Privacy policy: Carousel Studio
Last updated: 19 October 2026
Carousel Studio is a browser tool at visual-ideas.eu/apps/carousel-studio for building a carousel deck and downloading it as a PDF and a set of images. This policy explains what the tool does with your data. The rest of the website is covered by the site privacy policy.
1. Who I am
Carousel Studio is published by me, Cristian Istrate, an independent developer (private individual), Str. Lalelelor, Nr. 4, bl. A10, Sc. 1, Bragadiru, Ilfov 077025, Romania. For anything in this policy, including your data rights, contact support@visual-ideas.eu.
For the purposes of the EU General Data Protection Regulation (GDPR), I am the data controller for the processing described below.
2. The short version
- There are no accounts and no sign-in.
- The editor runs in your browser. Your current deck and the last AI-generated deck are kept in your browser's local storage, not on the site’s servers.
- AI generation sends the text you paste, or the text of the page you ask me to read, to DeepSeek, which is located in China. Do not paste personal or confidential information.
- I do not store the source text you submit or the deck you build.
- A photo story searches stock photos on Pixabay from the site’s server. Your search words go to Pixabay, and the previews load from Pixabay's servers.
- Payments are handled by PayPal. I never see your card details.
- The only records I keep are short-lived abuse counters, a minimal order record and download-code records.
3. What stays in your browser
Carousel Studio keeps its working state in your browser. I cannot read it.
| Browser storage | What it holds | How long |
|---|---|---|
| localStorage | The current deck, so the editor can restore it when you return | Until you clear your browser's site data |
| localStorage | The last AI-generated deck, so you can load it again from the sample picker | Until you clear your browser's site data |
| localStorage | Your AI-consent choice, so the checkbox stays ticked | Until you clear your browser's site data |
| localStorage | A purchase reference (order id, window expiry and downloads left) so a paid order can be resumed | 24 hours |
| sessionStorage | A download code for the current tab session | Until the tab is closed |
Clearing your browser's site data removes the local copy of your deck, the stored purchase reference and the download code.
4. AI generation and DeepSeek
When you use AI generation, the text you paste, or the text I read from the page whose URL you give me, is sent to the site’s server and then to the DeepSeek API. DeepSeek is located in China, outside the European Union and the European Economic Area. If you do not want your text processed there, do not use AI generation.
Do not paste personal, confidential or sensitive information into the AI form, and do not point it at a page that contains such information.
I use the text only to produce the draft deck you asked for. I do not store the source text or the deck on the site’s servers once the request has been answered.
Reading a page from a URL
When you give me a URL, the site’s server fetches the page; your browser does not. Nothing about you — your IP address, cookies or browser details — is sent to the site being read. That site sees a request from the site’s server, not from you.
5. Abuse limits and Turnstile
To keep the free AI generation, payments and download-code checks available, I apply daily limits. The limit record is keyed by a salted hash of your IP address; I do not store raw IP addresses. The record is automatically deleted after two days.
The AI and payment/download forms are protected by Cloudflare Turnstile, which distinguishes people from automated traffic. Cloudflare processes the technical signals needed for the challenge. I receive only a pass or fail result, and I do not use it to identify you.
6. Legal basis
- AI generation: performing the service you request (GDPR Article 6(1)(b)).
- Transfer to DeepSeek in China: your explicit consent, given through the checkbox before generation (Article 49(1)(a)). There is no EU adequacy decision for China. You can withdraw this consent by not using AI generation.
- Abuse counters and Turnstile: my legitimate interest in preventing abuse (Article 6(1)(f)).
- Orders and download codes: performing the purchase (Article 6(1)(b)).
DeepSeek may keep requests under its own privacy policy: DeepSeek privacy policy.
7. Payments and order records
Paid downloads are bought through PayPal. Your card or bank details go to PayPal and never reach me.
For each paid order I keep a record containing the amount, the order status, the PayPal reference and a one-way fingerprint of the deck. The record contains no name, email address, IP address or deck content. I keep it for 180 days and then delete it.
The purchase reference in your browser's local storage lasts 24 hours. It lets you resume a paid order in the same browser.
8. Photos for a photo story
A photo story uses stock photos from Pixabay. When you search or when the AI generation asks for a photo, your search words leave the site’s server and go to the Pixabay API; I never send them from your browser. Pixabay returns the photo addresses, which your browser then loads directly from Pixabay's servers so that you can see the preview.
Search results are cached on the site’s server for 24 hours, as Pixabay requires. A deck keeps only the Pixabay image id, the photographer's name and the link to the image page, so the credit line and the credits file stay correct. The image itself is downloaded and embedded when you export, so neither your PDF nor your ZIP depends on Pixabay staying reachable.
If you paste your own image address, the site’s server downloads it under the same safety rules as any other image: public address only, no redirect to a private network, size and image type checked. The address is not stored anywhere except inside your own deck, and the images are used only to build your download.
Photo search is rate-limited per visitor using the same salted IP hash as the other limits, and it is protected by Turnstile.
9. Download codes
The record for a download code holds its download allowance, how many downloads have been used and any expiry date. The code itself is stored only as a one-way fingerprint, so I cannot read it back to you.
10. Generated PDF and images
One ZIP is generated on the site’s server from the deck you submit, then sent back to your browser. It holds the PDF, one PNG per page, the receipt and the LinkedIn post text. None of it is stored on the site’s server after it has been sent.
The post text uses the version you last saw in the post window, including any edits you made there. That text is used only to build the file and is not stored.
11. Your rights
Where the GDPR or the UK GDPR applies, you have the right to:
- access the personal data I hold about you;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict or object to my processing;
- data portability;
- withdraw consent at any time; and
- lodge a complaint with a supervisory authority.
In Romania the supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro).
To exercise any of these rights, email support@visual-ideas.eu. I will respond within one month.
12. Children
Carousel Studio is not directed to children. I do not knowingly collect their personal data.
13. Changes to this policy
If this policy changes materially, the "Last updated" date above will change. Continued use of Carousel Studio after that means you accept the updated policy.
14. Contact
Cristian Istrate, private individual, Str. Lalelelor, Nr. 4, bl. A10, Sc. 1, Bragadiru, Ilfov 077025, Romania. Email: support@visual-ideas.eu.