Privacy Policy
1. The short version
- CarouselForge turns source material you provide (transcripts, notes, articles, ideas) into social media carousel campaigns. It is in an invite-only beta operated by Companio Pty Ltd.
- To do that, the material you give it is sent to AI model providers. Anthropic (Claude) is always used; other providers are used only when they are switched on. See the AI processing notice.
- Do not paste confidential client data, other people's personal data, passwords, or regulated data into CarouselForge during the beta. Use material you are free to share.
- We do not sell your data, we do not use it for advertising, and CarouselForge does not train AI models on your content.
- You can delete a project yourself at any time. To delete your whole account and its data, email the privacy contact (support@companio.ai); self-service account deletion is not available yet.
- Support: support@companio.ai. Privacy requests: support@companio.ai.
2. Who is responsible
CarouselForge is operated by Companio Pty Ltd (ABN 53683515291) ("we", "us", "our"), at Level 5 / 100 Market St, Sydney NSW 2000, Australia. We decide how and why personal information is processed to run CarouselForge. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
You can reach us at the support contact (support@companio.ai) or, for anything about your personal data, the privacy contact (support@companio.ai).
3. What this policy covers
This policy covers the CarouselForge web application and these legal pages. It does not cover services you connect to CarouselForge, such as Instagram or ManyChat, which have their own policies.
If you use CarouselForge for a client or an employer, you are responsible for having the right to share their material with us. During the beta, do not upload confidential client material or other people's personal information. Contact support@companio.ai to discuss business data-processing requirements before sharing such material.
4. What we collect
Account information
- Your email address and the user ID our authentication provider (Supabase) assigns to you.
- Your password. Your browser sends it directly to Supabase; CarouselForge's own servers never receive it.
- Sign-in session tokens, which prove to our servers that a request comes from you.
Content you provide
- Source material: transcripts, articles, founder notes, sales-call or case-study text, rough ideas, and links you paste or ask the assistant to read.
- Chat messages and instructions you give the AI assistant.
- Projects: project names, descriptions, project notes, and research the assistant saves to a project.
- Brand profiles: creator name and handle, profile photo, colours, fonts, tone of voice, audience, and copy rules.
- Images you upload, including reference images you ask CarouselForge to restyle.
- Edits you make to slides.
- Optional post-export feedback: three answers about your draft and an optional free-text “why” response of up to 500 characters. Do not include personal details or source material.
Content generated for you
- Campaign angles, carousels, slide copy, and captions.
- Generated and restyled images, including candidates that were not selected, which are stored privately in your project with a record of how they were made.
- Background-removed cut-outs of your images.
- Research briefs, for example saved summaries of X (Twitter) trend scans.
- Quality-check results for your carousels.
Exports
Image and ZIP exports are produced in your browser and downloaded to your device. To produce an MP4 video, your browser uploads its screen recording to our server, which converts it in a temporary folder that is deleted once the conversion finishes.
Chat history and long-term memory
- Your conversation with the assistant is stored on our servers with each project so you can pick up where you left off.
- When long-term memory is switched on, CarouselForge also keeps memory banks for you, for each project, and for each brand profile. See Hindsight below.
Performance and outcome data
- Post results you record, such as reach, views, saves, shares, clicks, and notes.
- Instagram post statistics you choose to pull from Meta.
- Automation events sent by ManyChat if you connect it, such as a keyword being triggered, a conversation opening, or a lead, booking, or purchase. We replace any contact identifier with a keyed pseudonym before storing it and drop names, email addresses, phone numbers, and message text.
- Benchmark measurements, if you take part in a benchmark run: time from source to export, whether the first draft was publishable, edits per slide, and any notes you type.
Connected accounts and keys
- If you connect Instagram through Meta: an access token, your Instagram account identifiers, and records of the posts you publish or schedule, including the approved images, videos, and captions and an audit trail of each publication.
- API keys you add for AI and image providers. These are encrypted, stored per account, and never sent back to your browser.
Meta and Instagram connection
CarouselForge connects Instagram through Companio Pty Ltd's Meta app (app ID 2599152777204211), using Facebook Login. We request these scopes: pages_show_list, pages_read_engagement, instagram_basic, instagram_content_publish, instagram_manage_comments, and instagram_manage_insights. These permissions support Page and Instagram account discovery, publishing, comments and insights; requesting a permission does not mean every feature is available.
Instagram insight metrics are used as AI prompt context to help the assistant learn from post performance. Relevant performance context is sent to Anthropic with assistant requests; this is inference, not model training by CarouselForge.
When memory is enabled, recorded campaign outcomes containing Instagram-derived performance metrics, identifiers and any notes you provide are sent to Hindsight (Vectorize) for project, user and, where applicable, brand memory. Conversations discussing Instagram-derived results can also be retained there as chat transcripts.
For the operator's own account only, when the experimental creative pipeline is enabled, Instagram-derived performance context included in a campaign brief (such as feedback rationale) may also be sent to OpenRouter for creative copy generation. That route is pinned to Z.AI as the upstream model provider, with provider fallbacks disabled; it is not used for beta users' content.
There is no in-app disconnect today. Revoke access in Facebook settings → Business integrations by removing the Companio app. Revoking access stops future authorised access but does not erase data already stored. For deletion, email support@companio.ai and identify your CarouselForge account and connected Instagram account.
Companio's Meta connection notice also covers CarouselForge's Meta use and forms part of this policy. See the Meta data-deletion instructions.
Technical information
- Your IP address and browser details reach our hosting provider with every request. We also use IP addresses briefly to rate-limit the public webhook that ManyChat calls.
- Error reports and server logs, described in section 9.
5. AI processing notice
CarouselForge is an AI product. When you ask it to do something, the material needed for that task is sent to an AI model provider, which processes it and returns a result.
- Every assistant turn sends Anthropic your message, the project's conversation so far, project and brand context, the visible copy of the carousel you are working on, relevant long-term memory, and any source material you supplied.
- Generating a campaign or carousel sends your source material and the selected angle to Anthropic.
- Generating or restyling images sends an image prompt (built from your request and your brand's visual style) and any reference image to fal.ai, and sends preview images of the results to Anthropic for a quality check.
- Visual design review, when available, sends images of your rendered slides to Google's Gemini API.
- Research tools, when available, send search terms, topics, account handles, and public web addresses chosen by the assistant from your request to Firecrawl, xAI, the X API, or Pexels.
Outputs are machine-generated. They can be inaccurate, incomplete, out of date, or similar to content generated for someone else. Review everything before you publish it.
Provider retention and training. Each provider handles the data it receives under its own terms. Some providers keep inputs and outputs for a period (for example, to monitor abuse), and their terms differ on whether data can be used to improve their models, often depending on the type of account used. We have not yet confirmed each provider's retention and training settings for this deployment, so this policy makes no promise about them. Read each provider's current terms, linked in the next section.
No model training by CarouselForge. CarouselForge has no model-training pipeline and does not train AI models on your content.
During the beta, do not paste confidential client data, other people's personal data, credentials, or regulated data (for example health, financial, or children's data). Use material you are free to share with these providers.
6. Service providers (subprocessors)
These companies process data on our behalf. The "When used" column says whether a provider is always involved, or only when the operator switches it on for this deployment or you connect it yourself. If you add your own API key for a provider in Settings, requests made for you use your key, and your own agreement with that provider also applies.
| Provider | What it does | Data it receives | When used | Terms |
|---|---|---|---|---|
| Railway | Hosts the CarouselForge servers and local media storage. Project notes and chat history are held in the application database. Its platform keeps our server logs. | Everything the application processes, plus request metadata such as IP addresses. | Always | Privacy policy |
| Supabase | Sign-in, account emails (such as password resets), our production database, and private file storage for images and publication media. | Email address, password, session tokens, database records, stored images and videos. | Always | Privacy policy |
| Anthropic (Claude) | The AI assistant, campaign-angle and carousel generation, image-prompt planning, and image quality checks. | Messages, source material, project and brand context, carousel copy, memory snippets, and preview images. | Always | Privacy policy · Commercial terms |
| Sentry | Error monitoring for the servers and the browser app. | Scrubbed error reports: error type, sanitised code locations, release, and a few technical labels. No account identity, request contents, or error messages (details). | Always in production | Privacy policy |
| Google (Gemini API) | Optional visual design review of rendered slides. | Images of your rendered slides and their order, type, and layout. | Only when a Gemini key is configured by the operator or by you | Gemini API terms |
| fal.ai | Image generation, restyling, and background removal. | Image prompts, reference images, and images you ask it to cut out. | Only when a fal.ai key is configured by the operator or by you | Privacy policy |
| Pexels | Stock photo search. | Search terms, which may be derived from your content. | Only when a Pexels key is configured by the operator or by you | Privacy policy |
| Hindsight (Vectorize) | Long-term memory for the assistant: your preferences, brand voice, and what has worked. | Brand profile details, project identity, carousel headlines and calls to action, full chat transcripts, memory notes, and outcome summaries, including recorded Instagram-derived performance metrics and identifiers when present. | Only when the operator switches memory on | Privacy policy |
| Firecrawl | Web search, page reading, site maps, research-paper search, and GitHub history search. | Search queries and public web addresses chosen by the assistant from your request. | Only when the operator configures it | Privacy policy |
| xAI (Grok) | X (Twitter) trend discovery and topic search. | Topics, account handles, and queries chosen by the assistant from your request. | Only when the operator configures it | Privacy policy |
| X Corp. (X API) | Looking up exact public posts, timelines, and post context. | Search queries, account handles, and post IDs. | Only when the operator configures it | Privacy policy · Developer policy |
| Meta (Facebook / Instagram) | Connecting your Instagram professional account, publishing and scheduling your carousels, and reading post statistics. | Your access token and account identifiers, the images, videos, and captions you approve for publishing, and media IDs. | Only when you connect Instagram | Privacy policy · Platform terms |
| ManyChat | Sends us automation events from your ManyChat flows. We send no data to ManyChat. | We receive event types, campaign IDs, an optional value and currency, and a contact identifier that we immediately replace with a keyed pseudonym. | Only when you set up the ManyChat webhook | Privacy policy |
| OpenRouter with Z.AI (pinned upstream GLM provider) | An experimental copywriting pipeline; upstream provider fallbacks are disabled. | Copy drafts, source material, brand context and campaign briefs, including Instagram-derived performance feedback rationale when present. | The operator's own account only. Never used for beta users' content. | Privacy policy |
| OpenAI (Codex) | An experimental design pass, run through a design worker the operator controls. | Copy, brand details, and images for that pipeline. | The operator's own account only. Never used for beta users' content. | Privacy policy |
We will update this list before we add a provider that receives your data.
7. Cookies and browser storage
CarouselForge uses no advertising cookies, no analytics cookies, and no third-party tracking pixels. It stores the following in your browser, all of it needed to run the app or remember your choices.
| Name | Type | Purpose | How long |
|---|---|---|---|
cf_session |
Cookie (HttpOnly, SameSite=Lax, Secure in production) | Lets image requests from the app prove you are signed in. | No longer than your sign-in token remains valid; cleared when you sign out. |
sb-…-auth-token |
Local storage, set by Supabase's sign-in library | Keeps you signed in and refreshes your session. | Until you sign out. |
cf_layout_prefs, cf_editor_sections, cf.seenEditorOrientation, cf_metaWasConnected, cf_defaultSlideCount, cf_demoMode, cf_claude… (model and effort choices) |
Local storage | Remembers panel widths, which editor sections are open, whether you have seen the editor tour, whether Instagram was connected, your default slide count, and AI model settings. | Until you clear site data. |
cf_brand, cf_brand_profiles, cf_active_brand_id, cf_migrated |
Local storage | A copy of your active brand (including your profile photo) for fast loading, and keys used once to move brand profiles from older versions to your account. | Until you clear site data. |
cf_outcome_followups_v1, cf_manual_benchmark_session_v1, cf_export_gate_overrides_v1, cf-publication-change |
Local storage | Reminders to record post results after an export, a benchmark timing session, a log of quality-gate overrides you approve (who approved it, the reason you typed, and which carousel), and a signal that tells your other open tabs that publishing data changed. | Until you clear site data. |
carouselforge.pending-chat-turn.v1, carouselforge:image-director-pending:v1 |
Session storage | Retry keys and fingerprints so a dropped connection does not repeat a paid AI request. Your prompts and source text are not stored here. | Until you close the tab. |
carouselforge |
IndexedDB | Used only by older versions of CarouselForge. Current versions read it once to move locally saved images and projects into your account. | Until you clear site data. |
Signing out clears the sign-in cookie and session. To remove everything else, clear this site's data in your browser settings.
