ScanPostbyCastTechCastTech

CastTech Inc. · United States

Privacy Policy

Effective October 11, 2026 · Version 2026-10-12-plans

This policy describes how CastTech Inc., a Delaware corporation, handles personal information in ScanPost by CastTech (“ScanPost”). It covers our website, customer accounts, billing and package-management service. Contact us at hello@cast.tech.

1. Our role and your property’s role

For business contacts, website security, account administration and billing, CastTech determines how information is used. For guest, reservation and package records uploaded by a hotel, condominium or property operator, we generally process information on that operator’s instructions. The operator is responsible for its guest notices, lawful collection and use, and authorised staff access. Guests should first contact the property handling their package; we assist the property with requests.

2. Information we handle

3. Why we use information

We use this information to provide scanning and package records, match packages to reservations, manage users, support customers, operate billing, prevent abuse, investigate problems and comply with legal obligations. Staff must review extracted and matched details before relying on them. We do not sell personal information or share it for cross-context behavioural advertising, and the current service does not use advertising trackers.

4. Providers and integrations

We use hosting, database, backup and security providers to operate ScanPost. TypeSafe assists with interpreting extracted shipping-label text; this can include names, addresses, sender details and property destination information. Current label interpretation sends extracted text and layout information, rather than the image or your reservation database. See TypeSafe’s privacy information.

Stripe processes payments and subscriptions under Stripe’s Privacy Policy. If your property connects a reservation platform, ScanPost reads authorised reservation information and sends package updates according to your settings. Connecting an integration may require us to hold protected credentials or browser-session data. Pausing an integration alone does not delete its saved credentials; contact us to remove them.

We may also disclose information where required by law, to protect people or the service, to professional advisers under appropriate duties, or in a business transfer with applicable privacy safeguards. We provide only information relevant to the purpose. Contact us for current provider and processing-location information or to arrange a data-processing agreement.

5. Retention and deletion

Package, reservation and account records are retained to operate the customer’s account and maintain its delivery history. Package and reservation history does not automatically expire after a fixed number of days. Short-lived security tokens and rate counters expire automatically. Scan timing and transactional email delivery records are kept for up to 30 days; sent or permanently failed email bodies are removed from the delivery queue. Encrypted off-server database backups are kept for up to 14 days. Customers should request their required retention schedule or account deletion by emailing hello@cast.tech. We assess deletion requests with the property operator and applicable recordkeeping requirements; billing, consent, fraud-prevention and legal records may need to be retained longer. Deleted information may remain in backup copies until those copies expire or are replaced. We do not promise immediate deletion from every backup.

6. Security

We use measures including authenticated access, staff roles, separation of organisation records, password hashing and HTTPS for service traffic. Security controls reduce risk but cannot guarantee that information will never be accessed, lost or misused. Customers must keep credentials private, remove access when staff leave and use only authorised integrations. Report suspected security incidents to hello@cast.tech.

7. Cookies and browser storage

Essential cookies and local storage keep your session and interface working. These are not advertising cookies. Camera and location access depend on your device permissions, which you can change in browser settings. Blocking essential storage can prevent sign-in or scanning from working.

8. Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete or receive a copy of personal information, or to restrict or object to certain uses. Email hello@cast.tech with your request and the relevant property. We may need to verify identity and authority without collecting unnecessary information. Where the property controls the record, we will direct the request to or work with it. You may contact your relevant privacy regulator. No rights available under applicable law are limited by this policy.

Administrators can export package records and organisation data, manage staff access, and submit verified data requests through Account security. For account closure, deletion requests or privacy complaints, email hello@cast.tech. Do not send passwords, payment card details or identity documents by ordinary email.

9. Geography and children

ScanPost is offered to businesses in the United States. Information may be handled by service providers in other jurisdictions; do not assume every provider or backup is located in the same place as your property. ScanPost is not directed at children under 13. Staff should not knowingly create child accounts or add unnecessary sensitive information to labels or notes.

10. Updates and contact

We will post policy updates here with a new effective date and provide additional notice when required for material changes. CastTech Inc.’s Delaware registered office is 131 Continental Dr, Suite 305, Newark, DE 19713, United States. This is our registered office, not a package drop-off location. For privacy or service enquiries, contact hello@cast.tech.