Privacy policy
Version · Last updated:
The short version. We collect what we need to run your account, deliver your license and render your videos. We do not sell your data, we do not run advertising or analytics trackers, and your uploaded files are deleted automatically shortly after processing. You can ask for access, correction or deletion at any time.
1. Who is responsible
We are the controller within the meaning of the General Data Protection Regulation (GDPR) for the personal data described here. We have not appointed a data protection officer, because we are not required to. Privacy questions go to the address above.
2. Scope
This policy covers the ProdReel website, the web applications (Reel Studio, MIDI Studio, Beat Breakdown), your account and dashboard, the checkout, and our email communication. It applies to visitors, account holders and customers.
3. What we process and why
| Category | Data | Purpose | Legal basis (GDPR art. 6) | Kept |
|---|---|---|---|---|
| Account | Name, email address, password (stored only as a hash by our authentication provider), sign-up date, plan | Create and run your account, sign you in, send service messages such as a password reset | Contract (1b) | Until you delete your account |
| License | License key, plan (Free or Pro), activation date and the account it is bound to | Unlock Pro, prevent sharing and misuse of keys | Contract (1b), legitimate interest (1f) | Until you delete your account; the key record stays as long as needed to prevent re-use |
| Order and payment | Email address, amount, payment reference, date, record of your withdrawal confirmation. Card and bank details are handled by Stripe and never reach us. | Deliver the license key, invoicing, tax administration, handle disputes | Contract (1b), legal obligation (1c) | 7 years for tax records (Dutch tax retention rules) |
| Usage | Number and date of exports, template, duration, your user ID | Show your history, apply daily limits, keep the service fair for everyone | Contract (1b), legitimate interest (1f) | Until you delete your account |
| Technical | IP address, request time, browser type, error messages | Security, abuse prevention, rate limiting, fixing faults | Legitimate interest (1f) | Short-lived server logs that are rotated; no longer than needed for these purposes |
| Communication | Your emails to us and our replies | Answer questions, handle complaints and requests, keep a record of what was agreed | Legitimate interest (1f), contract (1b) | As long as needed to handle the request, then deleted unless needed as evidence |
The legitimate interests are: keeping the service secure and available, preventing fraud and misuse, and keeping reliable records. We weigh these against your interests and rights. You can object, see section 12.
Providing data that the account and checkout ask for is necessary to use the service. Without it we cannot create your account or deliver your license.
4. Your uploaded files
When you create a reel, visualizer or breakdown, you upload video, audio, MIDI or project files and settings. We process them only to create your output.
- Files are validated for type and size on arrival.
- They are processed on our render servers and are not published or shared.
- An uploaded file is deleted automatically about 30 minutes after its last use. Finished output is available for download for about 15 minutes after completion and is then deleted.
- We do not use your files to train models, for advertising or for any purpose other than delivering your output.
Your files can contain personal data of others, such as a voice or a face. You are responsible for having a legal basis for that, see our terms.
5. What we do not do
- We do not sell personal data or share it for advertising.
- We do not use analytics, advertising or tracking cookies or pixels.
- We do not build profiles for marketing and we do not take decisions about you with legal effect based only on automated processing. Daily limits and abuse checks are applied automatically; you can contact us if you think one was applied wrongly.
- We do not send marketing email. We only send messages related to your account and orders. If that ever changes, we ask for your consent first and you can withdraw it at any time.
6. Who receives data
We use a small number of service providers that process personal data on our instructions (processors), with agreements that meet GDPR article 28:
| Provider | Role | Data |
|---|---|---|
| Supabase | Database and authentication | Account, license, order and usage data. Region: |
| Hosting provider: | Servers for the website, render engine and email | Uploaded files in transit and during processing, technical logs, emails |
| Stripe | Payment processing (independent controller for its own legal duties, such as fraud and anti-money-laundering) | Payment details, email address, amount |
We also disclose data where the law requires it, for example to tax authorities or on a valid order from a competent authority, and to protect our rights in a legal dispute. If our business is transferred, data may go to the successor under the same promises as in this policy.
