Privacy policy · Kastoo

This is a translation for your convenience. The Spanish version is the legally binding one: read it in Spanish.

In short: Kastoo is a player. It shows no advertising and does not sell or share your data. We only process what is essential for your lists and preferences to reach your devices and to manage your licence. Payments are processed by Stripe or, if you installed the app from Google Play, by Google. Visits to the website are counted anonymously on our own server and, only if you accept it in the cookie notice, also with Google Analytics.

This policy complies with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). It applies to this website and to the Kastoo application in all its versions: Smart TV, Android (including the Google Play version), iPhone and iPad (including the App Store version) and the browser extension for Chrome and Edge.

1. Data controller

Antonio Lozano Hernández, tax ID (NIF) 71205045N, with address at Calle Gregorio Marañón, 23, 47195 Arroyo de la Encomienda (Valladolid). Contact for any privacy matter: contacto@kastoo.es. Given its size and activity, the controller is not required to appoint a data protection officer.

2. What data we process, why and on what legal basis

Data	Purpose	Legal basis (GDPR)
Device identifier and key: an identifier in MAC format and a 6-digit key generated by the app (on some TVs it is the device's real MAC).	So that you can add lists from the website and to protect your data on the server.	Performance of the service you request (art. 6.1.b).
Your lists: M3U addresses or access details (server, username and password) from your provider.	Sending them to your app and, if you press “Check”, asking your provider for the status of your subscription.	Performance of the service (art. 6.1.b).
Preferences backup: profiles, favourites, watched content, progress and channel organisation.	Not losing them when you reinstall and sharing them between your devices.	Performance of the service (art. 6.1.b).
Commands between devices: the channel or video you send from your phone to the TV.	So that the TV plays it. They are discarded after a few minutes.	Performance of the service (art. 6.1.b).
Licence and purchase: trial start, licence code, associated devices, plan, amount, date, email address given when paying and the date on which you accepted immediate activation.	Managing your licence, sending you the purchase confirmation, assisting you and proving your consent.	Performance of the contract (art. 6.1.b).
Google Play purchases (Google Play version only): product purchased, order identifier, date and payment status reported to us by Google, and an encrypted, irreversible digest of the device identifier that we send to Google to link the purchase to your device.	Checking with Google that the payment is valid, activating your licence and withdrawing it if the payment is refunded or cancelled.	Performance of the contract (art. 6.1.b).
The same purchase data.	Complying with tax and accounting obligations (invoicing and record keeping).	Legal obligation (art. 6.1.c).
Device fingerprint (Android only): an encrypted, irreversible digest of the identifier that Android assigns to the app.	Preventing the free trial from restarting when reinstalling, as a security measure of the licensing system.	Legitimate interest in preventing fraud (art. 6.1.f). You can object by writing to us.
Connection data: the device identifier, the platform (Android, iPhone, LG, Samsung, browser), the app version and the dates and times when the app connects to the server (when it was open and for how long).	Knowing how many devices use Kastoo and which ones are in use, to maintain the service and give you support. It does not include what you watch.	Legitimate interest in running and improving the service (art. 6.1.f). You can object by writing to us.
Website statistics (kastoo.es only, not the app): the page you visit, the site you come from (only its domain, for example google.com), the type of device and screen, the operating system and the browser language. To count unique visitors, the server instantly calculates an encrypted, irreversible digest of your IP address and browser using a key that changes every day. The IP address is not stored and the key is deleted at the end of the day, so afterwards nobody can tell who you were.	Knowing how many people visit the website, which pages help them and where they come from, in order to improve it. Only anonymous totals are kept. No cookies are used, nothing is stored on your device and nothing is shared with anyone.	Legitimate interest in understanding and improving the use of the website (art. 6.1.f). If your browser has "Do Not Track" or Global Privacy Control enabled, your visit is not counted. You can also object by writing to us.
Use of the website's help assistant: which topic is looked up and whether the answer helped, without what you type (that never leaves your browser).	Knowing which guides are missing or need improving. Only anonymous daily totals are kept.	Legitimate interest (Art. 6(1)(f)). Nothing is recorded if your browser sends «Do Not Track».
Provider form: name, company or service, email, website, countries and message.	Replying to your request and, if we reach an agreement, managing the coupon. Kept while the conversation or collaboration lasts and for 2 years afterwards at most.	Pre-contractual steps at your request (Art. 6(1)(b)).
Availability alert (only if you ask for it on the website): your email address, the platform you're interested in (for example, Samsung Smart TV), the language and the dates you signed up and confirmed.	Sending you a single email when Kastoo is available on that platform. Before that we send you another one so you can confirm the address is yours.	Consent (Art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in the emails or by writing to us.
Google Analytics (kastoo.es only, not the app, and only if you accept it): random identifiers stored in cookies, the pages you visit, where you come from, your type of device and browser, and your approximate city or region (Google works it out from your IP address, which it does not store). We never send your MAC, your lists or your email, and Mi Kastoo and the admin panel do not load it.	Understanding how the website is used and where visits come from, so we can improve it. No advertising: Google signals and ad personalisation are turned off.	Your consent (art. 6.1.a), which you can withdraw at any time from “Cookie settings” at the bottom of every page.

