CAST Privacy Policy
Effective October 20, 2026 · Last updated October 27, 2026
This policy explains what personal information CAST collects, why, who can see it, how long we keep it, and your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
CAST is about events in the Philippines, but you can use it from anywhere: Filipinos abroad, and anyone planning or attending an event here. If you live outside the Philippines, section 10 also explains the rights your own country's laws may give you.
1. Who we are
CAST is operated by CAST Events Organizing Services, a sole proprietorship registered with the Department of Trade and Industry (DTI), Philippines ("CAST", "we", "us"). We are the personal information controller for the information described here.
This policy covers:
- our websites, including casteventplanning.com, app.casteventplanning.com (the CAST web app) and go.casteventplanning.com (card pages, credential checks, RSVP pages and links)
- the CAST app for iOS and Android
- the CAST Cue app for accredited CAST partners
- CAST Expo registration, Expo Passes, check-in, booth leads, raffles and draws
- inquiries, consultations and event services you arrange with us
Privacy questions? Contact our Data Protection Officer at privacy@casteventplanning.com.
2. The short version
- We collect what you give us to plan and run events, and basic app usage data to keep the apps working.
- When you contact, book or share your details with a CAST partner, that partner sees what you sent them. That's the point of the platform, and we tell you when it happens.
- We don't sell your personal information, and we don't use it for advertising across other apps or websites.
- You can see, correct or delete your information, and delete your account in the app.
3. What we collect
| What | Examples | When |
|---|---|---|
| Account details | Name, email, mobile number, password (stored securely by our sign-in provider, never visible to us) | When you create a CAST or partner account |
| Event details | Event type, date, venue, guest count, budget items, tasks, milestones, notes, mood board photos, seating and floor plans | When you plan an event in CAST |
| Guest lists | Guests' names, groups, mobile or email if you add them, RSVP answers | When you add guests or a guest answers an RSVP link |
| Invitation content | What hosts add to a digital invitation or Save the Date: names, event date and venue, programme, entourage and sponsors, attire, gift details and photos | When hosts set up an Event Upgrade |
| Gallery photos | Photos guests upload to an event's gallery and the name they type with them | When a guest adds photos to a gallery |
| Event Upgrade orders | The account and event an upgrade is for, what was bought, the amount, payment status and time, the payment method type reported by Xendit, and the sales invoice number | When you buy an Event Upgrade on our website |
| Inquiries and bookings | Messages to partners, inquiry details, contracts, inclusions and add-ons, meeting schedules | When you contact or book a partner |
| Payment records | Amount, method, reference number and receipt photo of a payment made outside CAST | When you or a partner record a payment |
| Reviews and community posts | Verified reviews and partner replies; CAST Circle posts, comments, reactions and reports | When you post them |
| Partner applications and profiles | Business name, category, address, contact person, business email and mobile, website and social links, registration number, Tax Identification Number (TIN) if you choose to give it, years in business, photos and logos, business documents | When a vendor or venue applies for accreditation or manages their profile |
| Partner payout details | Account name, bank or e-wallet account or mobile number, payment QR code | When a partner adds them so clients know where to pay |
| Expo | Full name, email, phone, registration type, Expo Pass, check-in time, raffle and draw entries | When you register for or attend a CAST Expo |
| CAST Cue leads | Name, mobile, email, event type and date, where you met, notes | When you send your details from a partner's card, or a partner scans or saves your contact |
| App and device data | App version, device model, operating system, an app identifier, crash reports, feature usage, push notification tokens | Automatically, when you use the apps |
| Website data | IP address, browser and pages visited (see section 11) | Automatically, when you visit our websites |
We don't ask for sensitive information such as health, religion, political views or government ID numbers, apart from a partner's optional TIN (see section 6). Please don't put that kind of information in notes, guest lists or posts.
