Privacy Policy

1. Who we are

Carousel AI is operated by Caio Avelino. Contact us about your data at caio@carousel-ai.com.

2. Data we collect

• Account: email address, account identifier and name when provided. Supabase manages password and Apple/Google authentication; we do not store your password in plain text.
• Content: topics, briefs, prompts, text pasted or imported from a URL, outlines, slide text and captions, brand names and handles, calls to action, visual preferences and images you provide or save. This content may contain personal information when you include it. Sharing with AI services requires your permission as described in section 5.
• Usage: generation counts and project state to provide the service and enforce plan limits.
• Purchases: transaction identifiers, amounts, subscription status and access periods. Stripe, Mercado Pago, Apple or Google process payment depending on your checkout. We do not store full card numbers. RevenueCat receives your account identifier and store purchase information to verify and restore subscriptions.
• Technical data: network requests and error logs needed for operation and security. The approximate country inferred from your IP is used to display local payment options; we do not request GPS location.
• Authentication and purchase SDKs: Google Sign-In and RevenueCat may process profile data, user and device identifiers, usage and diagnostics to authenticate users, verify purchases and operate their services.
• Website: Google Analytics, Google Ads and Vercel Analytics may receive visits, interactions and browser identifiers to measure usage and conversions. These analytics and advertising scripts are disabled inside the native Android and iOS apps.

3. How we use your data

We use data to authenticate your account, generate and save requested content, export files, process purchases and refunds, restore subscriptions, enforce limits, secure the service and send transactional emails. If you connect Instagram or LinkedIn, we store the required connection information and transmit content when you request or schedule a post.

4. Service providers

• Supabase and Vercel: authentication, database, files and hosting.
• Anthropic (Claude): receives the topic, brief, original or imported source text, URLs and references used in the outline, slide text and captions, editing instructions, brand name and handle, calls to action, language and visual preferences included in the prompt. We use this information to prepare outlines, generate and revise carousels and captions, and translate trending headlines.
• Google (Gemini): receives the cover prompt, including any topic, text and brand or style instructions it contains, the image format and any reference image you provide, such as a product photo, logo or image of a person. We use this information to create the requested cover.
• Tavily: receives only predefined public category searches, with language and time filters, to find current information and suggest trends. Our server selects the category; we do not send your topic, brief, text, URLs or account identifier to Tavily. The same restriction applies to administration tools. Public search results, including titles, text and authors, may be sent to Anthropic to generate content, classify results or suggest replies.
• Apple, Google Play and RevenueCat: app purchases, subscription verification and restoration. Eligible alternative purchases on Google Play are also reported to Google.
• Stripe and Mercado Pago: card and Pix processing where available.
• Pexels: for photo carousels, receives search terms suggested from the slides to find images. These terms may contain personal information when it is in your supplied content; this transfer is disclosed in the permission notice before generation. For manual searches, Pixabay, Unsplash, Pexels and image search services receive the terms you request. SendGrid and Supabase email services: delivery of transactional emails.
• Instagram and LinkedIn: optional connections and user-requested publishing. Google Analytics, Google Ads and Vercel Analytics: website measurement, disabled in native apps.

Each provider processes the information needed for its function under its applicable terms, privacy policies and data protection conditions. Processing may occur outside your country. AI service requests are sent from our server over HTTPS; their private API keys stay on the server. Account passwords, payment details and social connection tokens are not automatically included in prompts. Personal information you enter or include in images and documents is part of the shared content.

The AI services that receive personal content are Anthropic’s commercial API and Google’s paid Gemini API services. Their data processing agreements require protection equivalent to that described in this policy, including confidentiality, security measures and processing to provide the service, subject to the security and legal exceptions in those agreements. Anthropic does not use this API content to train its models. In the paid services we use, Google does not use prompts or responses to improve its products. Retention follows each provider’s terms and data processing agreement.

Tavily publishes security measures including access controls and encryption. Its terms allow queries to be used to operate and improve its services and to be shared as needed with vendors and search indexes. We limit these queries to public terms defined by the system, without including personal content supplied by users.

Pexels describes technical and organizational measures against unauthorized access, loss and unlawful processing, and safeguards for international transfers. Its policy permits search queries and interactions to improve search results, including through machine learning. We do not send your account, password or payment information to Pexels; we send only the terms needed to search for photos. Retention, processing and deletion requests follow its privacy policy.

Read the providers’ documents: Anthropic privacy, Anthropic commercial terms, Anthropic data processing, Google privacy, Gemini API terms, Tavily privacy and Tavily terms.

5. Your permission for AI services

Before the first request to Anthropic, Google Gemini or Tavily, we explain what information is shared, who receives it and why. You choose Allow and continue or Not now. Only an explicit Allow and continue action authorizes sharing; using the app, opening a screen or having a subscription does not grant permission. Without permission, the server blocks AI operations before sending content or consuming your allowance.

You can decline and continue accessing your account, library and manual editing. You can review or withdraw permission in Account settings under Manage AI permission, or through the AI permission control in the footer. Withdrawal blocks new AI requests in this browser or device; it does not undo processing already started or automatically delete previously shared information. Contact us to request deletion of that information.

We record your choice with its date, this notice version and your account identifier, or a signed-out session, in a protected cookie for up to 180 days. Your choice applies to this browser or device and this account. Switching accounts, cookie expiration or a new notice version requires new permission. Withdrawal removes this record.

6. Retention and deletion

We retain account data and projects while your account is active. You can delete your account in Account settings or follow the account deletion instructions.

Deletion removes account access and your files and projects. Financial records needed for reconciliation, refunds and store reports may be retained with the account link removed. Account deletion does not automatically cancel a store subscription; you can manage renewal in Apple or Google settings.

7. Your rights

To request access, correction or deletion of your data, or obtain assistance, contact caio@carousel-ai.com.

8. Cookies and local storage

We use cookies and local storage for sessions and preferences. On the website, measurement tools may use cookies and browser identifiers. Native apps do not load the website advertising and analytics scripts.

9. Changes

We may update this policy. Significant changes will be communicated through a service notice or email.