Privacy Policy

This Privacy Policy explains how ClickCarousel ("ClickCarousel", "we", "us") collects, uses and protects personal data when you use our website and application (the "Service").

1. Who we are

ClickCarousel provides tools to create, schedule and publish social content. The data controller is ClickCarousel FZ-LLC, a free zone company registered in Ras Al Khaimah, United Arab Emirates. We are subject to the United Arab Emirates Personal Data Protection Law, and — because we offer the Service to people in Europe — we also apply the standards of the EU/UK GDPR, under which we act as a data controller for the personal data described here. Where we process content on behalf of business customers, we act as a data processor — see our Data Processing Agreement.

2. Information we collect

Information you give us

• Account data — your name and email address. You can sign in with a password, with a one-time email link, or with Google. If you choose Google, we receive your name, email address and profile picture from your Google account — nothing else, and we do not sell or share that data.
• Content — the prompts you enter and the carousels, captions and brand assets (such as logos and colours) you create or upload.
• Profile details you choose to add — such as your role and audience, used to tune your content.
• Billing data — plan, transactions and the last four digits of your card. Full card details are handled by our payment processor (Stripe); we never see or store full card numbers.
• Support messages — what you send us via the help form or email.

Connected social account data

When you connect a social account — currently LinkedIn, Instagram, Facebook, Threads, X or Bluesky — we receive, through that platform's official API and only with your authorisation, your profile identifier, name, photo and the access token needed to publish on your behalf. We request the minimum scopes required to publish your content. Tokens are stored encrypted; disconnecting the account in Settings revokes our access.

When you connect a WordPress site, you approve ClickCarousel on your own WordPress admin screen, and WordPress gives us an application password for that WordPress user. We store it encrypted and use it only to upload your carousel images and create draft posts, which you publish yourself. Disconnecting the site revokes that password.

Information we collect automatically

• Usage & device data — pages viewed, features used, IP address, approximate location, browser and device type, and error diagnostics.
• Cookies and similar technologies — see our Cookie Policy.

3. How we use your information

• To provide, operate and improve the Service — generating, editing, storing and publishing your carousels.
• To publish content to your connected social accounts at your request or on your schedule.
• To manage your account, subscription and payments — including processing your purchases through Stripe and keeping the invoicing and tax records the law requires us to keep.
• To provide support and send service communications (sign-in links, receipts, important notices).
• To analyse usage, keep the Service secure and prevent abuse.
• With your consent, to send product news — you can opt out at any time via the unsubscribe link.

4. AI processing — no model training

Your prompts and content are sent to our AI providers solely to generate your output, and the results are returned to your account. So that the writing sounds like you, this includes the profile details, saved notes and writing samples you have given ClickCarousel. We do not use your prompts or content to train AI models, and we do not permit our AI providers to do so — we route requests through provider settings that disallow training use. If this ever changes, we will ask for your explicit consent first.

5. Legal bases (GDPR)

We rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent abuse), consent (for optional cookies and marketing) and legal obligation (e.g. tax and accounting records).

6. Connected social accounts

Publishing happens through each platform's official API, under your own identity, and only when you initiate or schedule it. We store the access token securely and use it solely to perform actions you have asked for. You can disconnect any platform at any time in Settings, which revokes our access. Your use of each platform remains subject to that platform's own terms and privacy policy.

7. How we share information

We do not sell your personal data. Where you have accepted marketing cookies, the advertising platforms we run campaigns on receive measurement data about your visit — see the Cookie Policy. Otherwise we share personal data only with:

• Sub-processors — vetted providers who power the Service, acting under contract and only on our instructions. They fall into a few categories: cloud hosting and infrastructure, database and authentication, file storage, AI generation, background job processing, publishing to some of the platforms you connect, payments, email delivery, and product analytics and error monitoring. The current list of named providers is maintained on our Third-Party Terms page.
• The social platforms you connect — to publish the content you create, when you ask us to.
• Legal & safety — where required by law, or to protect our rights and users.
• Business transfers — in a merger, acquisition or asset sale, subject to this policy.

8. Data retention

We keep personal data for as long as your account is active. When you close your account (or ask us to delete it), we delete or anonymise your personal data and content within 30 days, and it leaves our encrypted backups within a further 30 days — except where we must retain records for legal, tax or dispute-resolution reasons (billing and tax records are typically kept for five years). Disconnected platform tokens are deleted immediately.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your personal data, to object to processing, and to withdraw consent at any time. EU/UK residents may also complain to their supervisory authority, and residents of the United Arab Emirates may complain to the UAE Data Office. California residents have rights under the CCPA/CPRA, including the right to know, correct and delete, and not to be discriminated against for exercising them — and we do not "sell" or "share" personal information as those terms are defined there. To exercise any right, contact us at clickcarousel.com/contact — we respond within the legally required time.

10. Security

We use encryption in transit, encryption of stored access tokens, access controls and least-privilege practices, and we log and monitor for abuse. Payment data is handled by Stripe (PCI-DSS). No method of transmission or storage is completely secure, but we work to protect your information and will notify you of breaches as required by law.

11. International transfers

We are established in the United Arab Emirates, and our providers process data in various countries, including the United States and the European Union. Where we transfer personal data from the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

12. Children

The Service is not directed to anyone under 16 (or the age required in your country). We do not knowingly collect their data; if you believe a child has provided us data, contact us and we will delete it.

13. Changes

We may update this policy. We will post the new version here and, for material changes, notify you by email or in-app before they take effect. The "Last updated" date shows the latest revision.

14. Contact

Privacy questions or requests: clickcarousel.com/contact. Controller: ClickCarousel FZ-LLC, Al Hulaila Free Zone, Ras Al Khaimah, United Arab Emirates. Trade licence no. 47037051.

ClickCarousel FZ-LLC, Al Hulaila Free Zone, Ras Al Khaimah, United Arab Emirates. Trade licence no. 47037051.