You describe an unreleased product to Cast in plain words. Sometimes you add the pitch deck, the pricing you have not announced, or the notes from a call you would not forward to anyone. Then a cast of AI users talks about it for an afternoon and you get a report. The question a serious buyer asks before any of that, and the question an IT or legal team asks again before a purchase, is simple: where does all of that go?
This note answers it from the code. Every claim below is true in the code that runs Cast, and where a line is a legal promise rather than a mechanism, we say so. One thing you will not find here is a list of the companies behind each part. We describe every component by its role and by what it guarantees, because a public map of a system's parts helps nobody but an attacker. The short version sits on the homepage under Trust and Data. This is the long one.
The path of a brief, from typing to report
Here is the journey, step by step.
- You type the brief, or upload a document. It is saved to your workspace in our database, where the people you invite can see it and nobody else can.
- The Casting Agent reads the brief and turns it into Ideal Customer Profiles (ICPs), the audiences your decision depends on. That is a model call, and it follows the data rule described below.
- Before anyone is cast, the ICP Researcher searches the web for public facts about those audiences and their market, so the people at the table are the right ones. It is the only part of Cast that touches the internet, and it never speaks in an interview. Its search queries are written by the model from the brief, so keep anything you would not type into a search box out of the brief. The last section says why that is usually easy.
- The cast is built, interviewed and checked, one model call at a time. Each AI user answers from its own record. None of them can look anything up.
- The findings, the report, the deck and the podcast are written and voiced by models under the same rule, then stored in your workspace next to the transcripts.
- It all stays there until you delete it, or until you delete your account.
One rule for every model: zero data retention, or no call
Cast runs on several large language models, each playing a separate role: the Casting Agent, the Director, the AI users, the Critic, the writers. Every one of those calls goes through a secure AI gateway, and every request carries the same three settings: data collection denied, zero data retention required, and no fallback to any other host. The gateway routes the call only to an endpoint that has committed to keep nothing after the reply. If no such endpoint exists for a model, the call fails. Cast does not quietly try somewhere else.
The list of allowed model and host pairs is written down in code, with the date each pair's zero-retention endpoint was last checked, and an automated test refuses any role configured outside that list. The same list covers the models that draw the portraits of your AI users, and the voices that read the podcast version of your report send the same policy on every request.
Two consequences are worth spelling out. First, there is no free model anywhere in Cast, not even as an emergency fallback. Free tiers tend to pay for themselves with your data, and the rule is that no model without a zero-retention endpoint is ever called, even if that means a study pauses. Second, if the gateway cannot serve a call under that policy, Cast stops and tells you it is busy rather than route your brief somewhere cheaper. We would rather be down than leaky.
“No free model and no model without a zero-data-retention endpoint, ever, including in an emergency.”
Never used for training
The settings above are what stops a provider from keeping your content. What stops us is simpler: we do not train models on it, and our Terms and Conditions say so in plain words. Customer content and outputs are not used to train AI models without your written consent, and our Privacy and Cookie Notice adds that the providers process your content under terms that prohibit training on it. Cast gets better by improving how it directs, checks and writes, not by learning from what you pasted.
Where it lives
Everything a study produces lives in one place: a managed cloud database with a private file store beside it, encrypted in transit and at rest, hosted with backups. A study belongs to a workspace, and the database enforces that boundary row by row, so a member of one workspace cannot read another's, and the public site cannot read any of it. Report files and portraits sit in that private storage, never on a public address.
There is one copy, not several. Cast does not mirror studies into an analytics tool, a search index or a training set.
Taking it out: export and delete
Your studies belong to you, and Settings has the buttons that prove it.
Download my data builds one ZIP file with everything Cast holds about you: your profile, the workspaces you belong to, every study in them with its interviews and chat turns, the report files, your token history and the feedback you sent. It is built on the spot from the database for the signed-in person only, so it is scoped to you by construction, and you can take a fresh copy whenever you need one.
Delete study removes a study from its menu, with its brief, transcripts and reports, and the files that went with them. There is no undo, which is why the dialog offers Archive instead.
Delete my account schedules the end of everything. It asks you to confirm by typing, and then a seven day cooling-off period starts: sign in and cancel in that time and nothing happens. After it, a scheduled job deletes the studies of the workspaces only you belonged to, those workspaces and their token ledgers, your photo, and finally the sign-in itself. If you are the only owner of a team that still has members, the deletion waits until you hand the team over, so a colleague's studies never vanish with your account.
What an AI user can and cannot know
AI users role-play. Each one is built from a member record: who they are, what they do, what they have tried, what they care about, and the research the ICP Researcher gathered about their market. When the Director asks a question, the AI user answers from that record and from what a language model can best guess about such a person. That is the whole source. The request that carries the question has no tools, no plugins and no web search, so an AI user cannot look up your company, read your competitors' pricing or find out who you are. If your brief does not say it, the AI user does not know it.
This is also what makes the findings explainable. The Critic reads every answer against the record and the transcript, and sends back anything invented or out of character. The four roles are instructed separately for the same reason: nobody grades their own homework.
The one role that does search is the ICP Researcher, and it runs before anyone is cast. It looks for public facts about a market and the people in it, and what it finds shapes who sits at the table, with the sources shown to you. It is never asked an interview question, and nothing it finds is sent anywhere but your study.
Questions an IT or legal team asks
Which third parties see our content?
Only the services that do the work, and we describe each one here by its role. The AI models that play Cast's roles, reached through a secure AI gateway that enforces zero data retention and no training on your content. The voices that read your podcast, under the same policy. A managed cloud database and private file store that hold your workspace, encrypted in transit and at rest. A transactional email service that sees your address and the emails we send you, and nothing from your studies. We do not publish their names, because a public list of a product's parts is a map for attackers. A full subprocessor list is available to customers on request.
Which security certifications do you hold?
We only ever claim certifications we hold, and we never put a badge where a mechanism should be. The services behind each component publish their own. What we can always show is the mechanism itself: the data rule in code, the allowlist with its check dates, and the tests that enforce them. Ask us and we will walk you through it.
How long do you keep our data?
Until you delete it. Deleting a study removes it at once. Deleting an account removes everything after the seven day cooling-off period. Our privacy notice describes the backup window beyond that.
Can we get a copy of everything?
Yes, as one ZIP from Settings, any time, with no ticket to raise.
Can we sign a data processing agreement?
Write to privacy@castofusers.com and we will take it from there.
Should we put customer data into a brief?
No, and you do not need to. Describe the segment, not the people. Your brief stays yours walks through a privacy-friendly brief line by line.
The safest data is the data you never put in. A brief that describes who your customers are, instead of listing them, loses nothing and keeps you a long way from the heaviest obligations.
We wrote the data rule before we wrote the product's second feature, because we knew the first question a buyer would ask. If you find a place where the product and this note disagree, tell us from the feedback box inside the app, and we will fix the product, not the note.
