Privacy
Effective date: October 20, 2026
1. WHO WE ARE
1.1 Controller. WorkCarousel is a social network about work, operated by HR Data Labs LLC, doing business as WorkCarousel, of PO Box 222, Sugar Loaf, NY 10981 (“WorkCarousel,” “we,” “us” or “our”). We decide how and why the personal information described in this policy is processed, and we are responsible for it.
1.2 Contact. You can reach us about privacy at support@workcarousel.com or at the postal address in Section 25.
2. SCOPE OF THIS POLICY
2.1 What it covers. This policy explains how we collect, use, share and protect personal information when you use the WorkCarousel mobile app, the website at https://workcarousel.com, and the web version of the app and our advertising site, wherever they are hosted (together, the “Service”), and the choices and rights you have.
2.2 Where the Service is offered. The Service is for adults aged 18 and over. The app is currently distributed in the United States and Nigeria. Before we make it available in other countries, we will update this policy where the law of those countries requires it.
2.3 Related documents. Our Terms of Use at https://workcarousel.com/terms, Content Policy at https://workcarousel.com/content-policy and Child Safety Standards at https://workcarousel.com/child-safety explain the rules for using the Service. Capitalized terms not defined here, such as Cohort, Jury, Review Room and The Floor, have the meanings in the Terms of Use.
2.4 Business customers. This policy also covers the personal information of people who manage company pages or buy Company Studio or advertising on behalf of a business.
3. INFORMATION YOU GIVE US
3.1 Account information. When you create an account, we collect your name or chosen handle, your email address and your date of birth. We use your date of birth to confirm that you are at least 18.
3.2 Profile and career information. Your profile photo, the career chapters you add (such as employers, schools, volunteer roles, organizations and camps), and the shelf items you add, such as links to podcast episodes and other media.
3.3 Content. The posts you write, including photos and videos, the mood and format you choose for each post, comments, reactions, messages and Water Cooler conversations, the rooms you join, and any place you choose to tag.
3.4 Company page information. If you claim a company page, the work email address used to verify the company’s domain, and your activity managing the page and its roster.
3.5 Business purchase information. If you buy Company Studio or advertising, billing contact details, campaign settings and the content of your ads. Card details are collected directly by our payment processor; we do not store full card numbers.
3.6 Communications. What you send us, such as support requests, reports, appeals, removal requests and requests about your personal information.
4. INFORMATION CREATED THROUGH YOUR USE OF THE SERVICE
4.1 Activity. Records of how you use the Service, such as the Cohorts you belong to (which form automatically from your career chapters), the members you block, and your Quiet mode status.
4.2 Settings. Your choices, including whether you have chosen to see posts tagged NSFW.
4.3 Moderation records. Reports you make or receive, Jury votes you cast, the results of automated screening, moderator decisions, and appeals.
4.4 Advertising records. Counts of views of sponsored cards. We count views ourselves.
5. INFORMATION COLLECTED AUTOMATICALLY
5.1 Technical information. When your device connects to our servers, our hosting and delivery providers receive technical information such as your IP address, device type, operating system, app version, and the date and time of each request.
5.2 Diagnostic information. If the app crashes or encounters an error, diagnostic and crash data about the app and your device.
5.3 No analytics or cross-site tracking. We do not currently use analytics tools, and we do not track your activity across other companies’ apps or websites.
6. INFORMATION FROM OTHERS
6.1 App stores and subscription provider. If you subscribe to Quiet mode, we receive your subscription status (for example, active, renewed or cancelled) from Apple or Google through our subscription provider. We do not receive your app store payment details.
6.2 Payment processor. For Company Studio and advertising purchases, our payment processor tells us whether a payment succeeded.
6.3 Other members. Other members may provide information about you, for example by mentioning you in a post or message, by reporting your Content, or by casting a Jury vote about it.
7. WHAT STAYS ON YOUR DEVICE
7.1 Résumé files. If you import a résumé PDF, it is parsed entirely on your device. The file is never uploaded to our servers or to any third party. Only the chapter entries you individually approve are saved to your profile.
7.2 Location. We do not track your location. If you choose to tag a place, the app takes a single reading at roughly 2-mile accuracy, saves only the approximate place you tag with that post, and does not keep the reading afterward.
7.3 Linked media. Linked media on a member’s shelf, such as YouTube or Spotify content, makes no network request to the hosting service until you press play. Scrolling past sends nothing.