7. Transfers outside the EEA
Some providers, such as Stripe, can process data outside the European Economic Area, including in the United States. Where that happens we rely on an adequacy decision (for example the EU–US Data Privacy Framework for certified companies) or the European Commission's standard contractual clauses, together with additional measures where needed. You can ask us for a copy of the safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Uploaded files | Deleted automatically, about 30 minutes after last use |
| Finished output on the server | Deleted automatically, about 15 minutes after completion |
| Account, license and usage data | Until you delete your account; after deletion removed or anonymized, except what the next row requires |
| Order and payment records | 7 years, because of Dutch tax law |
| Technical logs | Short-lived and rotated |
| Emails with us | As long as needed to handle the matter and to document it |
We delete or anonymize account data within a reasonable time after a deletion request. Data can remain in encrypted backups for a limited period until they are overwritten.
9. Cookies and local storage
We use browser storage only where it is strictly necessary for the service, which does not require consent under the ePrivacy rules (in the Netherlands: article 11.7a of the Telecommunicatiewet):
| Item | Purpose | Duration |
|---|---|---|
| Sign-in session (local storage, set by Supabase) | Keep you signed in on this device | Until you sign out or the session expires |
| Interface and account cache (local storage) | Remember your name, plan and license key for display, your recent reels list, and choices such as the quick tour having been seen or the studio you last used | Until you sign out or clear your browser data |
| Payment elements (Stripe) | Fraud prevention and secure payment on the checkout page only | As set by Stripe |
We do not use advertising cookies or analytics tools. If we add them later, we ask your consent first.
10. Third-party requests from your browser
To display our pages your browser loads fonts and code libraries from servers of third parties: Google Fonts, jsDelivr, cdnjs (Cloudflare) and the Tailwind CDN. Those parties receive your IP address and browser details with that request, as with any web request. On the checkout page your browser also loads Stripe's script. We do not control what those providers do with such technical data; see their own privacy notices.
11. Security
We take appropriate technical and organizational measures, including:
- encrypted connections (HTTPS) for the website and API;
- passwords stored only as hashes by the authentication provider;
- access to account data restricted by authenticated, per-user access rules in the database;
- validation of uploaded files and rate limiting of requests;
- automatic deletion of files after processing;
- license and plan checks on the server rather than in the browser;
- access to production systems restricted to the people who need it.
No system is completely secure. Choose a strong, unique password.
12. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (art. 15);
- rectification of inaccurate data (art. 16);
- erasure of your data, unless we must keep it by law (art. 17);
- restriction of processing in certain cases (art. 18);
- data portability: get data you provided in a structured, common format (art. 20);
- object to processing based on legitimate interest (art. 21);
- withdraw consent at any time, where processing relies on consent. Withdrawal does not affect earlier processing.
How. Email , preferably from the address on your account. We may ask for information to confirm who you are. We answer within one month; if a request is complex or we get many, we may extend that by two months and tell you why. Exercising your rights is free, unless requests are manifestly unfounded or excessive.
Deleting your account. Ask us by email. We delete your account, license binding and usage history, except records we must keep by law (order records, see section 8). Deleting your account does not by itself refund a purchase.
Complaints. If you think we handle your data unlawfully, contact us first. You can also complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, or to the authority of your own EU country, and you can bring a claim before a court.
13. Children
ProdReel is not meant for people under 16, and we do not knowingly collect their data. If you think a child has created an account, email us and we delete it.
14. Data breaches
If a personal data breach is likely to put your rights and freedoms at risk, we notify the Dutch Data Protection Authority within 72 hours as the law requires. If the risk to you is high, we also tell you directly, without undue delay, with what happened, what data is affected and what you can do.
15. Changes
We may update this policy, for example when we add a feature or provider. The date at the top shows the latest version. For material changes we tell account holders by email or in the service before they take effect. Earlier versions are available on request.
16. Contact and complaints
See also our terms of service and the contact page.