Privacy Policy

1. Introduction

Welcome to Carouselr. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Carouselr is operated by a French company and complies with the General Data Protection Regulation (GDPR) and French data protection laws (Loi Informatique et Libertés).

This policy explains what personal data we collect, why we collect it, and your rights. It applies when you use our website and our app.

2. Data Controller Information

The data controller responsible for your personal data is:

3. Information We Collect

3.1 Information You Provide

We may collect:

• Account information (email address, name) when you sign up
• Profile information you choose to provide
• Content you create using our service (carousel designs, text, images)
• Communications with us (support requests, feedback)
• If you subscribe to Pro: your subscription status and order details, sent to us by Polar. We never see your card number.

3.2 Automatically Collected Information

When you use our service, we automatically collect:

• Usage data (pages visited, features used, time spent)
• Device information (browser type, operating system, device type)
• IP address and approximate location (country/region)
• Log data (access times, error logs)
• A sign-in cookie and editor preferences stored in your browser (see our Cookie Policy)

3.3 Analytics and Error Reports

We count visits with Plausible Analytics, on this website and in the app. Plausible sets no cookies and gives us totals only (pages visited, referring sites, device types, countries), never a profile of you.

When the app hits an error, it sends a technical report to Sentry (EU region) so we can fix it: the error, the page, your browser and your account id. We do not record your sessions. Details are in our Cookie Policy.

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: To run your account, create and store your carousels, and provide the Pro plan if you buy it
• Legitimate Interests: To improve our service (visit counts, error reports), prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws and regulations

5. How We Use Your Information

We use the collected information for:

• Providing and maintaining our service
• Processing your carousel creations and exports
• Authenticating your account and ensuring security
• Communicating with you about updates, features, and support
• Analyzing usage patterns to improve our service
• Detecting and preventing fraud or abuse
• Complying with legal obligations
• Sending marketing communications (with your consent, which you can withdraw at any time)

To answer a support request or fix a problem with your account, a Carouselr administrator may sign in to your account to see what you see, for at most one hour at a time.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

6.1 Service Providers

We work with third-party service providers who process data on our behalf:

• Cloud hosting providers (data stored in EU)
• Google, for sign-in with your Google account
• Polar (polar.sh), which sells the Pro plan as merchant of record and processes payments
• OpenAI, which drafts slides from the topic and settings you submit when you use AI generation
• Cloudflare, which stores the images you upload
• Plausible Analytics, which counts visits without cookies
• Sentry, which receives error reports from the app

6.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (court orders, subpoenas)
• Requests from law enforcement or government authorities
• Protection of our rights, privacy, safety, or property
• Emergency situations involving safety or security

7. Data Retention

We retain your personal data only for as long as necessary:

• Account data: Until you delete your account, plus 30 days for backup purposes
• Content: Until you delete it or your account is closed
• Usage logs: Maximum 12 months
• Legal records: As required by French law (typically 5 years)

After these periods, data is securely deleted or anonymized.

8. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with the CNIL (French data protection authority)

To exercise these rights, contact us at privacy@carouselr.com. We will respond within one month.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest
• Access controls and authentication
• Regular security assessments
• Secure development practices
• Data hosting in EU-based secure facilities

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your data is primarily stored and processed within the European Union. Two providers process some data in the United States: OpenAI (the topic and settings you submit for AI generation) and Google (sign-in). When data leaves the EU, we rely on:

• Adequate level of protection (adequacy decisions)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Compliance with GDPR requirements

11. Children's Privacy

Our service is not intended for users under 16 years of age (or the minimum age in your country). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us, and we will delete such information.

12. Cookies and Tracking

We use only the cookies needed to sign you in, and no tracking cookies. The full list is in our Cookie Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Significant changes will be communicated via:

• Email notification (if you have an account)
• Prominent notice on our website

Continued use of our service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us: