Privacy Policy

Carousel Draft · last updated July 7, 2026

This policy explains what Carousel Draft collects, how it is shared with TikTok, and your rights. Carousel Draft generates AI carousel backgrounds and uploads them to your TikTok account as a draft.

1. Who we are

Carousel Draft is built and operated by Son BIP (the "developer"). For any privacy question, email [email protected].

2. Data we collect

  • From TikTok (only after you authorize): your TikTok open_id (a stable, anonymous identifier), display name, and profile avatar. We never see or store your TikTok password.
  • Content you create: the text prompts you send to the AI image generator and the generated background images.
  • Basic usage data: anonymous request logs (timestamps, success/error) used to keep the service running and fix bugs.

We do not collect sensitive data such as payment details, government IDs, or precise location.

3. How data is shared with TikTok

When you connect your TikTok account, Carousel Draft uses TikTok's Content Posting API to push your generated images into your TikTok Inbox as a draft. To do this it requests the scopes user.info.basic (read your profile), video.upload (share as draft), and optionally video.publish. The generated images and a draft title are sent to TikTok on your behalf and are then governed by TikTok's Privacy Policy.

4. How we use data

Solely to generate your carousel backgrounds, deliver them to your TikTok account, and operate the app. We do not sell your data or use it to train AI models.

5. Data retention

  • TikTok profile data (open_id, name, avatar): kept only while your account is linked and deleted within 72 hours of unlinking.
  • Generated images & prompts: kept for 30 days so you can re-download a draft, then permanently deleted.
  • Anonymous logs: rotated after 90 days.

6. Your rights

You can request access to, correction of, export of, or deletion of your data at any time by emailing [email protected]. Depending on where you live (e.g. GDPR, CCPA), you may also have the right to object to processing or lodge a complaint with your local data-protection authority.

7. Data deletion via TikTok

You can also trigger deletion from inside TikTok. When you remove Carousel Draft from your TikTok authorized apps, TikTok calls our data-deletion callback endpoint (HTTPS), and we erase your linked data within 72 hours as required by the TikTok developer policy.

8. Third parties & AI

Generated images are produced by a third-party AI image provider solely to fulfill your request. Your data may be processed by our hosting provider for delivery. Each processor is bound by data-protection terms.

9. Cookies & local storage

Carousel Draft uses a single first-party session/login token and browser local storage to remember you. No advertising or tracking cookies are used.

10. Children

Carousel Draft and the TikTok Content Posting API are not intended for users under the age required by TikTok in your region (typically 13, 16 in the EEA/UK). We do not knowingly process data from younger users.

11. Security

Access tokens are stored encrypted and transmitted only over HTTPS. No system is perfectly secure, but we apply industry-standard safeguards.

12. Changes

We may update this policy; the "last updated" date above will change. Material changes are announced in the app.

← Back to Carousel Draft