Privacy Policy

This Privacy Policy explains how ClickCarousel ("ClickCarousel", "we", "us") collects, uses and protects personal data when you use our website and application (the "Service").

1. Who we are

ClickCarousel provides tools to create, schedule and publish LinkedIn carousels. The data controller is [ClickCarousel legal entity — to be confirmed, including registered address]. For the purposes of the EU/UK GDPR, we act as a data controller for the personal data described here. Where we process content on behalf of business customers, we act as a data processor — see our Data Processing Agreement.

2. Information we collect

Information you give us

• Account data — your name and email address. Sign-in is passwordless (email links) or via a third-party identity provider, so we do not store a password for you.
• Content — the prompts you enter and the carousels, captions, first comments and brand assets (such as logos and colours) you create or upload.
• Profile details you choose to add — such as your role and audience, used to tune your content.
• Billing data — plan, transactions and the last four digits of your card. Full card details are handled by our payment processor (Stripe); we never see or store full card numbers.
• Support messages — what you send us via the help form or email.

LinkedIn account data

When you connect LinkedIn, we receive — through LinkedIn's official API and only with your authorisation — your LinkedIn profile identifier, name, photo and the access token needed to publish on your behalf. We request the minimum scopes required to publish carousels and post the first comment. Tokens are stored encrypted; disconnecting LinkedIn in Settings revokes our access.

Information we collect automatically

• Usage & device data — pages viewed, features used, IP address, browser and device type, and error diagnostics.
• Cookies and similar technologies — see our Cookie Policy.

3. How we use your information

• To provide, operate and improve the Service — generating, editing, storing and publishing your carousels.
• To publish content and the first comment to LinkedIn at your request or on your schedule.
• To manage your account, subscription and credits.
• To provide support and send service communications (sign-in links, receipts, important notices).
• To analyse usage, keep the Service secure and prevent abuse.
• With your consent, to send product news — you can opt out at any time via the unsubscribe link.

4. AI processing — no model training

Your prompts and content are sent to our AI providers solely to generate your output, and the results are returned to your account. We do not use your prompts or content to train AI models, and we do not permit our AI providers to do so — we route requests through provider settings that disallow training use. If this ever changes, we will ask for your explicit consent first.

5. Legal bases (GDPR)

We rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent abuse), consent (for optional cookies and marketing) and legal obligation (e.g. tax and accounting records).

6. LinkedIn integration

Publishing happens through LinkedIn's official API, under your own identity, and only when you initiate or schedule it. We store the access token securely and use it solely to perform actions you have asked for. You can disconnect LinkedIn at any time in Settings, which revokes our access. Your use of LinkedIn remains subject to LinkedIn's own terms and privacy policy.

7. How we share information

We do not sell your personal data, and we do not share it with anyone for their own advertising. We share it only with:

• Sub-processors— vetted providers who power the Service, acting under contract and only on our instructions. The current list — hosting (Vercel), database & authentication (Supabase), file storage (Cloudflare R2), AI generation (OpenRouter, routing to model providers such as DeepSeek and Google), background jobs (Inngest), payments (Stripe), email (Resend), product analytics (PostHog) and error monitoring (Sentry) — is maintained on our Third-Party Terms page.
• LinkedIn — to publish the content you create, when you ask us to.
• Legal & safety — where required by law, or to protect our rights and users.
• Business transfers — in a merger, acquisition or asset sale, subject to this policy.

8. Data retention

We keep personal data for as long as your account is active. When you close your account (or ask us to delete it), we delete or anonymise your personal data and content within 30 days, and it leaves our encrypted backups within a further 30 days — except where we must retain records for legal, tax or dispute-resolution reasons (kept only as long as required). Disconnected LinkedIn tokens are deleted immediately.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your personal data, to object to processing, and to withdraw consent at any time. EU/UK residents may also complain to their supervisory authority. California residents have rights under the CCPA/CPRA, including the right to know, correct and delete, and not to be discriminated against for exercising them — and we do not "sell" or "share" personal information as those terms are defined there. To exercise any right, email privacy@clickcarousel.com — we respond within the legally required time.

10. Security

We use encryption in transit, encryption of stored access tokens, access controls and least-privilege practices, and we log and monitor for abuse. Payment data is handled by Stripe (PCI-DSS). No method of transmission or storage is completely secure, but we work to protect your information and will notify you of breaches as required by law.

11. International transfers

Our providers process data in various countries, including the United States. Where we transfer personal data from the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

12. Children

The Service is not directed to anyone under 16 (or the age required in your country). We do not knowingly collect their data; if you believe a child has provided us data, contact us and we will delete it.

13. Changes

We may update this policy. We will post the new version here and, for material changes, notify you by email or in-app before they take effect. The "Last updated" date shows the latest revision.

14. Contact

Privacy questions or requests: privacy@clickcarousel.com. Postal address: [registered address — to be confirmed].