Privacy Policy

ReelsCashGen is operated by TODO — LEGAL ENTITY NAME, TODO — REGISTERED ADDRESS, TODO — COUNTRY OF INCORPORATION. We are the controller of the personal data described here. Write to us at TODO — CONTACT EMAIL.

Representative in the EU and UK: TODO — EU/UK REPRESENTATIVE, OR 'none appointed'.

Your account. You sign in with Google. From that we receive your email address, your name and your profile picture, and we store them so the account is yours next time. We never see your Google password, and we ask Google for nothing beyond your basic profile.

What you create. The niche you describe, any sample script you paste, the settings you choose, any background music you upload, and everything the service makes from them: subtopics, scripts, generated images and finished videos.

Billing. Payment is handled by Stripe on its own pages. We never receive or store your card number. We keep the identifier Stripe gives us for your customer record, your email, and the state of your subscription. Stripe holds the rest, under its own privacy policy.

Connected social accounts. If you connect TikTok, Instagram or YouTube, the authorisation is held by our publishing partner, Zernio. We never receive your platform password or access token, and we cannot read those accounts beyond publishing what you asked us to publish.

Technical data. Ordinary server logs — IP address, time, the page or endpoint requested, and errors — kept by the platforms that run the site.

We do not collect special category data (health, beliefs, biometrics and so on) and ask you not to put any into a niche description or script.

Under the UK and EU GDPR every use of personal data needs a lawful basis. Ours:

Where we rely on legitimate interests you can object — see section 9 — and we will stop unless we have compelling grounds not to. We rely on your consent for one thing only: analytics (section 13). You can withdraw it at any time from “Cookie settings” at the bottom of every page.

There is no advertising and no advertising tracking on this site. Analytics runs only if you accept it, and is used only to understand and improve the product — never for ads, and never shared with advertising networks. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we have never done either. Under California law that means there is nothing to opt out of, and we say so plainly rather than publishing a “Do Not Sell” link that does nothing.

We do not train models on your material. Your scripts, images and videos are sent to the providers in section 6 to produce your video, and for nothing else.

What we cannot promise on your behalf: each provider processes your text under its own terms. We choose providers whose terms exclude training on API content, and we will change a provider that changes that, but the arrangement is theirs. If this matters to you, section 6 names every one of them so you can read their terms.

Finished videos are stored with Cloudflare R2 and served from a public address that is not listed anywhere and cannot be guessed: each one contains a random 128-bit identifier. Anyone you give that link to can open the video, and it works without signing in — which is what lets a video play in your browser and be handed to the platforms you publish to.

In practice: treat a video link like an unlisted link, not like a private file. If you need genuinely private storage, tell us before you rely on it.

Producing a video means sending parts of it to specialist providers. These are all of them. We remain responsible for your data while they hold it, and each is bound by a data processing agreement.

We will update this list before adding a provider that receives personal data, and the date at the top of the page changes with it.

Most of these providers are in the United States, so using the service transfers your information there. Where we or a provider move personal data out of the UK or EEA we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, or on an adequacy decision where one covers the provider.

You can ask us for a copy of the safeguards that apply to a particular transfer.

Wherever you are, you can ask us to give you a copy of what we hold about you, correct it, delete it, or export it in a portable form. If you are in the UK or EEA you can also object to processing based on legitimate interests, ask us to restrict processing while a dispute is resolved, and withdraw consent where we ever rely on it.

If you are in California you have the right to know what we collect and why, to delete it, to correct it, and not to be treated worse for asking. As section 4 says, we do not sell or share personal information, so there is no opt-out to exercise. An authorised agent may act for you with written proof.

How to ask: write to TODO — CONTACT EMAIL from the address you signed up with. If we cannot tell it is you from that, we will ask for something more before acting — handing an account's data to the wrong person is the failure a verification step exists to prevent. We answer within 30 days and will tell you if we need longer.

