Privacy policy

1. Data controller

The data controller is [Legal entity name], [Address]. Privacy contact: [Contact email].

2. Data we collect

Account data: email address, name if provided by Google, technical session identifiers.

Subscription data: plan, status, Whop identifiers related to payment (full card details are not stored by AutomatReels).

Workspace data: pipeline settings, connected TikTok/Instagram accounts (platform access tokens), uploaded media, publications and related metadata.

Technical data: application logs, IP address and user-agent as needed for security and diagnostics.

3. Purposes and legal bases

Service delivery (contract): authentication, video composition, scheduling, publishing, team management and quotas.

Billing and subscription management (contract / legal obligations) via Whop.

Security, fraud prevention and stability (legitimate interest).

Support requests (legitimate interest or contract).

4. Cookies and session

AutomatReels uses cookies or equivalent storage required for authentication sessions (Auth.js) and service operation.

These cookies are not used for third-party behavioral advertising. Limiting cookies in your browser may prevent sign-in.

5. Recipients and processors

Data may be processed by providers strictly needed to run the service: hosting, Google auth, transactional email (SMTP), Whop payments, TikTok and Meta/Instagram APIs for publishing, and OpenAI when text overlays are generated.

Providers act under their terms and, where applicable, data processing agreements. Personal data is not sold.

6. Retention

Account and workspace data are kept for the lifetime of the service relationship, then archived or deleted within a reasonable period after closure, unless a legal retention duty applies.

Technical logs are kept for a limited period compatible with security and diagnostics.

7. Transfers outside the EU

Some providers may be located outside the European Union. Where applicable, appropriate safeguards (such as standard contractual clauses) are sought.

8. Your rights

Under GDPR you may request access, rectification, erasure, restriction, objection and portability, subject to legal conditions.

To exercise your rights: [Contact email]. You may also lodge a complaint with your supervisory authority (in France: cnil.fr).

9. Security

Reasonable technical and organizational measures protect data (access control, secure sessions, workspace isolation). No system is perfectly secure.

10. Changes

This policy may be updated. The update date appears at the top. Material changes may be communicated in-product or by email.