security code.
• Technical and security information. Hosting and authentication services process information such as IP addresses, browser details, request logs, and session records to deliver the website, diagnose errors, and prevent misuse.

Please provide only information needed for your request. Do not put passwords, API keys, card details, or sensitive personal records in project descriptions or logo uploads.

Google sign-in

When you choose Google sign-in, Google shares basic profile information, such as your name, email address, profile image, and Google account identifier, with our authentication service, Supabase. We use your verified identity to establish a session and check your invitation and project access. Signing in alone does not activate a client account.

Castillo requests basic sign-in information only. This sign-in does not request access to your Gmail messages, Google Drive files, contacts, or calendar. We do not use Google sign-in data for advertising or sell it.

You can remove Castillo's Google connection in your Google Account connections. Revoking that connection may prevent future sign-in; it does not automatically delete existing project or contractual records. Contact us to request deletion.

Service providers and sharing

We use providers to operate the service: Supabase for authentication, databases, and file storage; Vercel for hosting; Stripe for payments; SignWell for electronic agreements; Resend for service emails; GitHub for source code and development records; and OpenAI for approved AI-assisted work. A provider receives the information needed for its role, such as signing details for SignWell or an email address and message for Resend.

Authorized Castillo personnel may access information to review and fulfill your request, support your project, and handle billing or security. We may also disclose relevant information when required by law or necessary to address fraud, security incidents, or legal claims. Providers may process information in countries other than yours, under their own applicable terms and privacy policies.

AI-assisted development and saved work

Castillo uses automated review aids and may use OpenAI to prepare source-code drafts after Owner approval. The connected builder sends selected work-package instructions, acceptance criteria, and constraints. It does not automatically send your entire client record, uploaded documents, billing records, or Google sign-in profile. Information you include in the selected requirements may be processed by the AI provider.

AI output requires review before publication. Project requirements, decisions, drafts, and verification evidence are saved for continued work. Reusable patterns require Owner review and removal of customer-specific data before approval. This saved-work library is not a claim that an AI model is trained on your project.

Cookies and browser storage

We use cookies for authentication, session security, and invitation handling. Your light, dark, or system theme preference is saved in browser storage. Blocking essential cookies can prevent sign-in or invitation access. You can clear cookies and local storage using your browser settings.

Storage, protection, and retention

We use access controls, private file storage, and project-specific authorization to protect client information. No online service can guarantee absolute security.

We retain information to operate your account, fulfill agreed work, and maintain necessary business records. Applicable suspended or cancelled project/application data has a guaranteed retention period of 90 calendar days before it becomes eligible for permanent deletion; archival retention may be longer. Accounting, contracts, payments, security, disputes, fraud prevention, and legal obligations may require longer retention. This is not a promise to erase all records on day 90. Restoration is not guaranteed after permanent deletion.

Your choices and requests

You may contact ecastle612@gmail.com to request access, correction, export, or deletion of your information, or to ask about its use. Depending on your location, applicable law may provide additional rights. We verify identity before disclosing or changing private records and explain any information that must be retained for contractual, security, or legal reasons.

This service is intended for business customers, not children. If you believe a child has submitted personal information, contact us so we can review it.

Policy updates

We will publish updates on this page with a revised date. Material changes will be communicated where required. Your signed project agreement continues to govern project-specific obligations.