Privacy Policy

This policy explains how AutoReel ("AutoReel", "we", "us") handles personal data when you visit autoreel.app, use the AutoReel app or API, or contact us. AutoReel is the controller of that data. Questions or requests: [email protected].

1. What we collect

Account data. Your name, email address, password (stored only as a salted hash), and how you sign in: magic links, Google or Apple sign-in (we receive your name, email and account identifier from them), passkeys (we store the public key only) and two-factor authentication settings. We also keep your sessions (device, browser and IP address), so you can see and end them.

Workspace data. Workspaces you create or join, your role, invitations you send or receive, and your answers to onboarding questions.

Content. What you put into AutoReel and what it makes for you: prompts, scripts, captions, brand kits, uploaded photos, videos, audio and logos, generated videos, images and voiceovers, templates, automations and schedules.

Creators and consent. If you create a custom creator from photos of a real person, we store the photos and a record of who confirmed the person's consent, and when. We use the photos only to make that creator for your workspace; we don't use them to identify anyone.

Billing data. Your plan, credit balance and history, purchases, invoices and tax details. Card details are collected and stored by Stripe, not by us; we keep a reference to your Stripe customer and your card's brand and last four digits.

Connected social accounts. When you connect TikTok, Instagram or YouTube, we receive access tokens (stored encrypted) and basic profile information such as the account name and picture. For posts published through AutoReel we store the post's identifiers and status, and statistics such as views, likes, comments, shares and saves.

Developer data. API keys (we store only a hash and a short prefix), webhook endpoints and their delivery logs.

Usage and device data. Technical logs of requests (IP address, browser, request identifiers, errors) for security, debugging and abuse prevention. With your consent, product analytics about how you use the site and app, including session replays (see the Cookie Policy).

Communications. Emails you send us, and records of the emails we send you and whether they were delivered.

Referrals. If you arrive through an affiliate link, a referral identifier so the affiliate can be credited if you subscribe.

2. How we use it

• To provide the service: create your account, run your workspaces, generate, edit, render and store your content, publish it when you ask, and show your analytics.
• To bill you: process payments, credits, auto-refill, invoices and taxes.
• To keep the service safe: prevent fraud and abuse (for example blocking disposable email addresses and bots, rate limiting), screen prompts and review reported or flagged content, and secure accounts.
• To support you and send service messages: verification, security alerts, receipts, generation and publishing updates.
• With your permission: onboarding tips, product news and product analytics. You can withdraw consent at any time.
• To meet legal obligations, such as tax records, and to establish or defend legal claims.

Where the GDPR or UK GDPR applies, we rely on: performing our contract with you (the service, billing, support); our legitimate interests (security, abuse prevention, moderation, improving the service in ways you'd expect); your consent (analytics cookies, marketing emails, connecting social accounts); and legal obligations (tax and accounting).

3. AI processing

To generate content, we send the relevant inputs (your prompt, script and any media you chose) to the AI model that runs that step, through our model providers WaveSpeed AI (video, image, voice and lip-sync models) and OpenRouter (the language models behind the script assistant). The output comes back to us and is stored in your workspace.

We don't train AI models on your content and we don't sell it. Providers process inputs to return the result you asked for, under their terms with us. Outputs from the models are copied to our own storage, so you keep them even after a provider deletes its copy.

4. Who we share data with

We don't sell your personal data and we don't share it for cross-context behavioural advertising. We share it only with:

• Service providers (sub-processors) that process it on our behalf, listed in section 5;
• Social platforms you connect, when you publish to them or we read your posts' statistics;
• Other members of your workspace, who see the workspace's content and activity according to their role;
• Affiliates whose link you followed, who see only totals (visits, sign-ups, paying customers and their commission), never who you are or what you make;
• Authorities or others, when the law requires it, to protect rights and safety, or in a merger, acquisition or sale of the business (subject to this policy).

5. Sub-processors

We update this list when it changes. Some providers send model requests on to the company that built the model (for example, a video model's own developer); they do so under their agreements with our providers.

6. International transfers

Our providers may process data outside your country, including in the United States. Where the GDPR or UK GDPR requires it, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK addendum) with appropriate safeguards.

7. How long we keep it

• Account and workspace data: while your account or workspace exists. Deleting your account erases it, along with every workspace you own alone.
• Content you delete: goes to the trash and is deleted for good after 30 days (or straight away if you delete it for good from the trash).
• Downloads you request: ZIP files expire after one day; data export archives after seven days.
• Webhook delivery logs: 30 days.
• Post statistics: collected for 90 days after a post is published, and kept while the workspace exists.
• Billing and tax records: as long as tax and accounting laws require, which can be longer than your account.
• Security logs and backups: for a limited period, after which they're deleted or overwritten.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. In the app:

• Export your data: Account → Your data → request an export. We prepare an archive and email you a link that works for seven days.
• Delete your account: Account → Your data → delete account. If you own a workspace that other people use, transfer it or remove them first. We delete your Stripe customer records and your email contact as part of the deletion.
• Emails: choose which emails you get in your notification settings, or use the unsubscribe link in any marketing email. Security, billing and legal emails always send.
• Cookies and analytics: see the Cookie Policy.
• Connected accounts: disconnect them in the app at any time.

For anything else, email [email protected]. We'll answer within the time the law requires (one month under the GDPR). You can also complain to your data protection authority.

California and other US states. We don't sell personal information or share it for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics. You can exercise the rights above, and we won't discriminate against you for doing so.

9. Google and YouTube data

When you connect a YouTube channel, we use YouTube API Services to upload the videos you schedule and to read their statistics. By connecting, you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. AutoReel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke AutoReel's access at any time from your Google account permissions. Disconnecting the channel in AutoReel also revokes access, deletes the stored tokens and cancels its scheduled posts.

10. Security

Data is encrypted in transit. Social account tokens and webhook secrets are encrypted at rest, API keys and passwords are stored only as hashes, and workspace data is separated at the database level. Staff access is limited and logged. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

11. Children

AutoReel is not for anyone under 18, and we don't knowingly collect children's personal data. If you believe a child has given us data, contact us and we'll delete it.

12. Changes

We'll update this policy as the service changes. If a change is significant, we'll tell you by email or in the app before it applies. The effective date is at the top of this page.