Privacy Policy

Content Carousel is operated by Jacob Perks, trading as Thunkle, a sole proprietorship based in Ottawa, Ontario, Canada. Thunkle is accountable for the personal information described here and is the controller where that term applies. Contact: jacob@thunkle.ai.

• Account information: your email address, account identifiers and workspace membership.
• Social sign-in information: if you choose Sign in with Apple or Google, we receive an account identifier and the profile information that provider makes available so we can create and authenticate your Content Carousel account. Apple may provide a private relay email address if you choose Hide My Email.
• Brand and content information: submitted websites, public webpage text, brand names, briefs, product details, logos, colours, fonts, approved tools, generated slideshows, videos and captions.
• Onboarding information: where you heard about Content Carousel, the content goals you select and any optional details you provide about those goals.
• Billing information: your plan, subscription status, Stripe or App Store subscription identifiers, billing periods, renewal status and transaction records. Stripe and Apple handle payment information; we do not receive complete card numbers.
• Usage and technical information: generation allowances, job status, errors, security events, and ordinary server information such as IP address, browser type, device type, requested pages and timestamps.
• Communications: information you include when you contact us for support, privacy or billing help.

We use information to authenticate users, research submitted websites, generate and render content, provide downloads, administer plans and billing, answer support requests, prevent misuse, troubleshoot errors, improve reliability, comply with law and enforce our terms. Where consent or a particular legal basis is required, we rely on consent, performance of our contract, legal obligations and our legitimate interest in operating and securing the service, as applicable.

We do not sell personal information or use it for third-party behavioural advertising. We do not send promotional email without the consent required by law. Product updates and marketing tips are optional and off by default. You can change this preference from your account or use the unsubscribe link included in our emails. We may still send billing, security and essential service notices.

Apple and Google sign-in are optional and are used only to create your account, identify you and keep you signed in. Content Carousel requests only the basic identity and profile information described above. We do not request or access your iCloud content, Gmail messages, Google Drive files, Calendar, contacts or other provider product content.

Supabase processes the authentication exchange and manages your session using essential cookies. We do not use Apple or Google user data for advertising, sell it, or send it to AI providers. We share it only with service providers needed to operate authentication and the Content Carousel account, as described below. You can revoke Content Carousel's access from your Apple ID or Google Account settings and request deletion of your Content Carousel account and associated personal information at any time.

When you submit a website, we retrieve selected public pages and use their text and visible brand details to prepare your brand brief. Only submit a website and materials you are authorized to use.

You may complete this research before creating an account. We keep the resulting draft in a private, randomly identified onboarding record for up to seven days and use an essential browser cookie to let you resume it. If you create an account and start a trial, the draft is moved into your workspace. Expired, unclaimed drafts are deleted.

Content generation may use Anthropic and OpenAI API services. The prompts sent to an AI provider can include your brand brief, product information, selected website content, content preferences and draft outputs. We do not intentionally send your payment-card information. Processing by each provider is governed by its commercial/API terms and privacy commitments. AI providers and model configurations may change as the service evolves; this policy will be updated when a change materially affects your information.

We use providers that process information for the purposes above, including:

• Supabase for authentication, database services and file storage;
• Apple and Google for optional social sign-in;
• Render for web application and background-worker hosting;
• Stripe for web checkout, subscription billing and invoices;
• Apple for App Store subscriptions and payment processing;
• RevenueCat for App Store entitlement management and subscription reconciliation;
• Resend for account and subscription email;
• Anthropic and OpenAI for AI processing when enabled;
• public image, icon and website services used to assemble brand assets and content.

We may also disclose information when required by law, to protect users or the service, to investigate fraud or security incidents, or in connection with a financing, sale or reorganization of the business. Providers may process information outside Canada, including in the United States, where it can be subject to local law.

We keep account, brand and generated-content information while your account is active and for a limited period afterward when reasonably needed to provide support, restore service, resolve disputes, prevent abuse or meet legal obligations. Generation and security logs may be retained for a shorter operational period. Canadian tax and transaction records may be retained for at least six years where required.

Unclaimed pre-account research drafts expire after seven days.

You may delete your account from the Account page or request deletion at any time. We will delete or de-identify information that we no longer need, subject to legal obligations and normal backup-expiry cycles. We will explain any information we must retain when responding to a request.

We use essential authentication cookies to keep you signed in. We also use local or session storage to remember a selected plan and resume an active generation flow, an essential seven-day cookie to resume pre-account product research, and a service worker to support installation and a limited offline experience. We do not use advertising or cross-site tracking cookies. If that changes, we will update this policy and request consent where required.

We use access controls, tenant separation, private file storage, encrypted network connections and restricted service credentials intended to protect information. No online service can guarantee absolute security. If a breach creates a real risk of significant harm, we will notify affected people and regulators as required by law.

Depending on where you live, you may ask to access, correct, export or delete personal information, withdraw consent, or object to or restrict certain processing. Email jacob@thunkle.ai from your account email so we can verify the request. Under PIPEDA, access requests are normally answered within 30 days, subject to permitted extensions.

You may complain to the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction. We would appreciate the opportunity to address the issue first.

The service is for people aged 18 and older and is not directed to children.

We may update this policy as the service or law changes. The date above shows the latest revision. We will provide additional notice when a change materially affects how we use personal information.