4. Why we use it
| Purpose | Legal basis under the Data Privacy Act |
|---|---|
| To run your account and the features you use: planning, guest lists, bookings, messages, Expo passes, cards and leads, and Event Upgrades you buy, including activating them, issuing sales invoices and handling refunds | To provide the service you asked for (contract) |
| To connect clients with accredited partners, and partners with Expo visitors who chose to share | Your consent, given when you send or share your details |
| To review and verify partner accreditation, and to let anyone check a partner's credential | Contract with the partner, and our legitimate interest in a trusted directory |
| To send account emails, booking and payment notices, reminders and push notifications | Contract |
| To keep CAST safe: preventing fraud, misuse and spam, and moderating CAST Circle | Legitimate interest |
| To fix problems and improve the apps, using usage and crash data | Legitimate interest |
| To keep records required by law, such as tax records and DTI raffle permits | Legal obligation |
| To send news and promotions | Your consent, which you can withdraw at any time |
If you're in the European Union, the European Economic Area, the United Kingdom or Switzerland, these are also our legal bases under the GDPR: contract, consent, legitimate interests and legal obligation.
5. Who can see your information
Other CAST users, when you choose to share. CAST connects clients, partners, guests and Expo visitors, so some information is meant to be seen by others:
| Who | What they see | When |
|---|---|---|
| A partner you contact or book | Your name, contact details, the event details you share, your messages, the booking, its payment records and meetings | When you send an inquiry, book them or message them |
| Partners booked for your event | Your event's mood board and event-day schedule, and guest counts (never guests' names) | While their booking is active |
| A partner whose card you use | The name, mobile, email, event details and note you send | When you tap "Send my details" on their card page and agree |
| Co-hosts you invite | Your event, with view or manage access as you choose | Until you remove them |
| Your guests | Their invite, the hosts' names and your message; with an Event Upgrade, the invitation's design and details. Each guest sees only their own invite, answer and table (when you choose to show tables). Guests with a gallery link see the event's gallery photos | When they open their RSVP link |
| Event hosts | Their guests' RSVP answers | When a guest answers |
| Expo exhibitors | Your name and email, and they can message you in CAST | Only if you turn on "Let exhibitors scan my pass" and they scan it |
| Expo organizers and their team | Your registration, Expo Pass and check-in | When you register for their Expo |
| Anyone | Partner profiles, a partner's credential status, verified reviews with the reviewer's first name and last initial, and Expo raffle and draw winners shown as first name and last initial | Public |
| CAST Circle members | Your Circle posts and comments | When you post |
Partners see totals of how many people viewed or saved their profile, never who.
Partners who receive your details use them to follow up about your event. Each partner is an independent business, responsible for how they handle your details under the Data Privacy Act and the CAST Partner Terms.
Our service providers, who handle information only to run CAST for us:
| Provider | What for | Their policy |
|---|---|---|
| Google Firebase | Database, sign-in, file storage, servers, website hosting, app analytics, crash reports, push notifications | policies.google.com/privacy |
| Mailbux | Email hosting for casteventplanning.com, including sending CAST emails from notifications@casteventplanning.com | Privacy Policy at mailbux.com |
| Forms Designer Pro | Our website inquiry form: stores your answers and emails them to CAST | formdesigner.pro/privacy-policy.html |
| Apple | Push notifications, Live Activities and Apple Wallet passes on iPhone | apple.com/legal/privacy |
| Push notifications and Google Wallet passes on Android, and Google Fonts on our websites | policies.google.com/privacy | |
| Xendit | Payments for Event Upgrades on our website, and payment links we email to clients abroad. You enter your payment details on Xendit's page; we never see or store your card or e-wallet details. | xendit.co/en/privacy-policy |
When the law requires it. We may share information with courts, regulators or law enforcement when required by law, or to protect our rights or someone's safety.
If CAST changes hands. If the CAST business is sold or transferred, your information may transfer with it, and this policy continues to apply.
We never sell your personal information.
6. Partners' Tax Identification Numbers
A TIN is sensitive personal information under the Data Privacy Act. Giving a TIN is optional. If a partner gives it, we use it only to verify their business for accreditation. Only CAST staff who review applications can see it; it is never shown on profiles, cards or to other users.
7. Where your information is stored
CAST runs on Google Cloud through Firebase. Our database is stored in Singapore, and our servers run in Singapore and the United States. Our service providers may also process information in other countries, including Ukraine for our website inquiry form. Wherever it is processed, we protect it as this policy describes and as the Data Privacy Act requires.