We do not process your name, your location, your contacts or what content you watch (the watch history is only on your device and in your backup). We do not make automated decisions with legal effects or create profiles, and we do not use your data for advertising.

Browser extension (Chrome and Edge)

The extension is the same app inside a tab of your browser and processes the same data described above. Your settings, lists and favourites are saved in the extension's own storage on your computer. The permission to access any website is used only to download the lists, the guide and the channels from your provider's server, which may be at any address. The extension does not read or modify the pages you visit, does not access your history or your bookmarks and does not send any data about your browsing to anyone.

App for iPhone and iPad

Your settings, lists, favourites and the copy of downloaded lists are stored in the app's private area on your device and are not included in your iCloud backup. For some video formats the app uses VLCKit, VideoLAN's playback library, which runs on your device and sends no data to anyone. If you use AirPlay, the video is sent directly to your Apple TV or TV. The app does not use cross-app tracking or the advertising identifier.

3. Who data are disclosed to

Hostinger International Ltd. (Cyprus, EU), which hosts the website and the server, as data processor under the corresponding contract.
Stripe Payments Europe, Ltd. (Ireland), which processes payments and directly receives your card, Apple Pay, Google Pay, PayPal or Bizum details, as an independent controller of that processing according to its privacy policy. Kastoo never sees or stores those details.
Google Ireland Limited (Ireland), only if you buy from the Google Play version: Google processes the payment, issues the receipt and handles refunds as an independent controller according to its privacy policy. Kastoo does not see your payment details.
Apple Distribution International Ltd. (Ireland), only if you buy from the App Store version: Apple processes the payment, issues the receipt and handles refunds as an independent controller according to its privacy policy. We receive the purchase signed by Apple (product, identifier, date and an encrypted, irreversible digest of the device identifier) to activate your licence. Kastoo never sees your payment details.
Tax authorities and other authorities, when required by law.
Google Ireland Limited (Ireland), as processor for Google Analytics, only if you accept analytics cookies, under Google’s data processing terms.

In addition, due to the way the app works, which you control: your list provider (the app connects to its server to download and play), the Chromecasts or TVs on your network to which you send something (they receive the video address) and, only if you add your key in Settings, TMDB (it receives the title of the content to look up cover art).

Home trends: our server asks TMDB (The Movie Database) for the week's most-watched movies and series, without sending any of your data, and the app compares that list with yours on your device. The posters and images of those trends are loaded from TMDB's servers (image.tmdb.org), which, like any image server, receive the IP address of your connection. More information in TMDB's privacy policy.

4. International transfers

Stripe, Google and Apple may process data in the United States through their groups. These transfers are covered by the EU-U.S. Data Privacy Framework and by the standard contractual clauses approved by the European Commission. TMDB is based in the United States; your device connects to its servers only to download the images of the trends. We make no other transfers outside the European Economic Area. The same applies to Google Analytics, if you accept it.

5. How long we keep data

Lists and preferences backup: for as long as you use Kastoo. You can delete your lists from the website or ask us to delete everything.
Licence and purchases: while the licence is valid and afterwards, blocked, for the legal periods: 4 years for tax purposes (Spanish General Tax Law) and up to 6 years for commercial purposes (article 30 of the Spanish Commercial Code).
Commands between devices: a few minutes.
Device fingerprint and trial start: for as long as they are needed to prevent the trial from being restarted.
Connection data: the connection history is kept for 90 days; the rest is deleted after 12 months without connecting.
Website statistics: the digest used to count visitors is deleted at the end of each day; after that only anonymous totals remain, which are no longer personal data.
Availability alert: until we send you the alert (it is deleted at that moment) or you unsubscribe. If you don't confirm the email, it is deleted after 30 days.
Backups: 30 days at most.
Google Analytics: 14 months; Google then deletes the data.

6. Security

Data on the server can only be read or changed with your device's identifier and key, travel encrypted (HTTPS) and are stored outside the public part of the website. We apply attempt limits to prevent unauthorised access. We make encrypted daily backups of the server data so it can be recovered after a failure; only we can open them.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to contacto@kastoo.es and stating your device's MAC (to verify that the data are yours we may ask you for the key shown by the app). We will reply within one month. If you consider that your rights have not been respected, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es).

8. Minors

Kastoo is not aimed at children under 14, who must not provide any data (article 7 of the LOPDGDD). Purchases are reserved for adults. The app's kids profiles only serve to hide content within it.

9. Cookies

This website uses essential technical storage and, only if you accept them, Google Analytics cookies. You can change your choice at any time from “Cookie settings” at the bottom of every page. More information in the cookie policy.

10. Changes

If this policy changes, it will be published here with its new date and, if the change is significant, we will let you know.