Deleting your account in Settings deletes your series, scripts, stored videos and login at once, and disconnects your social accounts. It does not cancel a subscription: cancel it in Billing to stop payments. Payment records stay with our payment provider, and analytics are kept as described in section 8. Anything already published to TikTok, Instagram or YouTube stays there: it is on your own account and only you can take it down.

If you are unhappy with how we handled a request you can complain to your data protection authority — the ICO in the UK, or your national authority in the EEA — and we would rather you told us first.

This section is the notice required by the California Consumer Privacy Act as amended by the CPRA. It describes the same practices as the rest of this page, against California's own categories.

What we collect, and why. In the last twelve months we have collected the following categories. We collect them from you directly, from Google when you sign in, and from Stripe when you pay.

Disclosure for a business purpose. We disclose categories A, B, D, F, G and H to the service providers listed in section 6, only so they can perform the work described there. Each is contractually barred from using your data for its own purposes.

We do not sell or share personal information as those words are defined in the CCPA, and we have not in the preceding twelve months. We do not sell or share the personal information of anyone under 16. There is therefore no “Do Not Sell or Share My Personal Information” mechanism to offer, and we would rather say that than publish a link that does nothing.

Sensitive personal information. We do not collect any, so the right to limit its use and disclosure does not arise.

How long we keep each category is set out in section 8. Where a category has no fixed period we keep it for as long as your account exists and delete it with the account.

Your California rights: to know what we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for asking — we will not deny service, charge a different price or give a lower quality of service because you exercised a right. Exercise them by writing to TODO — CONTACT EMAIL, as described in section 9. An authorised agent may act for you with written permission, and we will ask you to confirm it directly.

Shine the Light (Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct marketing, so there is nothing to request under it.

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you have broadly the rights in section 9: to confirm whether we process your data, to get a copy, to correct it, to delete it, and to opt out of targeted advertising, sale, and profiling with legal effects — none of which we do.

Appeals. Several of these laws give you the right to appeal a refused request, and we honour it everywhere rather than only where it is required. If we turn a request down, reply to our answer and say you are appealing. A different person reviews it and responds within 45 days with the reasons. If we refuse again, you may complain to your state attorney general, and we will tell you how.

Nevada: we do not sell covered information, and would not without your consent.

The service generates content automatically, which is the product. It does not make automated decisions that produce legal or similarly significant effects about you — no automated pricing based on your behaviour, no automated refusal of service, no profiling. A suspension under the terms is a decision a person takes.

Strictly necessary. Supabase sets cookies to keep you signed in and to protect the sign-in flow. Without them you cannot stay logged in, so they do not need your consent. Clearing them signs you out.

Analytics — only with your consent. The first time you visit, we ask. Until you accept, no analytics code is loaded and nothing about your visit is sent to an analytics provider. If you accept, PostHog, Amplitude and Google Analytics record which pages you view and what you do in the product (for example, which step of the series wizard you reach), and GrowthBook may show you one of two versions of a page so we can tell which works better. These services set cookies or local storage to recognise your browser between visits.

When you are signed in, these events are linked to your account's internal id — never to your email address. Nothing is used for advertising: Google Analytics runs with advertising features turned off. Session recording is off.

You can change your answer at any time with “Cookie settings” at the bottom of every page. Refusing changes nothing about how the product works.

Data is encrypted in transit. The database is not reachable from the public internet without credentials, and access to production systems is limited to people who need it. Payment card data never reaches our systems at all — it goes straight to Stripe.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will notify the relevant authority within 72 hours where the law requires it, and tell you directly when the risk to you is high.

The service is not for people under 18, we do not knowingly collect their information, and we will delete an account we learn belongs to one.

Publishing takes your videos to platforms with their own privacy policies, and paying takes you to Stripe's pages. What those companies do with data you give them directly is governed by their policies, not this one.

If we change this page we will update the date at the top. If a change materially reduces your rights or widens what we do with your data, we will email you before it takes effect.