8. How we use data
- To provide CarouselForge: store your projects, generate campaigns, carousels, and images, and keep your work in sync.
- To publish or schedule posts to Instagram, only when you ask us to.
- To personalise the assistant with long-term memory, when memory is switched on.
- To keep the service secure: authenticate requests, limit how fast costly AI features can be used, and prevent abuse.
- To find and fix problems, using scrubbed error reports and server logs.
- To learn whether the beta works, using the quality statistics and validation measurements described below.
- To answer your support and privacy requests and to tell you about important changes to the beta.
- To comply with the law.
We do not sell personal data, we do not use it for advertising, and we do not make decisions that have legal or similarly significant effects on you by automated means alone. Where EU/UK data-protection law applies, legal bases may include contract performance, legitimate interests, consent and legal obligations, depending on the processing and applicable law.
9. Error reports, logs, and measurements
Error reports (Sentry)
In production, the servers and the browser app send error reports to Sentry. Before a report leaves our code, a scrubber removes your account identity, IP address, the request address, headers, cookies, and body, breadcrumbs, local variables, and source-code context, and replaces the error message with a fixed text. What remains is the error type, sanitised code locations, the release, and a small set of bounded technical labels. Like any web request, a report sent from your browser reaches Sentry over a network connection that carries your IP address.
Server logs
Our servers write operational logs, such as request and error identifiers, project and carousel identifiers, AI model and tool names, and error codes, to our hosting provider's log system. These logs are designed not to contain your source material or generated copy.
Quality statistics
When CarouselForge generates a carousel, it stores statistics about the draft with it: counts and codes of quality-check findings, whether an automatic repair pass ran, hook length, text density, layout mix, and a running tally of your manual edits (how many, which slide numbers, and when).
Validation measurements
During the beta we record measurements that tell us whether CarouselForge is working, such as timings, counts, and whether a first draft was usable. These measurements are designed not to contain your source material, prompts, or generated copy. Optional post-export feedback also includes the answers and free text you choose to submit, as described in What we collect.
10. When data leaves CarouselForge
- Service providers listed in section 6, so they can do their part of the work.
- Instagram, when you publish or schedule a post: the approved images, videos, and caption become public on your account. Deleting a project in CarouselForge does not remove posts already published to Instagram.
- Legal requirements: when the law requires it, or to protect the rights, safety, or property of users, the public, or us.
- Business changes: if the operator's business is reorganised, sold, or merged, data may transfer to the successor, subject to safeguards.
- With your permission in any other case.
11. Where data is processed
Our servers and providers may process data in Singapore and the United States, and outside the country where you live. We take reasonable steps, including contracts and due diligence, to ensure overseas recipients handle personal information in accordance with the APPs (APP 8). Contact support@companio.ai for information about likely overseas disclosures.
12. How long we keep data
| Data | Kept until |
|---|---|
| Account (email address and user ID) | Your account is deleted. |
| Beta invitation and terms acceptance (which beta terms version you accepted, and when) | Kept after your account is deleted, as the record of your acceptance, with your email address replaced by a one-way hash and your user ID removed. No fixed retention period is currently specified. |
| Projects, carousels, images, chat history, research notes, outcome data, publication records | You delete the project, or your account is deleted. |
| Brand profiles | You delete the profile, or your account is deleted. |
| Long-term memory | The related project or brand profile is deleted, or your account is deleted. |
| Instagram connection | The token expires, you revoke CarouselForge's access in your Meta settings, or your account is deleted. |
| API keys you added | You remove them in Settings, or your account is deleted. |
| Your app settings and preferences saved to your account | Your account is deleted. |
| Records of AI and media provider usage (provider, model, amounts used, and when; never your content) | Kept after your account is deleted so we can reconcile our provider bills, with your user ID replaced by a one-way hash. No fixed retention period is currently specified. |
| Validation events and optional post-export feedback | Removed during account deletion when the ledger pseudonym can be resolved; otherwise reported as residuals. The deletion's own account_data_request_opened and account_data_request_completed events are retained under a per-request pseudonym, not your account's pseudonym. No fixed retention period is currently specified for retained records. |
| Lifecycle safety records (deletion tombstones, operation and lock reconciliation evidence) | Kept to prevent deleted resources or unresolved operations from being reopened. Some lock scopes retain an account identifier; account deletion reports these as residuals rather than claiming they were erased. No fixed retention period is currently specified. |
| Error reports | According to our Sentry plan's retention settings; this policy does not specify a fixed period. |
| Server logs | According to our hosting plan's retention settings; this policy does not specify a fixed period. |
| Browser storage | You sign out (session data) or clear this site's data. |
| Backups | Our database and storage providers may keep backups after deletion according to their backup settings. This policy does not specify a fixed backup window. |
Copies that AI and service providers have already received are kept under their own terms. Deleting data in CarouselForge does not delete those copies, and we do not claim that it does.
