What this website collects about you

Last reviewed: 20 September 2026. This page covers ikonekt.com, the public website. The iKonekt service at app.ikonekt.com is a different thing with its own agreement and its own privacy terms — signing in there is not covered by this page.

Who is responsible

The controller of any personal data connected with this website is Castomo prosta spółka akcyjna, ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Poland; KRS 0001188843, NIP 8993033031.

You can reach us about anything on this page at hello@castomo.com.

What the website does not do

• No analytics from other companies. No Google Analytics, no Plausible, no Matomo. Visits are counted by Observer, the castomo family's own analytics, described under Analytics: Observer below.
• No scripts from other companies. Every page loads scripts only from this website and from two services run by Castomo: Observer (observer.castomo.com) and the chat button (chat.castomapi.com). The browser's own content security policy, declared on every page, refuses to load scripts from anywhere else. The only other addresses a page may even talk to are two more of castomo's own — app.ikonekt.com and accounts.castomo.com — and only the demo on the home page does, when you use it. You can verify this in your browser's developer tools; it is not a promise, it is a rule the browser enforces.
• No cookies. Neither this site nor the services it uses set any. See the cookie page, which is mostly about what we do instead.
• One form for your details, and it goes nowhere else. The access request is the only thing on this website that asks who you are, and it posts to this site and no other — the pages declare form-action 'self', so a form here cannot send your details to a third party even if something on the page tried. What happens to what you write is the next section. The demo on the home page asks for a place rather than for you, and has a section of its own.
• No embedded fonts, maps, videos or social widgets. The typeface is served from this website. Nothing here quietly tells another company that you visited.

The access-request form

If you fill in the access request, we receive what you typed: your first and last name, e-mail address, and — where you chose to give them — your company, telephone number, country and comment. Nothing else is added to it: no tracking identifier, no fingerprint, no idea of which pages you read before you got there.

We use it for one thing: to answer you about iKonekt. It is not added to a mailing list, not sold, not shared with anyone outside Castomo, and not used to profile you. The lawful basis is your request — taking steps at your request before entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in replying to business enquiries (Article 6(1)(f)) where no contract follows.

The message is delivered to our own internal operations console, which runs on the same EU infrastructure as the rest of the castomo services. A person reads it and replies; there is no automated decision-making of any kind.

We keep it for as long as the conversation is live and for up to 24 months afterwards, so that we can pick a thread back up when somebody writes again. Ask us to delete it and we will — either by saying so in the comment box or by writing to hello@castomo.com at any time afterwards.

The form keeps a short-lived note of the IP address it was submitted from, in a temporary file, purely to refuse a flood of automated submissions. It holds no name and nothing else, and it expires within fifteen minutes.

The demo on the home page

The box near the top of the home page counts the businesses around a place, and nothing is sent until you use it. When you do, the place you typed and the radius you chose go to castomapi-try, our own service at app.ikonekt.com/try, which asks our own places service for the count. No AI model is involved and nobody outside castomo is asked: the town is looked up, and the businesses counted, in castomo's own copies of public map data, on castomo's services in the European Union. Only totals, categories and a coarse grid come back — never a business's name.

The result is kept as a draft for 30 days, with any note you write on it, so that you can come back to it; after 30 days a draft nobody saved is deleted. It is opened by a key kept in your browser's local storage (see the next section), and nobody else can open it unless you share a link to it. Your internet address is used only to stop the demo being abused: castomapi-try holds it in memory for an hourly limit and never writes it down. The web server in front of the service keeps ordinary access logs, as every web server does.

If you keep the area, you sign in with a castomo account at accounts.castomo.com — this website never sees your password — and the draft moves into that account. From then on it belongs to the account rather than to this website: it can be opened in iKonekt at app.ikonekt.com, under that service's own terms, and it stays until the account is erased or you ask us to remove the draft.

The lawful basis is your request — you asked for the count and, if you keep it, for it to be kept (Article 6(1)(b) GDPR) — and our legitimate interest in keeping a public demo from being abused (Article 6(1)(f)).

Analytics: Observer

We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.

Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.

We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.

Chat assistant

Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.

When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.

The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.

We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.

What is stored in your browser

If you use the accessibility panel in the header, your choices are saved in your browser's local storage under four keys: ikk:theme, ikk:size, ikk:spacing and ikk:motion. They hold values like dark or large.

These never leave your device, are never sent to us or to anyone else, and are not readable by any other website. Clearing your browser's site data removes them, and the site works perfectly well without them — it simply forgets that you preferred the dark theme.

The demo on the home page keeps keys of its own there, all beginning ikk:try-, and only once you use it: the areas you counted, a sign-in that is under way, and — after you sign in — your castomo session. Unlike the four above, some of these do leave your device, only ever to castomo's own services and only when the demo needs them: the key that opens a draft you made goes to castomapi-try, and the sign-in values go to castomo accounts and castomapi-try. The cookie page lists each one, and clearing the site data removes them too.

Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.

What the server records

Serving a web page requires a server, and servers keep access logs. Our hosting provider records the usual technical entries — the IP address a request came from, the time, the page requested, the browser's user-agent string and the response status. This is ordinary operation of a website and is used for keeping the site running and secure, not for building a profile of anybody.

We do not combine those logs with anything else, we do not analyse them for marketing, and there is no identifier on this website that could connect a log entry to a person. The hosting provider acts as a processor on our behalf under a data-processing agreement. The lawful basis is our legitimate interest in operating and securing the website (Article 6(1)(f) GDPR).

The read-aloud button

The Listen button in the header uses the speech synthesiser built into your own browser and operating system. No text is sent anywhere; no service is called. If your device has no voice installed for the page's language, it will use the default voice and tell you so.

Your rights

Under the GDPR you may ask for access to your personal data, its rectification or erasure, restriction of processing, and you may object to processing based on legitimate interest. Where processing is automated and based on consent or a contract, you may ask for portability.

In practice, on this website, there is very little to exercise those rights against — the honest answer to "what do you hold about me?" is normally "an entry in a web server log" and, if you started one, a chat conversation. Write to hello@castomo.com and we will tell you exactly that, in writing, without making it difficult.

If you think we have handled your data badly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

Links to other websites

This site links to the other products in the castomo family and to a small number of external sites. Once you follow a link you are on someone else's website, under their policy. We have chosen the links; we do not control the pages at the other end of them.

Changes

If this page changes materially, the review date at the top changes with it. There is no mailing list to notify, because — see above — we do not have your e-mail address.