Privacy policy

This policy explains what personal data reelport.io processes when you visit the website, use the web app, connect social accounts, or use the API, the MCP server, the Reelport plugin for DaVinci Resolve or the Reelport Claude extension with your reelport.io account. We collect only what the service needs to work.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Pixel & Process UG (haftungsbeschränkt)
Marliring 74, 23566 Lübeck, Germany
Managing director: Florian Wartner
Email: privacy@reelport.io · Phone: +49 172 8643008

For data protection questions, write to privacy@reelport.io or to Florian Wartner at the address above. Full company details are in the imprint.

Visiting the website

When you open any page, our web server processes your IP address, the date and time, the requested URL, the referring page, your browser and operating system, and the response status. We need this to deliver the page, to keep the service secure and to find errors. The legal basis is our legitimate interest in a secure, working service (Art. 6 (1) (f) GDPR). Server logs are deleted after TODO: confirm log retention, e.g. 14 days.

With your consent, we measure visits with Umami, a cookieless analytics tool that Pixel & Process hosts itself at analytics.pixelandprocess.de on servers in Germany. It records the page, referring page, browser, operating system, device type, screen size, language and country, without cookies, without storing your IP address and without profiles. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without it the script is not loaded. You can withdraw it any time in the cookie settings linked in the footer.

We use no tracking pixels, no advertising networks and no third-party embeds. Fonts are served from our own servers, so no request goes to Google Fonts or any other font provider.

Your account

To create an account we process your name, email address and password (stored only as a salted hash). If you turn them on, we also store your two-factor authentication secret and recovery codes (encrypted) and the public keys of your passkeys. Every account has a team; we store your teams, your role in each (owner, admin or member), and the email addresses of people you invite, so we can send the invitation.

The legal basis is the performance of our contract with you (Art. 6 (1) (b) GDPR). Rate limits and login protection rely on our legitimate interest in preventing abuse (Art. 6 (1) (f) GDPR).

Sign in with Google

If you choose “Continue with Google”, Google Ireland Ltd. asks you to share your basic profile with us. We request the scopes openid, email and profile and receive your Google account id, name, email address and whether Google has verified it. We use them only to create or sign in to your reelport.io account: the Google id is stored to recognise you next time, and an existing account with the same verified email is linked to it. We do not receive your Google password and request no other Google data at sign-in. The legal basis is Art. 6 (1) (b) GDPR. Our use of this data follows the Google API Services User Data Policy, including the Limited Use requirements (see YouTube API Services and Google user data).

Connected social accounts

When you connect a channel, you sign in on the platform’s own page and grant reelport.io the permissions listed below. We receive an access token (and, for TikTok and YouTube, a refresh token). Tokens are encrypted at rest with the application key, used only by our servers to act on your instructions, and never shown to other team members, to the API or to the Reelport plugin. We store per channel: the platform’s account id, username or name, avatar URL, the granted scopes, the token expiry and its status.

When a post is due, we send the platform the video or photo, the caption and the options you chose. We store what the platform sends back: the upload or publish id, the link to the published post, its status and any error message. The legal basis is the performance of our contract with you (Art. 6 (1) (b) GDPR). The platforms process the content you publish as independent controllers under their own terms and privacy policies.

YouTube API Services and Google user data

reelport.io uses YouTube API Services to upload videos and read channel information. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google processes data under the Google Privacy Policy. You can revoke reelport.io’s access to your Google account at myaccount.google.com/permissions. The channel is then marked as needing reconnection the next time we try to use it; disconnecting it or deleting your account deletes its tokens at once.

reelport.io’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the features you see in reelport.io (signing in, uploading your scheduled videos, showing your channel and trending hashtags). We do not sell it, do not use it for advertising, do not use it to train AI or machine-learning models, and do not let humans read it except with your consent, for security reasons, to comply with the law, or in aggregated, anonymised form for internal operations.

The same principles apply to data we receive from Meta and TikTok: it is used only to publish your posts and show their results to your team, never for advertising or sold to anyone.

