Privacy policy
Last updated 29 September 2026
This policy explains what we collect when you use Carousel Builder, why we need it, who we share it with and what you can ask us to do with it. We keep it to what the service actually needs.
Who we are
Carousel Builder is run by Lava Socials Limited (company number 15337066), Ergo, Bridgehead Business Park, Meadow Road, Hessle, HU13 0GD. We are the controller of your personal data under UK data protection law. For anything in this policy, email contact@lavasocials.com.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Your name, email address and login | To give you an account and keep it secure | Contract |
| Your business details: name, role, area, website, logo, colours and style choices | To write and design carousels and captions for your business | Contract |
| Photos you upload and the carousels and captions you make | To build your carousels, save them for you and post them when you ask | Contract |
| Billing details: billing name, address, VAT number and payment history | To take payment, issue invoices and keep tax records | Contract and legal obligation |
| Social accounts you connect: page and profile names, account IDs, profile pictures and the access keys the platforms give us | To post your carousels to the accounts you choose, at the time you choose | Contract |
| Scheduled posts and their results, such as a link to the live post or the reason it failed | To show you what went out and what needs attention | Contract |
| Pages viewed, features used and error reports | To keep the service working and improve it | Legitimate interests |
| A scrambled (hashed) form of your IP address | To stop the free carousel being claimed over and over | Legitimate interests |
We never sell your data and we do not use it for advertising.
Posting to your social accounts
When you connect Facebook, Instagram or LinkedIn, the platform asks you to approve what Carousel Builder can do. We use that access only to list the pages and accounts you can post to and to publish the carousels you schedule or post. Nothing is posted unless you choose the accounts and press Schedule or Post now.
The access keys are encrypted before they are stored. You can disconnect an account at any time in My carousels under Accounts, which deletes its keys from our systems. You can also withdraw access from the platform's own settings.
Our use of information received from Meta and LinkedIn follows their platform terms and developer policies.
Who helps us run Carousel Builder
We use these providers to run the service. Each only gets what it needs to do its job.
| Provider | What they do | Where |
|---|---|---|
| Netlify | Hosts the website and stores uploaded photos and slide images | USA and EU |
| Neon | Our database | London, UK |
| Clerk | Accounts and logging in | USA |
| Stripe | Payments, subscriptions and invoices. We never see or store your full card number. | UK, EU and USA |
| Anthropic | The AI that writes your slides and captions. It receives your business details, your notes and the photos you add to a carousel. Under its commercial terms it does not train its models on what we send. | USA |
| Meta and LinkedIn | Receive the carousels and captions you choose to post to your accounts | USA, EU and Ireland |
| Google Fonts | Serves the typefaces, so your browser's IP address reaches Google when a page loads | USA |
Where data goes outside the UK, it is protected by the UK's adequacy regulations (including the UK Extension to the EU US Data Privacy Framework) or by the UK International Data Transfer Addendum to standard contractual clauses.
Cookies
We only use cookies the service needs to work: keeping you logged in (set by Clerk), remembering that your free carousel has been used, and protecting the connection to Facebook or LinkedIn while you connect an account. We do not use advertising or tracking cookies, so there is no cookie banner.
How long we keep it
- Your account, business details, carousels and connected accounts: while your account is open. When you ask us to close it, we delete them within 30 days.
- Invoices and payment records: six years, as UK tax law requires.
- The hashed IP address for the free carousel: 30 days.
- Usage and error records: up to 12 months.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email contact@lavasocials.com and we will reply within one month. To delete your data, see Data deletion.
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Children
Carousel Builder is for businesses and is not meant for anyone under 18.
Changes
If we change this policy we will update the date at the top, and tell you by email if the change is significant.