Privacy Policy

This section is a summary and is not a substitute for the rest of the page, but nothing below contradicts it.

• We collect the email address you sign up with, the work you make in Caroufy, and the minimum needed to run subscriptions.
• We do not sell or rent personal data, and we run no advertising or analytics trackers. There is no Google Analytics, no advertising pixel and no third-party session recorder on this site.
• We never ask for your Instagram password and nothing ever logs in as you. Caroufy reads posts that are already public.
• We do hold information about Instagram creators who never signed up for Caroufy, because that is what a competitor feed is. Section 5 explains exactly what, why, and how a creator gets it removed.
• Text and images you put into the carousel studio are sent to OpenAI to generate your carousel. They are not used to train anyone’s models.
• You can get your account and its contents deleted by emailing [email protected].

Caroufy is operated by TO FILL — your full legal name, tax identification number TO FILL — NIF/NIE, of TO FILL — postal address, Spain. We are the data controller for the personal data described on this page, within the meaning of the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”) and the Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD).

For anything on this page — a question, a request to exercise your rights, or a complaint — write to [email protected]. We are not required to appoint a Data Protection Officer and have not appointed one; that address reaches the person responsible.

“You” here means someone with a Caroufy account, or someone who opens a share link. Information about the creators you track is a different matter, dealt with in section 5.

Stated explicitly, because each of these is a thing a reader may reasonably assume a tool like this does:

• Your Instagram credentials. We never ask for them, there is no field to enter them in, and connecting your own account is not part of any plan. Nothing posts, likes, follows or messages as you.
• Analytics or advertising data. No Google Analytics, no Meta pixel, no advertising identifiers, no session recording, no third-party scripts of any kind on this site.
• Your Google account beyond sign-in. If you use Google sign-in we receive your email address and basic profile, and we discard the access token immediately rather than storing it. We cannot read your Gmail, Drive, contacts or calendar, and we never ask for permission to.
• Special-category data. We do not ask for and have no use for data revealing health, political opinions, religion, ethnicity, trade union membership, sex life or sexual orientation, or biometric data. Please do not put such information into briefs or uploads.

Caroufy exists to show you what is working in your niche, and a niche is made of people. When you add a creator to a group, or run an audience scan, we collect and store information about that person even though they have no relationship with us. We think it is better to state this in full than to bury it.

What we store. Public profile information (username, display name, biography, follower and following counts, profile picture, whether the account is verified, private or a business account) and public posts (caption, media type, engagement counts, posting time, location tag if the creator attached one, music metadata, and the image or video itself). For video posts, and only when a user asks for it, we generate a text transcript of the audio.

An audience scan additionally examines who follows a public account in order to compute how much its audience overlaps with other public accounts. It stores the resulting list of candidate creators and their public profile details. It does not store the individual follower identities that produced the overlap figure.

Where it comes from. Entirely from what Instagram serves publicly. We do not log in as anyone, we do not access private accounts, and we do not buy creator data from anyone.

Our legal basis is legitimate interests (GDPR art. 6(1)(f)): our users’ interest, and ours, in analysing publicly published professional content in their field, which is the same activity a person does by hand when they look at a competitor’s profile. We have weighed that against creators’ interests. The data is material they chose to publish to the public; we use it only to show it back to a small number of professional users in a private dashboard; we do not build advertising profiles, do not infer anything about their private lives, do not contact them, and do not sell the data. Because the data was not obtained from the creator, GDPR art. 14 applies, and this section is the notice it requires. Notifying each creator individually would require contacting hundreds of thousands of people through a platform that provides no address for it, which we consider a disproportionate effort under art. 14(5)(b) — so this section, on a public page, is how we make the information available.

You can also object to this processing (art. 21), ask for a copy of what we hold about you (art. 15), or complain to the Spanish supervisory authority — see section 10. If you are a Caroufy user, note that you are responsible for what you do with creator data you obtain through the service; the Terms of Service set out that responsibility.

Caroufy uses models operated by OpenAI to read a source post and to write a carousel. Specifically, these things are sent to OpenAI when you use the relevant feature:

• The source post you build from — its images or video frames, its caption, and its audio when you request a transcript.
• The brief, angle and chat instructions you write in the studio, and the carousel document being edited.
• Images you upload as assets, which are described by a vision model so that the authoring model can place them.

OpenAI acts as our processor for this, under their API terms. Data sent through the OpenAI API is not used to train their models. OpenAI may retain API request data for a limited period for abuse monitoring before deleting it.