Disconnecting a channel (Accounts › Disconnect) deletes its tokens immediately, together with posts still scheduled to it. See data deletion for every option.

API, MCP and the Reelport plugin

You can create personal API tokens in Settings › API tokens. We store a hash of each token, its name, its abilities, the team it belongs to and when it was last used. The Reelport plugin and the Claude extension sign in with a device code: the plugin shows a code, you confirm it on reelport.io/device, and the plugin receives a token. Device codes expire after 15 minutes. For plugin updates we process an anonymous machine hash that the plugin sends, so updates can be signed for that machine. You can revoke any token at any time; it stops working immediately.

Videos, photos and posts

Uploaded videos and photos, the poster frames we generate, captions, per-platform options, schedule times and publishing results are stored for your team. Media files are kept in a private bucket on Hetzner Object Storage in Helsinki, Finland (EU). Files are never public: Meta and the other platforms receive either the file itself or a signed link that expires after one hour. The legal basis is Art. 6 (1) (b) GDPR.

Media files are deleted automatically 30 days after their last post finished publishing, or earlier when you delete them. The post records (caption, time, channels, result, links) stay in your history until you delete the post, your team or your account.

Payments

Subscriptions are billed per team through Stripe. Stripe collects your payment details and, where you enter them, your billing address and VAT id on its own checkout and portal pages; we never see full card numbers. We store the Stripe customer id, the card brand and last four digits, the subscription status and the trial end date. The legal basis is Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for invoices, which German tax law requires us to keep for up to ten years (§ 147 AO, § 257 HGB). Stripe’s privacy policy: stripe.com/privacy.

Email

We send only service email that belongs to your account: address verification, password resets, team invitations, and messages when a post was refused or a channel needs reconnecting. We send it through Postmark. We do not send newsletters or marketing email without your separate consent.

Service providers and transfers

We use the following processors. Each may process personal data only on our instructions. Where data leaves the EU/EEA, the safeguard named applies.

Meta, TikTok and Google receive data when you connect a channel or sign in with Google and when we publish for you, as described above. They act as independent controllers. We do not sell personal data and do not share it with advertisers.

Cookies

reelport.io sets only cookies that the service needs (§ 25 (2) no. 2 TDDDG); Umami analytics, used only with your consent, sets none:

• reelportio-session: keeps you signed in for the browser session (expires after two hours of inactivity).
• XSRF-TOKEN: protects forms against cross-site request forgery.
• remember_web_…: only if you tick “Remember me” when you log in.
• appearance and sidebar_state: your display preferences inside the app.
• cookie_consent: your cookie choice, for 12 months.

Stripe’s checkout and portal pages set their own cookies for payment security; they are covered by Stripe’s privacy policy.

How long we keep data

• Account, team and post records: as long as your account exists.
• Social account tokens: until you disconnect the channel or delete your account.
• Uploaded media: 30 days after its last post finished, or until you delete it, whichever is sooner.
• API tokens: until you revoke them.
• Invoices and payment records: up to ten years, as German tax law requires.
• Backups: deleted data disappears from backups when they rotate (TODO: confirm backup rotation period).

Deleting your data

Disconnect a channel under Accounts to delete its tokens immediately. Delete your account under Settings › Profile › Delete account to remove your user, every team you own, their channels, tokens, videos and posts. Step-by-step instructions, including how to remove reelport.io on Instagram, TikTok and Google, are on the data deletion page. You can also email privacy@reelport.io and we will delete your data within 30 days.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have it corrected (Art. 16) or erased (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on our legitimate interests (Art. 21);
• withdraw any consent you gave, with effect for the future (Art. 7 (3)).

Email privacy@reelport.io to use them. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de.

We make no automated decisions with legal or similarly significant effect about you. reelport.io is not meant for children under 16.

Security

All traffic is encrypted with TLS. Social account tokens and two-factor secrets are encrypted in the database, media is stored in a private bucket, and every team’s data is separated by access policies. Only staff who need it for support or operations can reach production systems.

Changes

We update this policy when the service or the law changes. The date at the top shows the current version; for significant changes we notify account owners by email. Our terms of service apply alongside this policy.