Privacy policy

The controller of your account data is [LEGAL ENTITY NAME], [REGISTERED ADDRESS] (“StillToReel”, “we”). Privacy questions and requests: support@stilltoreel.com. [DATA PROTECTION OFFICER / EU-UK REPRESENTATIVE, IF REQUIRED]

For personal data that you or your team put inside your Reels (for example your clients’ names, images of people, or comments), you (or your organization) decide why and how it is used and are the controller, and we act as your processor, acting on your instructions. A data processing agreement is available on request.

Account data: name, email address, password (stored only as a hash), profile picture, and your Google account ID if you sign in with Google. We also record when you accepted the Terms.

Content you create: Reels, shots, notes, drawings, images, audio, assets, comments, clients and team settings, plus team membership and roles.

Shared links: if you enable a public link, we process the link settings and, when someone posts a comment, the name they type and the comment text with a timestamp. Visitors to a public link do not need an account.

Usage and technical data: export records (which kind of export, which Reel, when) used to apply plan limits; security and error logs that may include IP address, browser/device information and request details; and support messages you send us.

Payment data: we do not currently process online payments. If we later do, the payment provider will be named here.

When a team member invites you by email, we receive your email address from that person and use it only to send you the invitation and to match it to your account if you sign up. The invitation link expires after 2 days. Accepted or revoked invitations are deleted; [EXPIRED INVITATION RETENTION — expired invitations are not yet purged automatically]. We do not use your email for anything else. If you did not expect an invitation, ignore it or email support@stilltoreel.com.

To provide the Service you asked for (create your account, store and show your work, collaboration, sharing, exports, sending verification and invitation emails) — performance of a contract.

To keep the Service secure and working (authentication, abuse prevention, error logging, enforcing plan limits, fixing bugs) — our legitimate interests.

To answer support requests and handle content complaints — contract and legitimate interests.

To meet legal obligations, and to establish or defend legal claims — legal obligation and legitimate interests.

We send only service emails (verification codes, invitations, password resets, account notices). We do not send marketing emails; if we ever do, we will ask for your consent first. We do not sell personal data, do not use it for advertising or to train AI models, and do not make decisions about you by automated means that have legal or similarly significant effects.

We use service providers who process data on our behalf, only to provide the Service: [HOSTING PROVIDER AND REGION] (application hosting and database); [OBJECT STORAGE PROVIDER AND REGION, e.g. DigitalOcean Spaces] (uploaded files); [EMAIL PROVIDER] (transactional email such as verification codes and invitations); Google (sign-in with Google, if you choose it); and [ERROR MONITORING PROVIDER, e.g. Sentry — REMOVE IF NOT USED]. A current list is available on request.

Your content is visible to the members of the team you add and, if you create a public link, to anyone with that link. We may disclose data if required by law or to protect rights and safety.

Our providers may process data outside your country. Where data leaves the EEA/UK we rely on [TRANSFER SAFEGUARD, e.g. adequacy decisions or Standard Contractual Clauses]. Servers are located in [SERVER LOCATION].

Account data and your content are kept while your account is active. Archived Reels remain until you delete them permanently.

If you delete your account, we start a 30-day grace period after you confirm the request; after it, we delete or anonymize your personal data and content, except what we must keep by law. Unverified sign-ups are removed automatically.

Export records are kept for [EXPORT RECORD RETENTION, e.g. 13 months]. Logs are kept for [LOG RETENTION]. Encrypted backups are kept for [BACKUP RETENTION] and deleted data disappears from backups on that schedule. Support messages are kept for [SUPPORT RETENTION].

Depending on where you live, you can ask us to give you access to your data, correct it, delete it, restrict or object to its use, send it to you in a portable format, and withdraw consent where we rely on it. You can edit your profile and delete your account in the account settings, or email support@stilltoreel.com. We respond within one month.

You can complain to your data protection authority ([SUPERVISORY AUTHORITY NAME AND LINK]). We would appreciate the chance to resolve your concern first.

If you live in California or another US state with a consumer privacy law, you may have the right to know what personal information we collect, to access, correct or delete it, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising. To make a request, email support@stilltoreel.com. [CONFIRM WHETHER CCPA/CPRA THRESHOLDS APPLY TO US BEFORE KEEPING THIS SECTION.]

We use only strictly necessary storage. Two secure, httpOnly cookies keep you signed in (a short-lived access token and a refresh token). Your browser’s local storage remembers interface preferences (for example the Reels view mode) and, on public links, the name you last used to comment. We do not use advertising or analytics cookies, so we do not show a cookie banner. [UPDATE THIS SECTION BEFORE ADDING ANY ANALYTICS OR MARKETING TOOLS.]

We use measures such as encrypted connections, hashed passwords, access controls and role-based team permissions. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

StillToReel is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email support@stilltoreel.com and we will delete it.

We will post changes here, update the effective date above, and notify you by email or in the Service before material changes take effect. Earlier versions are available on request at support@stilltoreel.com.