13. Deleting projects and your account
Deleting a project (available now)
You can delete any of your projects from the app. CarouselForge then:
- refuses to start while an Instagram publication from that project is still being resolved, so a post is never left in an unknown state;
- deletes the project's images from file storage;
- deletes the project's long-term memory bank, and removes that project's entries from your personal and brand memory banks;
- deletes the project's local media folder and its database-backed chat history, research notes, and project notes;
- deletes the project's database records.
If any step fails, the deletion is reported as incomplete and you can retry it. A project is reported as deleted only when every step has succeeded.
You can also delete individual images and brand profiles. Deleting a brand profile deletes its memory bank.
Deleting your account
Self-service account deletion is not available yet. To delete your account and the data linked to it, email the privacy contact (support@companio.ai) from your account's email address. You can download a copy of your data yourself in Settings → Account → Download my data. We handle deletion requests within a reasonable time, subject to applicable law and any records we must retain.
Deleting your account keeps the record of which closed-beta terms version you accepted and when, with your email address replaced by a one-way hash, and records of how much AI and media provider usage your account consumed, with your user ID replaced by a one-way hash. Internal lifecycle safety evidence is also retained; records still scoped to your account are reported as residuals. See How long we keep data.
14. Your choices and rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong;
- receive your data in a portable format;
- have your data deleted;
- object to or restrict some processing;
- withdraw consent you gave, for example by disconnecting an integration;
- complain to your data protection authority.
Things you can do yourself today: edit or delete projects, images, and brand profiles; remove API keys in Settings; see what the assistant remembers in Settings → What the AI remembers; download your carousels with the export tools; and revoke CarouselForge's Instagram access in your Meta account settings.
Everything else: email the privacy contact (support@companio.ai). We will verify your identity before acting and respond within a reasonable time under the APPs, or within the timeframe required by other applicable law. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC). Other rights and complaint or appeal routes may apply where you live.
15. Security
- The production app is served over HTTPS and sends security headers, including a strict content security policy.
- Every request is checked against your account, so you can only reach your own projects, images, and carousels.
- API keys you add and Instagram access tokens are encrypted with AES-256-GCM and are never sent back to the browser.
- The sign-in cookie is HttpOnly, so page scripts cannot read it.
- Costly AI features are rate-limited per account.
- Error reports are scrubbed before they leave our code.
No system is completely secure, and we cannot guarantee that data will never be accessed without permission.
16. Security incidents
If a data breach is likely to result in serious harm, we will comply with the Notifiable Data Breaches (NDB) scheme by notifying affected individuals and the OAIC. We will also meet other applicable legal notification requirements.
17. Minimum age
CarouselForge is for people aged 18 or over. It is not directed at children. If we learn that someone under 18 has an account, we will delete it and its data.
18. Changes and versions
The version and effective date at the top of this page identify the policy you are reading. We keep a record of earlier versions and can send you a copy on request. If we make a material change, we will tell you by email or in the app before it takes effect. When the closed beta terms change, we tell beta users before the new version takes effect.
This policy and disputes arising from it are governed by the laws of New South Wales, Australia, subject to any mandatory rights under applicable law.
19. Contact
- Operator: Companio Pty Ltd (ABN 53683515291), Level 5 / 100 Market St, Sydney NSW 2000, Australia
- Support: support@companio.ai
- Privacy requests: support@companio.ai