Privacy notice

1. Who is responsible

The controller of your personal data is [Operator name], [Postal address, Poland] (“we”).

For any question about your data or to exercise your rights, write to [contact email].

2. What data we process

We only process the data the service needs:

• Account: your email address, a hash of your password (never the password itself), whether the email is confirmed, the date of registration and your role. If you sign in with Google, Facebook or LinkedIn, also the identifier of that account and the email it shares with us.
• Your content: ideas and briefs you send, video plans, scripts, series settings and the videos we generate for you.
• Photos and voice recordings you upload. From a voice recording we create a digital copy of your voice, only after you agree to it on the upload form.
• Credits and payments: your credit balance and its history, and records of your purchases (amount, currency, time, Stripe payment reference). Card details go directly to Stripe; we never see them.
• Abuse protection at sign-up: a normalised form of your mailbox (to detect the same inbox registered twice) and a one-way hash of your network prefix. Your IP address itself is not stored with the account.
• Technical logs: the server records requests and errors, which can include an IP address, browser type, your account email or the identifier of a video.
• Product analytics, only if you accept analytics cookies: pages you open, clicks, the main steps (sign-up, creating a video, checkout), device and browser type, approximate location and session recordings in which your texts and email are masked. A signed-in account is linked by an internal number, never by email.
• Cookies: strictly necessary cookies and a language preference; analytics cookies only if you accept them. See “Cookie settings”.

3. Why we process it and on what legal basis

• To create and run your account, generate videos, keep your balance and process payments — performance of our contract with you (Art. 6(1)(b) GDPR).
• To create and use a copy of your voice — your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by deleting the recording; this does not affect processing that took place before.
• To understand how the service is used and improve it (product analytics) — your consent (Art. 6(1)(a) GDPR), given in the cookie banner; you can withdraw it at any time on the “Cookie settings” page.
• To protect the service against fraud, abuse of free credits and attacks, and to find and fix errors — our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
• To keep accounting records of payments — a legal obligation (Art. 6(1)(c) GDPR).
• To send you service emails (email confirmation, password reset, important changes to these documents) — performance of the contract. We do not send marketing emails.

4. Who receives your data

We use the outside services below to run ExpertReels. They process data on our behalf and only for the stated purpose. Services marked as AI providers receive the text and media needed for one generation step; we do not send them your email or password. We do not sell your data.

5. Transfers outside the European Economic Area

Several of these services are located outside the EEA, mostly in the USA. Such transfers rely on an adequacy decision (for example the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission’s standard contractual clauses. You can ask us for a copy of the relevant safeguards at [contact email].

6. How long we keep data

• Account data, your content, photos and voice recordings: for as long as you have an account, unless you ask us to delete them sooner.
• The copy of your voice: until you delete the recording or the account; we then also delete it from ElevenLabs.
• Payment records: 5 years from the end of the year of payment, as Polish tax and accounting law requires.
• Application logs: about one month.
• You can delete a video, a series or your whole account yourself in the service; the files and the copy of your voice are deleted with it. Payment records are kept as stated above, linked only to an anonymous account number. You can also write to [contact email].

7. Your rights

You have the right to access your data and receive a copy, to have it corrected or deleted, to restrict its processing, to data portability, to object to processing based on our legitimate interest, and to withdraw consent at any time. Write to [contact email]; we answer within one month.

You may also lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl — or with the authority of the EU country where you live or work.

8. Automated decisions

AI models write plans and scripts and generate images, voice and video for you. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Sign-up limits that protect against abuse are checked automatically; if you think your registration was refused by mistake, write to us.

9. Security

Data travels only over encrypted connections. Passwords are stored as hashes, sessions are protected against forged requests, and each account can open only its own videos and files. Access to the server and the database is limited to the operator.

10. Children

ExpertReels is intended for adults (18 and over). We do not knowingly process data of children.

11. Changes to this notice

When this notice changes, we update the date at the top. We will tell you about significant changes by email or in the service before they take effect.