Privacy Policy
This is an English translation provided for convenience. In case of any discrepancy, the French version prevails.
Last updated: October 20, 2026
This policy explains what personal data the C4slide app and the appc4.com website ("the Service") collect, why, for how long, and how to exercise your rights.
1. Data controller
ATK Network. See also the Legal notice.
Contact for any question about your data: [email protected].
2. Data collected
| Data | Where it comes from | Why |
|---|---|---|
| Email address, password (stored encrypted) | Account creation | Create and secure your account |
| Role, credit balance, trial used, credit history | Use of the Service | Manage your credits and your access to features |
| Screenshots of product pages | Sent by you | Extract product info and generate the carousel |
| Generated carousels (images, titles, captions) and chosen settings | Generated by the Service | Display them in your history |
| Photos of you for the realistic avatar | Sent by you | Generate images in which you appear |
| Web searches for product photos | Entered by you | Find photos of the product |
| Link and ID of your TikTok posts, TikTok login tokens (when the feature becomes available) | TikTok connection | Send your carousels as drafts and find your posts |
| Technical data (error logs, device type, app version) | Automatic | Operate the Service and fix bugs |
We do not collect your location or your contacts. We do not use advertising trackers, do not track you across apps and do not sell any data (see "Cookies and trackers").
Photos of you: they are used solely to generate your images. They are not used to identify you or recognize your face, and are never shared with other users.
3. Legal bases
- Performance of the contract (the Terms of Use, Article 6.1.b of the GDPR): account, carousel generation, including sending your content to OpenAI, which produces the text and images, credits, history, avatar, TikTok posting.
- Consent: sending your photos for the realistic avatar. You can withdraw it at any time by deleting the avatar.
- Legitimate interest: promotion of the Service through the appc4.com showcase (you can object at any time by requesting removal, Article 11 of the Terms of Use), security, abuse prevention, improvement of the Service.
4. Who receives your data
Only our service providers, to operate the Service:
| Provider | Role | Location |
|---|---|---|
| Supabase | Accounts, database, image storage, servers | EU (Paris) |
| OpenAI | Reading screenshots, writing text, generating images | United States |
| Serper.dev | Web search for product photos | United States |
| Kalodata (Kalowave) | Selling points of a TikTok Shop product from its link: only the product number is sent, no personal data | Outside the European Union |
| TikTok | Posting as drafts (if you connect your account) | United States / Singapore (TikTok) |
| Apple | App distribution | United States |
| Cloudflare | Hosting and security of the appc4.com website, and temporary private storage of C4 Post videos and thumbnails (Cloudflare R2), deleted after posting and at the latest after 3 days | Worldwide |
| Meta (Instagram) | C4 Post: posting members' Reels, reading "LIEN" comments and sending the link by private message | Ireland / United States |
| Google (YouTube) | C4 Post: posting members' Shorts | United States |
Sending to OpenAI: to generate a carousel, the app sends OpenAI (United States) the screenshots, the product photos, your avatar photos if you use one, and the text you enter or edit. OpenAI processes them to produce the text and images, then sends them back to the Service. This data is therefore transferred to the United States. Your consent is requested when you sign up (or once before the first sending for accounts created before October 7, 2026); without this consent, generation is not possible.
OpenAI does not use data sent through its API to train its models. It may keep it for up to 30 days to detect abuse, then deletes it.
Transfers outside the European Union are governed by the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
Website showcase: when you send a carousel to TikTok from the app, we keep its first slide on our servers, with private access, for the appc4.com showcase. If the draft is never posted on TikTok, this image is deleted within 48 hours. If it is not selected for the showcase, it is deleted within 14 days. If it is selected, it is displayed on appc4.com with a link that opens your post on TikTok, where your username is visible; the website displays no other information about you. It stays displayed until you request its removal (Article 11 of the Terms of Use) or delete your account. Carousels that contain an avatar are never displayed.
5. Retention period
| Data | Period |
|---|---|
| Account, credits, history | As long as the account exists. Deleted within 30 days after the account is deleted |
| Screenshots | Used during generation, not stored on our servers |
| Generated carousels | As long as you keep them in your history or until the account is deleted |
| Avatar photos | Until the avatar or the account is deleted |
| TikTok tokens | Until you disconnect from TikTok or the account is deleted |
| Technical logs | 12 months maximum |
| Inactive account | Deleted after 3 years without login, following a warning email |
| First slide kept for the showcase | 48 hours if the TikTok draft is not posted; 14 days if it is not selected; otherwise until you request its removal or delete your account |
6. C4 Post (reposting to Instagram and YouTube)
C4 Post is a private tool of the C4 suite, reserved for a few members. It reposts their own videos to Instagram and YouTube.
For members who connect their account:
- We keep the Instagram and YouTube connection tokens, encrypted, to post on their behalf. They are deleted as soon as the Instagram or YouTube account is disconnected.
- We keep the posting schedule: video, date, caption, product link, Instagram and YouTube post identifiers. It is kept until the C4 account is deleted, except the YouTube video IDs, which are deleted when YouTube is disconnected (see below).
- Videos and thumbnails waiting to be posted are stored temporarily, with private access, at Cloudflare (R2). They are deleted after they are posted, and at the latest after 3 days.
For people who comment on our Instagram Reels: when you write "LIEN" under a Reel posted with C4 Post, we read that comment to detect the request. We then send you a single private message with the product link, followed by a short public reply under your comment. We only keep the comment identifier, so that we do not reply to you twice, and we delete it after 7 days. We keep neither the text of the comment, nor your username, nor your messages. We do not read private messages and never send you any other message. This processing is based on your request: by writing "LIEN", you are asking us for the link. You can exercise your rights as described in "Your rights".
YouTube: C4 Post uses YouTube API Services. When a member connects their channel, we read the channel ID and channel name, to show the linked channel; they are read again every day to stay up to date. We also keep the IDs of the videos posted by C4 Post, to track their status. This data is used only to post the member's videos to their own channel. It is never shared or sold. When the member disconnects in C4 Post, we revoke access at Google and immediately delete the tokens, the channel ID and name, and the video IDs. The only exception: a video still being uploaded at that moment keeps its ID until the upload ends, then it is deleted within one hour, to avoid a duplicate upload. If access is removed from the Google account, the same data is deleted at the daily check, and within 30 days at the latest. By connecting your channel, you agree to the YouTube Terms of Service. Your data is also processed under the Google Privacy Policy. You can revoke C4 Post's access at any time on the permissions page of your Google account. Contact: [email protected].
Providers: Meta (Instagram), Google (YouTube) and Cloudflare (temporary video storage).
| Data | Retention |
|---|---|
| Instagram and YouTube tokens (encrypted), YouTube channel ID and name (refreshed daily) | Until disconnection, or at the latest 30 days after access is removed from the Google account |
| IDs of posted YouTube videos | Until YouTube is disconnected or access is removed (at most 1 hour after an ongoing upload ends; at the latest 30 days if access is removed from the Google account) |
| Schedule and Instagram post identifiers | Until the C4 account is deleted |
| Videos and thumbnails to post (Cloudflare R2) | Deleted after posting, at the latest after 3 days |
| Identifier of a processed "LIEN" comment | 7 days |
7. Your rights
At any time, you can:
- access your data and obtain a copy of it;
- have it rectified or erased;
- object to processing or request its restriction;
- retrieve your data in a readable format (portability);
- withdraw your consent (avatar);
- give instructions on what happens to your data after your death.
Deleting your account from the app (My account > Delete my account) erases your data. For any other request, write to [email protected]. We respond within one month.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr).
8. Security
Communications are encrypted (HTTPS). Passwords are stored encrypted. The keys for the AI services stay on our servers and are never in the app. Each user can only access their own data.
9. Cookies and trackers
On the appc4.com website, we do not use advertising cookies, audience measurement tools or embedded social networks. Only strictly necessary trackers are used, which do not require your consent:
- a security cookie from our hosting provider Cloudflare, which protects the website against bots (duration: 30 minutes);
- storage of your login in your browser when you open "My account" (until you log out).
You can delete them in your browser settings; you will then need to log in again.
In the app, we do not track you across apps or websites, we do not use any advertising identifier and we do not share your data with data brokers or advertising networks. The app only keeps on your iPhone what it needs to work (your session, your settings, your drafts).
If we ever add a tracker that requires consent, we will ask for your permission before activating it and will update this page.
10. Minors
The Service is reserved for people aged 18 or over. We do not knowingly collect data about minors.
11. Changes
We may change this policy. In the event of a significant change, we will notify you in the app.