Privacy Policy

This policy explains what personal data ReelNaut (reelnaut.com) collects, why, how long we keep it and how you control it. This website is operated by Goga Chokoraia. The data controller is Individual Entrepreneur Goga Chokoraia, operating ReelNaut as a registered business in Tbilisi, Georgia, reachable at support@reelnaut.com.

1. What we collect and why

• Account: name, email address and profile picture from your sign-in provider (Google or email link). Used to create and secure your account and to contact you about it. Legal basis: contract.
• Free video without an account: the niche, topic and language you choose, and the email address you type on the form. We use the address only to send you the link to that one video (or to tell you it could not be made) and to keep it to one free video per person; nothing is sent to it afterwards unless you create an account. Unclaimed free videos and their address are deleted after 30 days. Legal basis: your request (contract).
• Your series and videos: the topic, style, voice, schedule and custom instructions you enter, and the scripts, images and videos generated from them. Used to provide the Service. Legal basis: contract.
• Connected channels: the channel id, name and avatar of accounts you connect, and the OAuth access/refresh tokens, stored encrypted. Used only to upload the videos you scheduled and to read the statistics of those videos. Legal basis: contract.
• Statistics: view, like and comment counts of videos we published, read through the platform APIs, shown in your dashboard. Legal basis: contract.
• Billing: plan, invoices and payment status from our payment partner, Flitt (TBC Bank JSC, Georgia). Card numbers, Apple Pay and Google Pay details are entered on Flitt's PCI DSS-certified checkout and never reach us; we store only the last four digits and a payment token. Legal basis: contract and legal obligation (accounting).
• Technical: server logs with IP address, browser type and timestamps, kept up to 30 days for security and troubleshooting. Legal basis: legitimate interest.
• Site analytics and ad measurement (only if you press "Accept" in the cookie bar): Microsoft Clarity records how our public pages are used (clicks, scrolling, anonymised session replays; typed text is masked; never inside your account or on the sign-in page), and the Meta Pixel and Meta Conversions API tell Meta when a visitor who came from one of our ads started a free video or a checkout, so our ads reach people likely to be interested. Meta receives your IP address, browser details and its own cookie identifiers, never your name, e-mail or content. The Google Ads tag does the same for visitors who came from one of our Google search ads: Google receives your IP address, browser details and its own cookie identifiers, never your name, e-mail or content. Legal basis: consent, which you can withdraw at any time (see section 5).

We do not sell personal data, and without your consent nothing is collected for advertising.

2. AI providers

To generate content we send only the text prompts, settings and narration text needed for generation to our AI providers: OpenAI (scripts, images, content safety check), ElevenLabs (narration) and fal.ai (motion clips). They receive no account details and no social tokens. Their processing is governed by their own terms; they do not use API data to train models.

3. Google and YouTube data

ReelNaut uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service; Google's privacy policy is at policies.google.com/privacy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access: your channel id, title and avatar (to show which channel is connected), permission to upload videos to that channel (youtube.upload), and view/like/comment counts of the videos we uploaded (youtube.readonly). We use this data only to upload the videos you scheduled and to display your own statistics; we never sell it, use it for advertising, train models with it, or let humans read it except for support at your request. You can revoke access at any time from the Channels page or at Google account permissions; revoked tokens and cached statistics are deleted within 7 days.

4. TikTok, Instagram and Facebook data

Connecting TikTok, Instagram or a Facebook Page works the same way: we store the account or Page id, display name and avatar plus encrypted tokens, upload only the videos you scheduled, and read only the statistics of those uploads. We never read your messages, friends, followers or other content. Disconnecting a channel deletes its tokens immediately; deleting your account removes every channel and token, and you can also revoke access at any time from the platform's own settings (Facebook: Settings → Business integrations; Instagram: Settings → Apps and websites). To request deletion of Meta-related data separately, email support@reelnaut.com and we will confirm within 7 days.

5. Cookies

Without your consent we set only strictly necessary cookies: the sign-in session cookie (so you stay logged in), a CSRF-protection cookie during sign-in and channel connection, and a cookie remembering your answer in the cookie bar. These are required for the site to work and do not need consent under the ePrivacy Directive and GDPR. Only if you press "Accept" do we load Microsoft Clarity (cookies _clck, _clsk; analytics, up to 1 year; Microsoft privacy statement) and the Meta Pixel (cookies _fbp, _fbc; ad measurement, up to 90 days; Meta privacy policy) and the Google Ads tag (cookies _gcl_au, _gcl_aw; ad measurement, up to 90 days; Google privacy policy). To change your answer at any time, use "Cookie settings" at the bottom of every page and the bar asks again. We keep anonymous, aggregated usage statistics (page visited, country, device type, referring site) to understand how the service is used; these are collected without cookies and IP addresses are stored only as a one-way hash. For security we log requests that look like attacks (scanners, floods, blocked networks) together with the IP address for up to 90 days. Our payment partner sets its own cookies on its checkout pages under its own privacy policy.

6. Storage, security and retention

• Data is hosted in the EU (Frankfurt) on Vercel, Supabase and Cloudflare. Generated videos and images are stored on Cloudflare R2 and served through public links so that platforms can fetch them.
• Tokens are encrypted at rest; all traffic uses HTTPS; access is limited to the operator.
• Account data is kept while your account exists. Delete a video and its files are removed; delete your account from Settings and all data, including channel tokens, is removed within 30 days. Invoices are kept as long as accounting law requires.

7. Sharing and international transfers

We share data only with the processors needed to run the Service (hosting, database, storage, email delivery, AI generation, payment processing by Flitt / TBC Bank) under agreements that limit them to processing on our behalf, and with the social platforms you connect. Some processors are outside the EU; transfers rely on standard contractual clauses or equivalent safeguards.

8. Your rights

You can access, export, correct or delete your data from the app or by emailing us. If you are in the EU/EEA or UK you also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. We answer requests within 30 days.

8a. Deleting your data

You can delete everything we hold about you at any time, without contacting us:

1. Sign in and open Settings → Delete account. Confirm the deletion.
2. Your series, videos, generated files, connected channels and their access tokens (YouTube, TikTok, Instagram, Facebook) are removed within 30 days. Invoices are kept only as long as accounting law requires.
3. To disconnect a single platform instead, open Channels and choose Disconnect: the stored token for that platform is deleted immediately.

If you removed ReelNaut from your Facebook or Instagram account settings, or cannot sign in, email support@reelnaut.com with the email address of your ReelNaut account and we delete the data within 30 days and confirm by email.

9. Children

The Service is for adults (18+). We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

10. Changes and contact

We will announce material changes to this policy in the app. Questions: support@reelnaut.com. See also our Terms of Service.