Privacy — Castoton chat assistant
Last updated: [26-August2026]
Who is responsible
Castoton (Tony Barratt), Amsterdam, the Netherlands, is the controller for personal data processed through the chat assistant at chat.castoton.com.
Contact: tony@castoton.com
What the assistant collects
When you use the chat assistant, the following is recorded:
- The messages you type and the assistant’s replies
- Your name and email address, but only if you choose to provide them
- A session identifier, generated in your browser when the page loads, used to group the messages in one conversation together. It is not stored on your device and is not reused across visits.
- Timestamps and technical usage counts (the size of each request sent to the AI model)
The assistant does not use cookies, does not store anything on your device, and does not track you across websites. Reloading the page starts a new conversation with no memory of the previous one.
You do not need to provide any personal data to use the assistant. Please don’t share confidential information, or personal data about other people, in the chat.
Why, and on what legal basis
- To run the assistant and answer your question — legitimate interest (Art. 6(1)(f) GDPR) in operating and improving the service.
- To follow up on your enquiry — if you provide your name and email, they are used to contact you about the problem you described. This is done on the basis of your consent (Art. 6(1)(a)) or steps taken at your request prior to entering a contract (Art. 6(1)(b)).
- To understand how the assistant is used and improve it — legitimate interest. Conversations may be read for this purpose.
Who else processes this data
The assistant is built on third-party services, each of which processes data on Castoton’s behalf:
| Service | Role | Location |
| Anthropic | Runs the Claude AI model that generates replies | United States |
| n8n Cloud | Orchestrates the conversation and stores it | EU / United States |
| Google (Workspace) | Stores conversation logs and sends lead notifications | EU / United States |
| Cloudflare | Serves the chat page and logs technical request data | Global |
Where data is transferred outside the European Economic Area, those transfers are covered by the European Commission’s Standard Contractual Clauses.
Anthropic does not use data submitted through its API to train its models.
How long it is kept
- Conversation logs: 90 days from the date of the conversation, then deleted.
- Contact details and enquiry summaries where you asked to be contacted: kept for as long as needed to respond and for 2 years afterwards, as a record of business correspondence.
You can ask for your conversation to be deleted sooner — see below.
Your rights
Under the GDPR you can ask to access, correct, delete, or receive a copy of your personal data, and object to or restrict its processing. Where processing is based on consent, you can withdraw that consent at any time.
To exercise any of these, email tony@castoton.com. Because conversations are identified by a session identifier rather than by you, please include the approximate date and time of the conversation and, if you gave one, the email address you used.
Castoton.com 