ReelFlow · Legal

Privacy Policy

Effective as of September 16, 2026. This policy describes what information we collect, how we use it, and the rights you have over it.

1. Who we are

ReelFlow is operated by Reel Flow Media LLC. For any privacy-related inquiries, write to hello@reelflowmedia.com.

2. Information we collect

To deliver the service, we collect and process the following categories of data:

• Account data: name, email, company, and phone number when you provide it.
• Payment data: processed directly by Stripe. We do not store card numbers — we only receive non-sensitive identifiers and metadata.
• Third-party connections: encrypted (AES-256) OAuth tokens for YouTube, Facebook, and Google Drive that are required to access the material you authorize us to process.
• Content material: the videos, audio, images, and associated metadata you authorize us to process.
• Usage data: technical logs, IP addresses, user-agent, and application events for security, debugging, and service improvement.
• Facebook Page audit data: Facebook user ID, granted permissions, Page IDs, names and access tasks; published video records; aggregate Page Insights and available estimated earnings for the Pages you select.

3. How we use your information

• To deliver the contracted service and produce the generated content.
• To display authorized Facebook Pages and on-demand reports of their content, aggregate performance and available estimated earnings.
• To process payments, billing, and subscription administration.
• To send transactional and support communications.
• To detect fraud, abuse, or breaches of the Terms.
• To comply with legal obligations or requirements from competent authorities.
• To improve the service and develop new features, always with aggregated or anonymized data.

4. Third parties we share with

We only share data with providers we need to operate the service, under data processing agreements:

• Stripe — payment processing and billing.
• Supabase — database and authentication.
• Vercel — hosting and infrastructure.
• Google (YouTube Data API, Drive) — access to your material under your authorization.
• Meta (Facebook Graph API) — authorized publishing and, through the separate audit integration, Page content and analytics.
• Resend / Mailgun — transactional email delivery.
• AI providers — for analysis, copy generation, brand-safety, and transcription.

We do not sell or rent your data to third parties for advertising purposes.

5. Cookies and similar technologies

We use cookies strictly necessary for session, authentication, and fraud prevention. We do not use third-party advertising cookies.

6. Security

We apply reasonable technical and organizational controls — encryption in transit (TLS 1.3) and at rest (AES-256 for tokens), role-based access control, audit logs, environment separation, and periodic security reviews. No system is completely immune; if you detect a vulnerability, report it to hello@reelflowmedia.com.

7. Your rights

Depending on your jurisdiction, you may have the right to access, rectify, delete, object to, or obtain a portable copy of your personal data. To exercise these rights, write to hello@reelflowmedia.com from the email associated with your account. We will respond within the timeframes mandated by applicable law.

8. Data retention

We retain account and operational data for the duration of the subscription and for a reasonable period afterward to comply with legal, tax, or rights-defense obligations. Processed material is retained as long as necessary to deliver the service and, unless legally required otherwise, is deleted within ninety (90) days following cancellation.

Facebook audit reports are requested on demand and are not stored as report history. Saved audit connections contain Page identifiers, granted permissions and encrypted tokens until disconnected or deleted. Temporary authorization records expire after ten minutes. Deletion receipts contain a random confirmation code and completion timestamp and are retained for up to 90 days.

9. Minors

The service is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If you detect that a minor has provided us with data, contact us to delete it.

10. International transfers

Your data may be processed on servers located in the United States or other jurisdictions where our providers operate. When applicable, we use Standard Contractual Clauses or other legal mechanisms to ensure an adequate level of protection.

11. YouTube API Services

ReelFlow uses YouTube API Services only for features the customer explicitly connects. Read access identifies the selected channel and its videos for content processing. Upload access sends customer-authorized clips to the selected destination channel. Google Drive and Sheets access delivers generated files and maintains the customer's publishing log. By using our service, you also agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. You can revoke ReelFlow’s access to your YouTube data at any time at security.google.com/settings/security/permissions. If you disconnect Google inside ReelFlow, we revoke the grant immediately and delete the OAuth credentials, Google account identifiers, and YouTube, Drive, and Sheets data stored under that grant. This does not delete videos or files that already exist in YouTube or Google Drive. If you revoke access from Google's security settings, our periodic authorization check deletes the associated API data as soon as the revocation is detected and no later than 30 calendar days. A direct deletion request is completed as soon as possible and within 7 calendar days. Other stored YouTube API data is refreshed or deleted at least every 30 days as required by YouTube's Developer Policies.

ReelFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide or improve the user-facing features that the customer selects in ReelFlow. We do not use Google user data for advertising, sell it, determine creditworthiness, or train generalized or non-personalized AI or machine-learning models. Any transfer to a service provider is limited to what is necessary to operate the selected feature and is subject to confidentiality and security obligations. Humans do not read Google user data except with the user's affirmative agreement for support, when required for security, or when required by law.

12. Meta (Facebook) data

ReelFlow offers two Facebook integrations. The publishing integration uses permissions such as pages_manage_posts, pages_manage_metadata,pages_show_list, pages_read_engagement andbusiness_management to support authorized content operations.

The separate ReelFlow Auditoría integration uses Facebook Login for Business.pages_show_list displays the Pages you authorize and their access tasks; you explicitly select which eligible Pages to save. pages_read_engagementretrieves published video records, descriptions, dates and links.read_insights retrieves aggregate Page metrics and available estimated earnings for a selected date range. Facebook also provides an app-scoped user ID through basic login access so we can associate and delete the authorized connection. The audit integration does not publish content or manage ads.

Audit data is used to provide your requested report, not for advertising, sale, or external audience profiling. Estimated earnings are not confirmed payouts; unavailable metrics are identified in the report. Vercel processes the audit requests and Supabase stores the connection records and encrypted tokens. The audit report flow does not send its data to AI providers.

Tokens are encrypted at rest. Access is limited to the signed-in account that saved the connection; reconnecting may be necessary if Facebook access expires or changes. You can remove a saved audit Page using Eliminar la conexión de esta página on the audit screen, or revoke the integration through Facebook Business Integrations. See the deletion instructions below for the scope of each action.

13. Data deletion

You can request complete deletion of your data at any time. Detailed instructions at /data-deletion.

14. Changes to this policy

If we materially update this policy, we will notify you by email or within the product before the changes take effect.