Privacy

Karuselo is operated by Povilas Adomas Brukas, acting under individual activity certificate No. 1544921, Rasytės g. 30-52, Kaunas, Lithuania. For anything on this page, write to hello@karuselo.com.

Four things, and nothing else.

• Your account. Your email address, and a password that is hashed by our authentication provider and never visible to us.
• What you tell us about your business. Its name, website address, colours, fonts, what you offer, your story, products, audience and any facts you enter — either typed in or read from the website address you gave us. Plus any pictures you upload.
• What the product makes. The posts, captions and schedules generated for you, a record of how many credits each action used, and — when you choose to publish through Karuselo — the rendered images of a post and the link to where it was published.
• Linked social accounts, if you link one. The account’s id and username or Page name, the Meta user id behind it, and the access token Meta issues so Karuselo can publish there. See below for how that is handled.

We do not collect analytics, we do not profile you, and we do not buy or sell data about you.

Linking Instagram or a Facebook Page is optional. When you do, Meta gives Karuselo an access token for that account. We use it for exactly one thing: publishing the posts you approved, at the time you set, to the account you linked. We do not read your messages, followers, insights or anything else, and we do not ask Meta for permission to.

The token is stored on our servers, in a table that the browser cannot read. It is deleted when you unlink the account under Brands, when you delete your account, or when you remove Karuselo from your Instagram or Facebook settings — Meta notifies us and the token is removed at once. Instagram tokens expire after sixty days; Karuselo renews them while the link exists so scheduled posts keep going out.

Images of a post you publish through Karuselo are placed at a public web address for Meta to collect, because that is how Meta’s publishing works. They are the same images that appear on your feed.

Only the services needed to make the product work. Each one gets the minimum it needs to do its job.

• Supabase — your account, your brands and posts, uploaded pictures, and linked-account tokens, stored in Frankfurt (EU).
• Google (Gemini API) — the description of your business, so it can write posts in your voice. Sent per generation. Google does not use it to improve their models, because we are on a paid tier where that is contractually excluded.
• Firecrawl — the website address you ask us to read, when you ask us to read it.
• Pexels — your search words, only when you search for a stock photograph.
• Meta (Instagram and Facebook) — only if you link an account: the posts you publish through Karuselo, sent to the account you chose.
• Railway — hosting.

Some of these operate outside the EU. Where they do, transfers rely on the European Commission’s standard contractual clauses.

Only the ones that are strictly necessary: a cookie that keeps you signed in, and — for the browser you linked a social account from — a short-lived copy of that connection which your browser cannot read. There are no advertising or analytics cookies, which is why this site does not ask you to accept any.

Your brands and posts are saved to your account and also kept in your browser’s storage so the app works quickly. Clearing your browser data clears the copy; signing in brings it back.

Your account and its contents stay until you delete them. Delete your account and everything attached to it goes immediately, apart from records we are required to keep for accounting.

Under the GDPR you can ask for a copy of your data, correct it, delete it, take it elsewhere, or object to how it is used. Write to hello@karuselo.com and we will answer within 30 days.

You can delete everything yourself at any time from this page, or from Account inside the app.

If you think we have handled your data badly, you can complain to your national data protection authority — in Lithuania, the State Data Protection Inspectorate (VDAI).

If this changes in a way that affects you, we will say so by email before it takes effect rather than quietly editing this page.