Privacy policy

This explains what we collect when you use the site or the client platform, why, where it lives, who processes it for us, how long we keep it, and what you can ask us to do with it. It is written for the person who has to approve a vendor, not only for a lawyer.

Who we are and what this covers

The controller of your personal data is Recast UX, Amman, Jordan. This policy covers recastux.com, the client platform at /app, the forms on /pilot and /contact, the emails we send, and the calls booked through Cal.com. It does not cover your own product or the data of your users, which you control; where you give us access to that data to do a request, we act on your instructions under the terms of service and, if you ask, a data processing addendum.

What we collect

• Account data. Name, work email, company name, role, time zone, preferred language (English or Arabic), and a profile photo if you add one. Created when you sign up or are invited to an organisation.
• Billing data. Plan, billing cycle, subscription status, invoice history, the last four digits and brand of the payment method, and the PayPal subscription identifier. Card numbers are entered directly into PayPal and never reach our systems.
• Request content. The briefs, links, files, comments, versions and approvals in your board. This is the work, and it can contain anything you choose to put in it — including screenshots of your product and, sometimes, your users' data. Please redact what does not need to be there.
• Leads. What you type into the pilot or contact forms — name, email, company, product URL, your message and any file you attach — stored in our database and sent to us by email and Slack.
• Usage data. Pages viewed, actions in the dashboard, browser and device type, approximate location from your IP address, and the referring page, collected through PostHog and Vercel's server logs.
• Communications. Emails you send us, messages in a shared Slack channel, notes from calls, and recordings of usability sessions where participants have consented.

Why we use it, and on what basis

• To provide the service — running your account, working your requests, billing you, and notifying you about them. Basis: performance of the contract.
• To answer you — replying to a lead or a message, and scheduling a call. Basis: our legitimate interest in responding to people who write to us, and the steps you asked us to take before a contract.
• To improve the service — understanding which parts of the dashboard are used and where people get stuck. Basis: legitimate interest; analytics is configured without advertising identifiers and you can opt out below.
• To keep records — invoices and tax records for as long as the law requires. Basis: legal obligation.
• To protect the service — rate limiting, abuse detection, security logs. Basis: legitimate interest.

We do not sell personal data, we do not use it for advertising, and we do not send marketing email unless you have asked for it, in which case every message has an unsubscribe link that works on the first click.

Where your data lives

Account, billing, request and lead data is stored in a Firebase project on Google Cloud in a European region (Belgium, europe-west1). Files you upload are stored in Google Cloud Storage in the same project. The website and dashboard are served by Vercel from the edge location nearest to you; page requests are logged briefly in Vercel's infrastructure. Backups follow the same regions as the primary data.

Subprocessors

These companies process data for us. Each is bound by a data processing agreement, and we review the list when it changes and notify Enterprise customers before adding to it.

Payment data

When you subscribe, you enter your card or PayPal details on a PayPal-hosted component inside our checkout. PayPal processes the payment and tells us the outcome, a subscription identifier, and the brand and last four digits of the method. We store those so your billing page can show you what will be charged and to what. PayPal's own privacy statement governs what PayPal does with your data. Enterprise invoices paid by bank transfer are recorded in our accounting system with the payer's name and reference only.

Cookies and analytics

We set a session cookie when you log in, a cookie that remembers your billing-cycle preference on the pricing page, and PostHog's analytics cookie. There are no advertising or cross-site tracking cookies, and no third-party pixels. Because we do not use non-essential cookies for anything beyond analytics, we do not show a consent banner in every region; where the law requires it, we ask before loading PostHog. You can opt out of analytics at any time from Settings in the dashboard, or by enabling Global Privacy Control in your browser, which we honour.

How long we keep it

• Account and request data — for as long as your organisation has an account, and for 24 months after cancellation so that you can come back to your files. You can ask us to delete it sooner at any time.
• Invoices and payment records — seven years, as required for tax and accounting purposes in Jordan.
• Leads — twelve months from the last contact, then deleted unless you have become a client.
• Usage data — twelve months in PostHog, then aggregated. Server logs are kept for 30 days.
• Research recordings — deleted 90 days after the request they were made for is delivered, unless you ask us to keep them or delete them sooner.

Your rights

Wherever you are, you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to stop processing it for a particular purpose, and take your request content with you in native formats (Figma files, PDFs, exports). Write to hello@recastux.com; we respond within 30 days and usually much sooner, and we do not charge for it.

If you are in the UK or the European Economic Area, these rights are set out in the UK GDPR and the GDPR, and you can complain to your supervisory authority. If you are in Saudi Arabia, the Personal Data Protection Law applies and you may complain to SDAIA. If you are in Jordan, the Personal Data Protection Law of 2023 applies. We treat every request the same way regardless of where you are.

International transfers

Our team is in Jordan and accesses data stored in the European Union. Some subprocessors operate in the United States. Where data moves between jurisdictions, we rely on the subprocessor's standard contractual clauses or an equivalent mechanism, and on our own data processing agreement with them. Enterprise customers who need data to stay in a particular region can specify this in their MSA, and we will tell you honestly whether it is achievable before you sign.

Security

Access to your data is restricted to the people working on your account and is governed by database rules that are tested as part of every release. All traffic is encrypted in transit and data is encrypted at rest by Google Cloud. Logins support passwordless links and Google sign-in; passwords, where used, are hashed by Firebase Authentication and never visible to us. We keep an incident procedure and will tell you within 72 hours if we learn of a breach affecting your data, with what we know and what we are doing.

Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe we have, tell us and we will delete it.

Arabic support

You can write to us about any of this in Arabic and we will reply in Arabic. An Arabic version of this policy is available on request and will be published alongside the English one; if the two differ, the English version prevails until the translation has been legally reviewed.

Changes to this policy

We update this page when our practices or subprocessors change, and update the date at the top. If a change affects how we use data you have already given us, we email you before it takes effect.

Contact

Privacy questions and requests: hello@recastux.com, subject line “Privacy”. Recast UX, Amman, Jordan.