Last updated: August 19, 2026
When you submit a contact form on our website, we collect your name, email address, phone number, and any message you provide. We collect this information solely to respond to your inquiry and discuss our services.
When you sign up for our emails using the form in our website footer, we collect only the first name and email address you enter there. Section 3 explains exactly what we do with them.
When you take our ops audit quiz, we collect the answers you choose, and, at the contact step partway through, the name, email address and phone number you enter. Answers are saved as you go, so we hold the ones you have already given even if you stop before the last question.
Three things are recorded automatically while you use the quiz: your browser’s user agent string, the page that referred you to us, and any campaign tags (the utm parameters) on the link you arrived through. We use them to see which pages and campaigns bring people to the quiz and where people stop answering. Your browser also stores a quiz session ID in its local storage so you can close the tab and pick up where you left off. Clearing your browser storage removes it.
Our servers see your IP address on every request, as any web server does. We hold it in memory for up to a minute to rate limit form submissions and block floods of automated traffic. It is not saved alongside your submission, though Vercel, which hosts this website, may keep it briefly in standard server logs.
By providing your phone number, you consent to receive SMS text messages from Castalin related to your inquiry, our services, and scheduling. Message frequency varies. Message and data rates may apply.
To opt out of SMS communications at any time, reply STOP to any message. To ask for help, reply HELP. You may also email hello@castalin.com and ask to be taken off SMS. However you send the request, we treat it as effective the moment it reaches us and complete the removal within one business day. If a message still reaches you after that, write to the same address and we will put it right.
We do not share your phone number with third parties for their marketing purposes.
If you enter your first name and email address into the signup form in our website footer, we store that name and email address in our own database, hosted on Supabase. They are held in the same table as our contact form submissions and tagged with the source newsletter, which is how we tell the two apart. We do not ask for, and the form cannot collect, a phone number, so signing up for these emails never opts you into SMS. A notification carrying that name and email address also goes to our own private Slack channel, which is how we see that someone has signed up. Section 5 names every service that receives your information.
We use that name and email address only to send you occasional emails about operations work in home service and trade businesses. Nothing is sent on a fixed schedule. We do not add you to any other list, and we do not sell, rent, or share your email address.
We do not use a third-party email marketing platform for these emails, so there is no automated one-click unsubscribe link. To come off the list, reply to any email we send you, or write to hello@castalin.com, and we will delete your record from our database by hand.
We do not sell, trade, or rent your personal information. We do pass it to the services that run this website and that tell us a new inquiry has arrived, and these are all of them:
Each of these providers handles the data on our instructions and under its own terms. We may also disclose your information when the law requires it.
Your information is stored in a database hosted by Supabase, which holds a SOC 2 certification for its own platform. That certification is Supabase’s, not ours, and we do not claim it as our own. We take reasonable measures to protect your personal data from unauthorized access, disclosure, or destruction. No method of sending data over the internet is fully secure, so we cannot promise absolute security.
We keep contact form submissions, newsletter signups and quiz records for as long as we still have a reason to hold them, which is usually answering you and keeping a record of the work, or for as long as the law requires. Nothing is deleted on an automatic schedule, so in practice a record stays with us until you ask us to remove it. Email hello@castalin.com at any time and we will delete it by hand.
You have the right to know what personal information we hold about you and why, to have it corrected, to have it deleted, to opt out of any sale or sharing of it, and to limit the use of sensitive personal information. We will not treat you any differently for exercising any of them.
Under the California Consumer Privacy Act, these are the categories of personal information we have collected in the past twelve months, and why:
We do not collect sensitive personal information as the CCPA defines it, so there is no use of it to limit, and we do not knowingly collect anything from anyone under 16.
To make a request, email hello@castalin.com from the address you gave us, or tell us which address you used so we can match it to your record. Matching that address is how we verify the request is yours, and we will not ask you for more information than we need to do it. We respond within 30 days, and in every case within the 45 days the CCPA allows.
We set no cookies of our own. The only cookies this website can place are the Google Analytics first-party cookies described below, and only where a measurement ID has been configured. The one other thing we store in your browser is the quiz session ID covered in section 1, which is held in local storage rather than in a cookie. You can instruct your browser to refuse all cookies or to tell you when a cookie is being sent, and clearing your browser storage removes the quiz session ID.
We use Vercel Web Analytics, which is cookieless. It records page views, the referring site, approximate country-level location, and device or browser type. It does not set cookies, does not fingerprint your device, and does not build a profile of you across other websites. Where a Google Analytics measurement ID has been configured, we also load Google Analytics 4 on our production website only, which sets first-party cookies to measure page views and on-page actions such as clicking a call-to-action or submitting a form. Information you type into our contact form, our footer email signup form, or our audit quiz is stored in our own database, hosted on Supabase, and is never sent to an analytics provider. Some of it does reach our private Slack channel as a notification, exactly as section 5 sets out.
We honor the Global Privacy Control (GPC) signal. If your browser or an extension sends a GPC signal, we do not initialize Google Analytics, set no analytics cookies, and record no Google Analytics events for your visit. Vercel Web Analytics stays active, because it is cookieless, does not identify you or fingerprint your device, and is never used for advertising or shared with third parties. We do not sell or share your personal information as those terms are defined by the California Consumer Privacy Act (CCPA/CPRA), and we do not use your information for cross-context behavioral advertising, so no “Do Not Sell or Share My Personal Information” link is required. California residents may still exercise their rights to know, correct, delete, or opt out by emailing hello@castalin.com, and we will not discriminate against you for doing so.
We may update this Privacy Policy periodically. Changes will be posted on this page with an updated date. Continued use of our website after changes constitutes acceptance of the updated policy.
For questions about this Privacy Policy or to exercise your data rights: