ReelFlow · Legal

Privacy Policy

Effective as of June 15, 2026. This policy describes what information we collect, how we use it, and the rights you have over it.

1. Who we are

ReelFlow is operated by ReelFlow Media LLC. For any privacy-related inquiries, write to hello@reelflowmedia.com.

2. Information we collect

To deliver the service, we collect and process the following categories of data:

• Account data: name, email, company, and phone number when you provide it.
• Payment data: processed directly by Stripe. We do not store card numbers — we only receive non-sensitive identifiers and metadata.
• Third-party connections: encrypted (AES-256) OAuth tokens for YouTube, Facebook, and Google Drive that are required to access the material you authorize us to process.
• Content material: the videos, audio, images, and associated metadata you authorize us to process.
• Usage data: technical logs, IP addresses, user-agent, and application events for security, debugging, and service improvement.

3. How we use your information

• To deliver the contracted service and produce the generated content.
• To process payments, billing, and subscription administration.
• To send transactional and support communications.
• To detect fraud, abuse, or breaches of the Terms.
• To comply with legal obligations or requirements from competent authorities.
• To improve the service and develop new features, always with aggregated or anonymized data.

4. Third parties we share with

We only share data with providers we need to operate the service, under data processing agreements:

• Stripe — payment processing and billing.
• Supabase — database and authentication.
• Vercel — hosting and infrastructure.
• Google (YouTube Data API, Drive) — access to your material under your authorization.
• Meta (Facebook Graph API) — publishing under your authorization.
• Resend / Mailgun — transactional email delivery.
• AI providers — for analysis, copy generation, brand-safety, and transcription.

We do not sell or rent your data to third parties for advertising purposes.

5. Cookies and similar technologies

We use cookies strictly necessary for session, authentication, and fraud prevention. We do not use third-party advertising cookies.

6. Security

We apply reasonable technical and organizational controls — encryption in transit (TLS 1.3) and at rest (AES-256 for tokens), role-based access control, audit logs, environment separation, and periodic security reviews. No system is completely immune; if you detect a vulnerability, report it to hello@reelflowmedia.com.

7. Your rights

Depending on your jurisdiction, you may have the right to access, rectify, delete, object to, or obtain a portable copy of your personal data. To exercise these rights, write to hello@reelflowmedia.com from the email associated with your account. We will respond within the timeframes mandated by applicable law.

8. Data retention

We retain account and operational data for the duration of the subscription and for a reasonable period afterward to comply with legal, tax, or rights-defense obligations. Processed material is retained as long as necessary to deliver the service and, unless legally required otherwise, is deleted within ninety (90) days following cancellation.

9. Minors

The service is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If you detect that a minor has provided us with data, contact us to delete it.

10. International transfers

Your data may be processed on servers located in the United States or other jurisdictions where our providers operate. When applicable, we use Standard Contractual Clauses or other legal mechanisms to ensure an adequate level of protection.

11. YouTube API Services

ReelFlow uses YouTube API Services to access metadata and videos from the channels that the customer explicitly authorizes via OAuth. By using our service, you also agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. You can revoke ReelFlow’s access to your YouTube data at any time at security.google.com/settings/security/permissions. The YouTube data we store (OAuth tokens, processed video metadata) is deleted 30 days after the last activity or upon permission revocation.

12. Meta (Facebook) data

ReelFlow uses Facebook Graph API exclusively to publish content to the Facebook Pages that the customer authorizes via OAuth. We request the following permissions: pages_show_list, pages_manage_posts, pages_read_engagement, pages_manage_metadata, business_management. These permissions are used ONLY to deliver the contracted service — NEVER for advertising, external audience analysis, or data sales. Access tokens are stored encrypted (AES-256) and refreshed automatically. You can revoke access at any time from Settings → Apps and Websites.

13. Data deletion

You can request complete deletion of your data at any time. Detailed instructions at /data-deletion.

14. Changes to this policy

If we materially update this policy, we will notify you by email or within the product before the changes take effect.