8. HOW WE USE INFORMATION
8.1 Purposes. We use personal information to:
create and run your account, and show your profile and Content to other members;
form Cohorts from your career chapters and show you Content from your rooms and Cohorts;
screen Content before it goes live and enforce our Terms of Use, Content Policy and Child Safety Standards;
handle reports, Jury votes, appeals, removal requests and support requests;
verify company pages and run Company Studio;
show sponsored cards, count their views and report total views to advertisers;
process subscriptions and purchases;
keep the Service and its members safe and secure, detect and prevent fraud, abuse and ban evasion, and fix problems;
send you service, security and policy messages; and
comply with the law, respond to valid legal process, and establish or defend legal claims, including reporting to the National Center for Missing & Exploited Children (“NCMEC”).
8.2 No sale and no profiling for advertising. We do not sell personal information, and we do not use it to build advertising profiles about you.
9. AUTOMATED SCREENING AND AI TOOLS
9.1 What is screened. Before a post, photo, video or profile photo goes live, it is checked by automated tools.
9.2 Who performs it. We do not screen photos and videos on our own systems. We send them to AI models provided by two outside companies: photos and profile photos are checked by OpenAI’s moderation model, and videos are checked by Google’s Gemini model. Text in posts is also checked by automated tools.
9.3 How your Content reaches them. These requests are routed through the Rork Toolkit, an AI gateway service. Your photos and videos therefore pass through Rork’s systems on their way to OpenAI or Google, and the results come back the same way.
9.4 What these companies may do with it. OpenAI, Google and Rork are our service providers under Section 15 and receive your photos and videos in order to screen them for us. Section 15.2 limits what they may do with your information, and Section 18.3 explains that they may keep limited copies, such as logs, for short periods. They are based in the United States and may process Content in other countries, as Section 17 explains.
9.5 What the result means. The result decides whether a post can go live as written, must be tagged NSFW or edited first, or is held for a moderator. Photos and videos flagged as sexual or graphically violent, and anything the tools cannot assess, are held for a moderator. Profile photos that fail screening are refused.
9.6 Human review. A person reviews everything that is held. If you think a screening decision about your Content is wrong, email support@workcarousel.com and a moderator will review it.
9.7 No other automated decisions. We do not use automated decision-making to make decisions about you that have legal or similarly significant effects.
10. MODERATION, REPORTS AND THE JURY
10.1 Reported Content. When Content is reported, it enters the Review Room and may be shown, with its author’s name or handle, to members of the relevant room as part of a Jury vote, and to our moderators.
10.2 Reporters. We do not show Jury members who made a report.
10.3 Sensitive reports. Reports about child safety, or about intimate images shared without consent, go only to our moderators and are never shown to a Jury.
10.4 Jury confidentiality. Jury members must not copy or share what they see in the Review Room.
11. WHAT OTHER MEMBERS CAN SEE
11.1 Public to members. Your name or handle, profile photo, career chapters, Cohort memberships, posts (with their mood, format and any tagged place), comments and reactions are visible to other members. Posts tagged NSFW are visible only to members who have chosen to see them.
11.2 Messages. Messages are visible to the people you send them to.
11.3 Company pages. If you appear on a company page roster because of your career chapters, the company can see your profile as a roster member. A company can feature your work only with your consent.
11.4 Think before you post. Because most members post under their real names, colleagues, managers and future employers may see what you share. Content other members have copied or recorded outside the Service is beyond our control.
12. ADVERTISING, QUIET MODE AND PAYMENTS
12.1 Contextual ads only. Sponsored cards are sold at a fixed price per thousand views and are labeled as sponsored. They are matched only to the post being viewed, never to your profile, your own posts or your activity elsewhere, and they never appear on posts tagged NSFW.
12.2 What advertisers receive. Advertisers receive only total view counts. We do not give advertisers your personal information.
12.3 Quiet mode. Members who subscribe to Quiet mode see no sponsored placements on The Floor. Quiet mode is processed by Apple or Google, which handle your payment under their own privacy policies.
12.4 Business payments. Company Studio subscriptions and advertising campaigns are processed by our card payment processor.
12.5 Do Not Track. Because we do not track you across other sites or apps, the Service does not change how it works in response to browser Do Not Track signals. We do not allow advertisers or other third parties to collect personal information about your activity on the Service for their own purposes.
13. ADULTS ONLY
13.1 Age requirement. The Service is for people aged 18 and over. Everyone signing up must give a date of birth, and anyone under 18 cannot create an account.
13.2 Minors’ information. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will close the account and delete the information, except where we must keep it under our Child Safety Standards or the law.
13.3 Tell us. If you believe a member is under 18, contact us at support@workcarousel.com.
14. HOW WE SHARE INFORMATION
14.1 Our approach. We do not sell personal information and do not share it for advertising targeted on the basis of activity across other companies’ apps or websites. We share personal information only as described in this Section 14 and in Sections 15 and 16.
14.2 Other members. As described in Section 11.
14.3 Apple and Google. When you subscribe to Quiet mode, Apple or Google processes your purchase under its own privacy policy.
14.4 Business transfers. If our business is sold, merged, financed or reorganized, personal information may be transferred to the buyer, successor or financing party, subject to confidentiality obligations, and this policy will continue to apply to it.
14.5 With your direction. We share information when you ask us to, for example when you consent to a company featuring your work.
15. OUR SERVICE PROVIDERS
15.1 Who they are. We use service providers that process personal information for us to run the Service:
Supabase: database and file storage;
Vercel: hosting;
Cloudflare: content delivery, feed, moderation and ad serving;
Resend: email delivery;
RevenueCat: subscription management with Apple and Google;
the Rork Toolkit service: the AI gateway through which your photos and videos pass to OpenAI and Google for automated screening, under Section 9;
OpenAI: automated screening of photos and profile photos, under Section 9;
Google (Gemini): automated screening of videos, under Section 9;
Rork: hosting of the web version of the app and our advertising site;
our crash reporting provider, _______________: diagnostic and crash data; and
our card payment processor, _______________: Company Studio and advertising payments.
15.2 Limits on their use. Our service providers may use personal information only to provide their services to us and as their contracts with us allow.
16. LEGAL AND SAFETY DISCLOSURES
16.1 Child safety. We report apparent child sexual abuse material and other apparent child sexual exploitation to NCMEC as U.S. federal law requires. NCMEC may share reports with law enforcement.
16.2 Legal process. We disclose personal information where we believe in good faith that the law requires it, including in response to a valid subpoena, court order or other legal process.
16.3 Protection. We disclose personal information where we believe in good faith that it is necessary to prevent death or serious harm to any person, to investigate fraud, abuse or security incidents, or to protect the rights, property and safety of WorkCarousel, our members or others.
17. WHERE INFORMATION IS PROCESSED
17.1 United States. We and our service providers store and process personal information in the United States, and our service providers may process it in other countries where they or their own providers operate. This includes the photos and videos sent for screening under Section 9.
17.2 Nigeria. Some members of our team work from Nigeria and may access personal information from there to operate and support the Service.
17.3 Protection wherever processed. Wherever personal information is processed, we protect it as this policy describes. Section 24 explains transfers of personal data of users in Nigeria.
18. HOW LONG WE KEEP INFORMATION
18.1 Default rule. We keep your account information and Content until you delete it or close your account.
18.2 Longer periods. We keep some information longer, for the following periods:
records of Content removed for breaking our rules, reports about an account, and the information needed to stop a removed member from rejoining: up to 1 year after the action;
material reported to NCMEC: at least 1 year after the report, as federal law requires, and longer if law enforcement asks us to or the law permits;
billing records for Company Studio and advertising purchases: 7 years, for tax, accounting and audit purposes;
support emails: up to 2 years after the issue is closed;
server and security logs: up to 90 days; and
anything we must keep to comply with a legal obligation or court order, or to establish or defend legal claims: for as long as that requires.
18.3 Service providers. Our service providers may keep limited copies, such as logs, for short periods under their own retention practices.
18.4 De-identified information. We may keep information that has been de-identified so that it can no longer reasonably be linked to you, and we will not try to re-identify it.
19. DELETION AND BACKUPS
19.1 Deleting Content. You can delete any post, career chapter or shelf item at any time from within the app. It is removed from the Service right away.
19.2 Deleting your account. You can delete your account from your profile settings in the app. If you cannot open the app, email support@workcarousel.com from your account email address with the subject line “Delete my account,” and we will delete it within 7 days. Our deletion page at https://workcarousel.com/deleteme explains the process.
19.3 What deletion removes. Deleting your account removes your profile, name or handle, email address and date of birth; your career chapters and Cohort memberships; your posts, reactions, comments, messages, Water Cooler conversations and shelf items, including photos and videos; and your appearance on any company page roster.
19.4 Backups. Deleted information leaves our live systems right away and is removed from all backups within 30 days. We keep backups for up to 30 days and use them only to repair or restore the Service.
19.5 Exceptions. Deletion does not affect the information described in Section 18.2, which we keep for the periods stated there.
20. SECURITY
20.1 Our measures. We use reasonable technical and organizational measures designed to protect personal information, appropriate to its sensitivity, and we restrict access to reported material to the staff who need it.
20.2 No guarantee. No system is completely secure, and we cannot guarantee the security of information.
20.3 Breaches. If a breach affects your personal information, we will notify you and the authorities where the law requires.
20.4 Your part. Keep your login secure, and tell us promptly at support@workcarousel.com if you believe your account has been accessed without your permission.
21. YOUR CHOICES
21.1 Sensitive content. Posts tagged NSFW are hidden by default. You can choose to see them, and change that choice at any time.
21.2 Your Content and profile. You can edit or delete your posts, career chapters and shelf items at any time.
21.3 Location. Tagging a place is optional.
21.4 Blocking. You can block any member.
21.5 Ads. You can remove sponsored placements by subscribing to Quiet mode.
21.6 Featuring. You can decline, or withdraw, consent for a company to feature your work.
22. YOUR PRIVACY RIGHTS
22.1 Rights for all users. Wherever you live, you can ask us to tell you what personal information we hold about you and give you a copy, to correct it, or to delete it.
22.2 How to ask. Email support@workcarousel.com from your account email address. You may also ask through an authorized agent, from whom we may require proof of your permission.
22.3 Verification. We will verify your request, usually by confirming that it came from your account email address, and may ask for more information where needed to protect your account.
22.4 Response. We respond within 45 days. Where reasonably necessary, we may extend that period once by a further 45 days and will tell you if we do.
22.5 Appeals. If we decline your request in whole or in part, we will explain why, and you can appeal by replying to our decision. If you live in a U.S. state whose privacy law gives you the right to complain to its Attorney General, we will tell you how to do so if your appeal is declined.
22.6 No discrimination. We will not treat you differently for exercising your rights.
22.7 Limits. We may decline a request where the law permits, for example where we cannot verify it, or where the information is kept under Section 18.2.
23. CALIFORNIA RESIDENTS
23.1 Application. This Section 23 adds to the rest of this policy for California residents.
23.2 Categories collected. In the last 12 months we have collected these categories of personal information listed in the California Consumer Privacy Act (“CCPA”):
identifiers, such as name or handle, email address and IP address;
customer records, such as billing contact details;
professional or employment-related information, such as your career chapters;
internet or other electronic network activity, such as how you use the Service and technical logs;
approximate geolocation, only when you tag a place;
audio, electronic and visual information, such as photos and videos you post; and
the contents of your posts and messages.
23.3 Sources, purposes, recipients and retention. We collect this information from the sources described in Sections 3 to 6, use it for the purposes in Section 8, disclose it for business purposes to the recipients in Sections 14 to 16, and keep it for the periods in Sections 18 and 19.
23.4 Sensitive personal information. Some of this information, such as your account login and the contents of your messages, is sensitive personal information under California law. We use it only to provide the Service and for other purposes California law permits, and not to infer characteristics about you.
23.5 No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
23.6 Your rights. To the extent the CCPA applies to us, California residents have the right to know what personal information we collect, use and disclose and to access it; to correct and delete it; to opt out of its sale or sharing, which we do not do; and not to be discriminated against for exercising these rights. Section 22 explains how to make a request.
23.7 Direct marketing. We do not disclose personal information to third parties for their own direct marketing purposes.
24. USERS IN NIGERIA
24.1 Application. If you use the Service in Nigeria, the Nigeria Data Protection Act 2023 applies to our processing of your personal data, and this Section 24 applies to you.
24.2 Lawful bases. We process your personal data where it is necessary to perform our contract with you by providing the Service; to comply with our legal obligations; for our legitimate interests in keeping the Service safe, preventing abuse and improving the Service, where those interests are not overridden by your rights; and with your consent where we ask for it, such as when you choose to tag a location. You may withdraw consent at any time.
24.3 Your rights. You have the right to be informed about and to access your personal data; to have it corrected or erased; to restrict or object to its processing; to receive it in a commonly used, machine-readable format; to withdraw consent; and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you. You can ask for a person to review any automated screening decision about your Content.
24.4 Transfers outside Nigeria. Your personal data is processed outside Nigeria. We are based in the United States, and our service providers, including Supabase, Vercel, Cloudflare, Resend, RevenueCat, Rork, OpenAI and Google, process personal data in the United States and in other countries where they operate. This includes the photos, videos and profile photo you post, which are sent to OpenAI or Google through the Rork Toolkit service for screening under Section 9.
24.5 Basis for transfers. We transfer your personal data outside Nigeria only on a basis the Act permits. Our contracts with service providers restrict how they may use personal data and require them to protect it, so that it receives a level of protection in line with the Act. Where a transfer relies on your consent, we tell you what is being sent and where, and you may refuse or withdraw consent. Some transfers are necessary to perform our contract with you, such as hosting and delivering the Content you post. You can ask us at support@workcarousel.com for information about the safeguards that apply to your personal data.
24.6 Breaches. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you, and we will notify the Nigeria Data Protection Commission as the Act requires.
24.7 Complaints. You can contact us at support@workcarousel.com. You also have the right to complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng.
25. CHANGES AND CONTACT
25.1 Changes. If we make material changes to this policy, we will tell you in the app before they take effect. The effective date at the top shows when this policy last changed.
25.2 Contact. Questions about this policy, or requests about your personal information:
HR Data Labs LLC, doing business as WorkCarousel
Postal address: PO Box 222, Sugar Loaf, NY 10981
Email: support@workcarousel.com