Back to 9:16 Studio
Last Updated: August 2026
GDPR & CCPA Privacy Commitment

Privacy Policy & Data Security

At TokCarousel (tokcarousel.com), your privacy and data sovereignty are fundamental principles. We operate on a privacy-first architecture designed to minimize server-side data retention.

Zero Server-Side Image Retention

Unlike traditional graphics apps that upload and store all your high-res social media graphics on their cloud servers, TokCarousel renders and packages your 9:16 carousels 100% locally inside your browser via Canvas & SVG. Your finished images are never uploaded to or stored on our servers.

01. Information We Collect

We only collect the minimal information necessary to deliver and improve our service:

  • Account Information: When you authenticate via Google OAuth or Supabase, we receive your verified email address, name, and profile picture avatar.
  • Local Draft Data: Your ongoing slide texts, theme choices, and handles are stored locally on your device via browser localStorage (tokcarousel_current_draft).
  • AI Generation Prompts: When you trigger the AI content summarizer, the text excerpt you submit is transmitted securely via TLS 1.3 to our AI endpoints strictly for parsing and structuring into carousel slides.
  • Billing Information: Transaction ID, customer email, and subscription status returned from our PCI-compliant payment gateways. We never store or receive your raw credit card numbers.

02. Third-Party Service Providers & Data Flow

To provide robust, reliable, and secure functionality, we partner with trusted, SOC2 / ISO-27001 compliant cloud infrastructure providers. We do not sell or rent personal information to advertisers:

Supabase (Auth & Database)

Manages secure user authentication, Google OAuth sessions, and account entitlement databases with AES-256 encryption at rest.

Vercel (Hosting & Edge Network)

Provides high-speed global CDN edge hosting, serverless API execution, SSL certificates, and DDoS mitigation.

OpenAI / Claude / DeepSeek (AI APIs)

Processes text inputs to structure slide decks. Zero Retention Policy: Customer inputs are not used to train public foundation models.

Stripe & Waffo (Payment Gateways)

Certified PCI-DSS Level 1 payment processors handling subscription checkouts, invoice billing, and secure customer portal management.

03. Your Rights Under GDPR (EU) & CCPA (California)

Regardless of your geographical location, we extend comprehensive privacy controls to all TokCarousel creators:

Right to Access & PortabilityRequest an electronic copy of all personal records and account history we hold.
Right to Erasure (Be Forgotten)Request complete and permanent deletion of your account and associated database records.
Right to RectificationCorrect or update inaccurate account profile details at any time.
No Sale of Personal Data (CCPA)We do not sell, rent, or trade your personal data to any data brokers or advertisers.

To exercise any of these statutory rights, email our Data Protection contact at support@tokcarousel.com. Requests are resolved within 30 days.

04. Cookies & Local Browser Storage

TokCarousel utilizes strictly necessary session cookies and HTML5 LocalStorage to maintain your authentication state and autosave your active slide draft so your work is never lost on accidental tab closes. We do not employ third-party tracking pixels or behavioral cross-site tracking cookies.

05. Children's Privacy (COPPA)

TokCarousel is not directed to individuals under 13 years of age (or under 16 in the European Union). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal data, we take prompt action to delete such records.

06. Contacting Privacy & Data Support

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact our team:

TokCarousel Privacy Office
support@tokcarousel.com
Help Center