Two consequences worth being direct about. First, do not paste confidential material, personal data about third parties, or anything you are not free to share into a brief or an upload — it leaves our servers. Second, generated text is produced by a statistical model: it can be wrong, and it is your job to check it before you publish. The Terms of Service say more about that.

No automated decision-making. Nothing in Caroufy makes an automated decision that produces legal effects for you or similarly significantly affects you, within the meaning of GDPR art. 22.

Caroufy sets two cookies, both strictly necessary for the service to function. There is no advertising, analytics or profiling cookie, which is why you are not being asked to click a consent banner: under article 22.2 of the Spanish LSSI-CE, technically necessary cookies do not require consent.

Both are first-party. The session cookie is HttpOnly, so scripts cannot read it, and both are sent over HTTPS only. If we ever add an analytics or marketing cookie, this section will change and you will be asked for consent first.

We use a small number of service providers, each of which processes data only on our instructions and under a data processing agreement. This is the complete list:

Beyond those, we disclose personal data only where we are legally required to — a valid order from a court or a competent authority — or to establish or defend legal claims. If Caroufy is ever sold or merged, data may transfer to the acquirer, who would remain bound by this policy until you are told otherwise.

Share links are a disclosure you make, not one we make. When you create a share link for a group or a scan, anyone holding that URL can view it, read-only, without signing in. Treat the link as the credential it is. You can revoke a link at any time from the app, which takes effect immediately.

Our servers are in the European Union. Some of the providers listed above are established in the United States, so using Caroufy involves transferring personal data outside the European Economic Area. Those transfers are covered either by the European Commission’s Standard Contractual Clauses or by the provider’s certification under the EU–US Data Privacy Framework, together with the additional technical measures those instruments require. You may ask us for details of the safeguards applying to a particular provider.

• Your account and content — for as long as your account is open. Carousel documents are stored as append-only versions, so an edit adds a version rather than replacing one; deleting the project deletes all of them.
• Cached creator media (post images and video) — up to 180 days after we last needed it, then deleted automatically. Posts whose media has expired keep only their text and metrics.
• Server logs — a short rolling window, measured in weeks, kept for security and debugging.
• Invoices and payment records — kept for the period Spanish tax and commercial law requires, which is generally four to six years. This is a legal obligation and survives deletion of your account.
• After you close your account — we delete your account and its contents within 30 days, except for the billing records above and anything we are required to retain to defend a legal claim. Creator profiles and posts are not deleted with your account, because they are shared across all users and are not your personal data; a creator can have their own data removed as described in section 5.

Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where processing is based on consent. Where we rely on legitimate interests — creator data, and security logging — you have a specific right to object under art. 21.

To exercise any of them, email [email protected] from the address on your account. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. Exercising your rights is free; we will only charge for manifestly unfounded or repetitive requests, and we will say so before doing anything.

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid), or to the supervisory authority in your own country of residence.

Traffic is encrypted in transit with TLS. Passwords are stored only as salted hashes using a slow key-derivation function, so a copy of our database would not reveal them. Access to production systems is restricted to the operator, the database is not exposed to the public internet, and the component that renders carousels runs on an isolated network with no outbound access at all.

Who at Caroufy can see your content. The operator can view account activity and the carousels, groups and tracked creators held in an account, through an internal read-only dashboard. We do this to support you, to investigate faults, and to understand which parts of the product are working — not to read your material for any other purpose. That view cannot change, delete or generate anything in your account, and it cannot spend your allowance. Access is limited to the operator; if Caroufy ever employs staff or contractors with the same access, they will be bound by confidentiality obligations. We never sell, publish or share your content with other customers.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours and tell you directly where the law requires it. If you find a vulnerability, please report it to [email protected] before disclosing it publicly; we will not pursue researchers who act in good faith and give us reasonable time to fix the issue.

Caroufy is a professional tool and is not directed at children. You must be at least 18 to hold an account. We do not knowingly collect data from anyone under 14, the age at which Spanish law permits a minor to consent to information society services; if we learn that we have, we delete the account and its data.

We will update this page when what we do changes — a new provider, a new feature that touches data, a change of retention. The date at the top always reflects the last substantive change. If a change materially affects your rights, we will email account holders before it takes effect rather than relying on you to re-read this page.

Questions about this policy, requests to exercise your rights, creator removal requests and security reports all go to the same place:

TO FILL — your full legal name
TO FILL — postal address, Spain
NIF TO FILL — NIF/NIE
[email protected]