Account data: your email address, used to authenticate you with a one-time login code and to send you essential service emails.
Connected social accounts:when you link a social account (e.g. TikTok) via its official authorization flow, we store the OAuth access and refresh tokens, your account's display name and avatar, and basic creator publishing information returned by the platform (such as privacy-level options). We never see or store your social account password.
Content: the carousels, images and captions you create in the app.
Tokens are used exclusively to publish or schedule the content you explicitly choose to publish, to the account you connected. We do not read private messages or followers lists, and we do not sell your data to third parties.
Data is stored in our private database and object storage. OAuth tokens are only accessible server-side and are never exposed to the browser.
You can disconnect a linked social account at any time from the project settings — the stored tokens are deleted immediately. You can also request the deletion of your account and all associated data by emailing contact@carouselfactory.io; we process such requests within 30 days.
Data controller: the Carousel Factory team — contact@carouselfactory.io.