If you use CAST from another country, your information is sent to and stored in these countries. When information moves between countries, we rely on our providers' legal safeguards for international transfers, such as the standard contractual clauses that Google uses for Google Cloud and Firebase.
8. How long we keep it
| Information | How long |
|---|---|
| Your account and the events, guests and posts in it | Until you delete your account, then deleted within 30 days |
| Bookings, messages and payment records | 5 years after the event (messages: 5 years after the last message) |
| CAST Cue leads | Until the partner deletes them or their account, and at most 2 years after the lead was last updated |
| Expo registrations, check-ins and booth leads | 2 years after the Expo |
| Raffle records | As long as the DTI permit rules require |
| Accreditation applications, documents and TINs | While the partner is accredited, then 2 years after accreditation ends or an application is declined |
| App analytics and crash reports | As set by Google Firebase (analytics up to 14 months; crash reports up to 90 days) |
| Invitation content and gallery photos | 6 months after the event date. Hosts are reminded to download photos 1 month and 1 week before |
| Event Upgrade orders and sales invoice records | As long as tax and accounting rules require |
| Backups | Up to 30 days after deletion |
We may keep information longer when the law requires it, or to resolve a dispute.
9. How we protect it
- All connections to CAST are encrypted.
- Security rules on our database limit each person to the information they're allowed to see.
- Passwords are handled by our sign-in provider; we never see them.
- Only CAST staff who need it for their work can see account or partner information.
- If a breach puts your information at risk, we will notify you and the National Privacy Commission as the Data Privacy Act requires.
No system is perfectly secure, so please use a strong password and keep it to yourself.
10. Your rights
Under the Data Privacy Act, you have the right to:
- be informed about how your information is used, which is what this policy is for
- access the information we hold about you
- correct information that is wrong or out of date
- object to how we use it, and withdraw consent you gave
- have it deleted or blocked when it's no longer needed or was used unlawfully
- get a copy in a common electronic format (data portability)
- be compensated for damage caused by misuse of your information
- complain to the National Privacy Commission at privacy.gov.ph
If you live outside the Philippines, you have all the rights above, and your local law may give you more:
- European Union, EEA, United Kingdom and Switzerland (GDPR): you can also ask us to restrict how we use your information while a request or objection is being checked, and you can complain to the data protection authority in the country where you live or work.
- United States, including California: you can ask what personal information we collect, use and disclose, and ask us to correct or delete it. We don't sell your personal information or share it for targeted advertising, and we won't treat you differently for using your rights.
- Anywhere else: you have the rights your local privacy law gives you. Email us and we'll help.
To use any of these rights, email privacy@casteventplanning.com. We may ask you to confirm your identity first. We reply within 30 days.
Deleting your account: in the CAST app, go to Account → Client Center and tap Delete Account, or see Delete Your CAST Account. Information you shared with partners before deleting stays with them as their own records, under their responsibility. Verified reviews you wrote stay on the partner's profile, shown as "Verified CAST client" instead of your name.
11. Analytics, cookies and forms
In the apps: CAST and CAST Cue use Google Firebase Analytics to see which features are used, and Firebase Crashlytics to receive crash reports. This data includes the app version, device model, operating system, an app identifier and usage events. It isn't used for advertising or to track you across other apps or websites.
On our websites: we don't use advertising or analytics cookies, and no tracking pixels. The websites save two small settings in your browser: whether to show motion effects, and whether you closed the Google Play banner. Text fonts load from Google Fonts, which receives your IP address to send them. You can clear these settings in your browser at any time.
Our inquiry form at forms.casteventplanning.com emails the details you enter (such as your name, contact details, event date, guest count and budget) to CAST, so we can reply to your inquiry. The form service, FormDesigner, also keeps a copy while CAST uses it.
12. Age
CAST is for people aged 18 and over. We don't knowingly collect information from anyone younger. If you believe a minor has given us their information, contact us and we will delete it.
Guest lists may include children's names added by event hosts. Hosts should add only what's needed for their event.
13. Changes to this policy
We will post any changes on this page and update the date at the top. For significant changes, we will also tell you by email or in the app before they apply.
14. Contact us
Data Protection Officer, CAST Events Organizing Services · privacy@casteventplanning.com