Legal
Privacy Policy
Last updated: Oct 14, 2026
We respect your privacy and collect as little personal data as possible. This policy explains which personal data Reelamo processes, why, and what rights you have under the General Data Protection Regulation (GDPR).
Who is responsible
The controller for the personal data described in this policy is Mimet Tech Solutions, registered with the Dutch Chamber of Commerce (KvK) under number 91037522.
For privacy questions or to exercise your rights, email [email protected]. We are not required to appoint a data protection officer.
For personal data in the content that business customers upload or generate, such as photos of employees or customers, the customer is the controller and we are the processor. See our Data Processing Agreement.
What data we process
- Account data: name, email address, password (stored only as a secure hash), language, two-step sign-in settings and the workspaces you belong to.
- Billing data: plan, subscription status, invoices, company name, address and VAT number if you provide them. Card and bank details are entered directly with Stripe; we never see or store them.
- Content: briefs, brand profiles, uploaded logos, photos, videos and music, scripts, voiceovers and the ads you make.
- Usage and technical data: IP address, browser and device type, sign-in times, security events (such as failed sign-ins), API requests and error logs.
- Communication: emails you send us and the messages we send you about your account.
- Share-link feedback: the name and comment that a reviewer leaves on an ad shared through a share link.
Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and managing your account, making ads and providing support | Account data, content, communication | Performance of the contract (Art. 6(1)(b)) |
| Payments, invoices and tax administration | Billing data | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Security, preventing fraud and abuse, enforcing our terms | Usage and technical data | Legitimate interest (Art. 6(1)(f)) |
| Service emails about your account, ads and important changes | Account data | Performance of the contract (Art. 6(1)(b)) |
| Improving the service with aggregated, non-identifying statistics | Usage and technical data | Legitimate interest (Art. 6(1)(f)) |
| Handling feedback on shared ads | Share-link feedback | Legitimate interest of the customer who shared the ad (Art. 6(1)(f)) |
We do not sell personal data, we do not use it for advertising profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We only send marketing emails if you have opted in, and you can unsubscribe at any time.
Content you upload
To make an ad, we send your brief and the relevant images to our AI provider to write the script, check content against our rules, generate a voiceover and, if you ask for it, create images. Only upload photos of recognizable people if you have their permission. Don't include sensitive personal data, such as health information, in briefs or uploads.
To check whether a new password appears in known data breaches, we send only the first five characters of a cryptographic hash of the password to the Have I Been Pwned service. Your password itself never leaves our servers.
No AI training on your data
We don't use your content or ads to train AI models. Our AI provider, OpenAI, does not use data sent through its API to train its models and keeps it for a limited time only to detect abuse, after which it is deleted.
Subprocessors
We use the following service providers to run Reelamo. Each processes personal data only on our instructions and under a data processing agreement.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application, database and video rendering | Germany and Finland (EU) |
| Cloudflare, Inc. | File storage (R2), network security, bot protection (Turnstile) and email routing | Western Europe (file storage); global network |
| OpenAI | Writing scripts, voiceovers, AI images, transcription and content moderation | United States |
| Stripe | Payments, subscriptions, invoices and tax calculation | Ireland (EU) and the United States |
| Resend | Sending account emails such as confirmations and password resets | European Union (sending region); company based in the United States |
When you search for stock footage, the search terms are sent to Pexels or Pixabay; no personal data is shared with them.
Transfers outside the EU
Our servers and file storage are in the European Union. Some subprocessors, such as OpenAI, Stripe, Cloudflare and Resend, are based in the United States or may process data there. In those cases we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards such as encryption in transit.
How long we keep data
- Files attached to an ad and rendered videos: deleted automatically 7 days after the ad was made.
- Media library, brand profiles and account data: as long as your account exists. When you close your account, we delete or anonymize your personal data straight away; files in a closed workspace are deleted within 30 days.
- Database backups: overwritten on a rolling basis and kept for no longer than 14 days.
- Security logs and sign-in history: up to 12 months.
- Invoices and payment records: 7 years, as required by Dutch tax law.
- Emails with our support team: up to 2 years after the last contact.
Security
We protect personal data with appropriate technical and organizational measures, including encrypted connections (HTTPS), securely hashed passwords, optional two-step sign-in, checks against breached passwords, strict access control on a need-to-know basis, private file storage with short-lived signed links, rate limiting and bot protection, regular updates and daily encrypted backups.
Data breaches
If a data breach occurs, we act immediately to stop it and limit the consequences. If the breach is likely to pose a risk to your rights and freedoms, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours. If the risk is high, we also inform you without undue delay. Business customers are informed as described in the Data Processing Agreement.
Cookies
Reelamo only uses functional cookies that are needed for the website and app to work. We don't use analytics, tracking or advertising cookies, and we don't load third-party trackers. Because these cookies are strictly necessary, we don't need to ask for your consent and you won't see a cookie banner.
| Cookie | Purpose | Kept for |
|---|---|---|
rl_session | Keeps you signed in | 30 days |
rl_lang | Remembers the language you chose | 1 year |
rl_2fa | Remembers the first step while you complete two-step sign-in | 5 minutes |
rl_flash | Shows a one-time message after an action, such as “Password set” | 1 minute |
| Cloudflare security cookies | Protect the sign-in and sign-up forms against bots and attacks | Up to 1 day |
Your rights
You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to receive your data in a portable format. You can download your data and close your account yourself in your account settings. For other requests, email [email protected]. We reply within one month and may ask you to confirm your identity.
Where we process data based on your consent, you can withdraw it at any time. You also have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or the authority in your own country, but we'd appreciate the chance to solve your concern first.
Children
Reelamo is not intended for people under 18 and we do not knowingly collect their personal data.
Changes
We may update this policy, for example when we add a subprocessor. The date at the top shows when it last changed. We will inform you of important changes by email or in the app.