Privacy Policy

1. What we collect

• A pilot application: the email, brand, website, TikTok account and the line you write in the form on Carou's home page, plus where you came from (the site or post that linked you there). Only Carou's team reads it, to answer you.
• Your login: your email and password. Supabase stores the password scrambled (hashed); we can't read it.
• Your brand: the brand card (name, website, what it sells, who it's for, how it sounds, its TikTok handle), plus what Carou reads from the public website you enter: the page title and description, product names, prices and product photos.
• Your photos: the photos you upload and the ones you make with Recreate with AI, kept in private storage that only your workspace can open.
• Your carousels: the carousels Carou makes for you, your edits, your keep and skip choices, notes, requests, saved posts and format choices.
• Your posts' numbers: when you add a TikTok post link, Carou reads that post's public views, likes, comments and shares from TikTok's public page, then again every few hours for 35 days.
• Bio-link taps: when someone taps your Carou bio link, we save the time and whether the tap came from inside TikTok's app. Nothing about the person: no IP address, no device ID, no cookie.
• Cookies: one keeps you signed in, one remembers which brand you had open. No ad cookies, no tracking, no analytics tools.
• On your device: your browser keeps a few things to make Carou faster or remember a choice (your onboarding answers until you sign in, picture links for 3 days, whether the sound is on). They stay on your device.

2. TikTok data, once you connect an account

This part applies when you connect a TikTok account to send carousels to it as drafts.

• What we get: an ID TikTok gives Carou for your account, your display name and profile picture (TikTok's user.info.basic permission), and the access and refresh tokens TikTok issues.
• What we use it for: only to show which account is connected and to send the carousels you choose to that account's TikTok inbox as drafts (TikTok's video.upload permission). Carou sends a draft only when you press the button for it. You finish and post it in TikTok yourself.
• What we don't do: post for you, read your videos, messages, followers or analytics, or use your TikTok data for ads or anything else.
• How it's kept: the tokens sit in our database, readable only by Carou's server and never sent to your browser. Supabase encrypts the database on disk.
• Disconnecting: in Carou's Settings, which deletes the tokens and asks TikTok to revoke them, or in the TikTok app where you manage connected apps. Drafts you already sent stay in TikTok until you delete them there.

3. Why we use it

• To make and show your carousels, and let your teammates work on them.
• To pick formats for your brand and write your brand's version of them.
• To show your results and bio-link taps.
• To keep Carou working and secure, and to answer you.

Your keep and skip choices teach Carou which formats to pick for you next. We don't sell your data or share it for advertising.

If you're in the EU or the UK: we use your data to give you the service you signed up for (contract), to keep it secure and improve it (legitimate interest), and for the TikTok connection because you chose to connect (consent, which you withdraw by disconnecting).

4. Who processes it for us

Pictures from public image sites (like Pinterest's image servers) load through Carou's own server, so those sites don't see you.

5. How long we keep it

• Your content stays as long as your account is open.
• When you remove a photo in Carou, it's gone from storage right away. A brand's numbers and bio-link taps go with the brand.
• When you ask us to delete your account, we delete everything in it within 30 days and tell you when it's done.

6. Your rights

• See and fix: most of your data is in Carou, where you can see and edit it. Ask us for a copy of the rest.
• Delete: email info@ninek.co from your login email and we delete your account and everything in it within 30 days.
• Depending on where you live (the EU, the UK, California and others), you may also have the right to object, to limit how we use your data, to take it with you, and to complain to your data protection authority. Email us to use any of them.

7. Security

Every login goes through Supabase. Every record belongs to a workspace, and database rules let only that workspace's members read it. Photos sit in private storage, and everything travels over HTTPS. No system is perfect: if your data ever leaks, we'll tell you.

8. Children

Carou is for brands and creators 18 and over. We don't knowingly collect data from anyone under 18.

9. Where your data lives

Our database is in the United States (Supabase, US East). If you use Carou from elsewhere, your data goes there, covered by our providers' standard data protection terms.

10. Changes

If we change this policy in a way that matters, we'll tell you in Carou or by email before it applies. The date at the top shows the last change. See also our Terms of Service.

11. Contact

Questions, a copy of your data or deletion: info@ninek.co.

By post: NineK Apps LLC, 418 Broadway STE N, Albany, NY 12207, USA.