Privacy Policy

This policy explains what ProductToReel collects and why. We collect the minimum needed to run the Service.

Who we are

ProductToReel is operated by an individual sole trader based in Ukraine, who is the controller of your personal data: the one who decides why and how it is used. We have no establishment in the EU, the UK or Türkiye: wherever you live, write to us directly at hello@producttoreel.com.

What we collect

• Product inputs: the links, photos and text you submit, the product information extracted from those pages, the storyboards generated from them, the videos rendered from them, the looks made for them (stills of an AI presenter, or AI hands, holding your product), and your edit requests.
• Account data: your email address, sign-in codes (short-lived), session cookies, credit balance and order history, and how you first found us: the site that sent you, the campaign tags (utm) and ad-click marker in that link, and the page you first opened, never the rest of either address — read from the analytics cookie when you create your account.
• Sign-in with Google: if you sign in with Google, Google tells us your email address and your Google account id, which we keep to sign you in; it also sends your name and profile photo, which we don't keep. Google handles your sign-in under its own privacy policy.
• Abuse-prevention data: a salted hash of your IP address (we do not store the address itself), request timestamps and Cloudflare Turnstile results.
• Usage data: the pages you visit and what you click, page load times, errors the site runs into, and recordings of your visits (what you type into forms is masked and never recorded), with your browser, device and approximate location, worked out from your IP address, which is then discarded. Once you sign in, it is linked to your account id and email.
• Payment data: handled by Whop, our payment processor — we never receive card details. We keep a record of each payment event Whop sends us — the payment and order ids, the amounts, and the buyer details Whop includes (name, email, billing address and country) — for bookkeeping.
• Accounts you share to: if you publish a video, schedule posts or run a video as an ad, the id and username of each TikTok, Instagram, YouTube, Facebook or ad account you connect (never its password), the captions and ad settings you enter, and the ids, statuses and links of the posts and ads made.
• Your face, if you make an AI avatar of yourself: the clip you record for its check, the portrait cut from it and the check's results, described in full under “Your own face (AI avatar)” below.

How we use it

To extract products, write scripts and render videos; to publish your videos, schedule your posts and create your ads on the accounts you connect, when you ask; to sign you in and keep your account; to prevent abuse and enforce our terms (for this we may review uploaded photos, storyboards and generated videos); to send transactional emails (sign-in codes, and an email when your videos or looks are ready, when your AI avatar is ready or can't be made, or when credits come back, written in the language of the page you ordered them on, which you can turn off on your Credits page); to send one reminder email about a storyboard you made a free preview of and haven't made a video from, a day or two after the preview, one about a purchase you started and didn't finish, about an hour later, and one about your next video, two days after a video you bought, each of which you can turn off on your Credits page or with the unsubscribe link in it; to see how the site is used and fix what breaks; to learn which sites and ads bring visitors and customers. We do not sell personal data and we do not use your content to train AI models.

Legal bases

We rely on our contract with you, to run your account, make what you order, take payment and send the emails the Service needs; on our legitimate interests, to keep the Service safe, see how it is used and fix it, measure our ads and send the reminders about a preview, an unfinished purchase or your next video, which you can object to; on the law, to keep payment records for bookkeeping and tax; and on your explicit consent, for an AI avatar of your own face, which you can withdraw at any time. We collect your data from you, through the site and, for an AI avatar, your camera; automatically, through cookies and server logs; from Whop, for payments; and from Zernio, for the accounts you connect to share a video.

Your own face (AI avatar)

Making an AI avatar of yourself is optional: the AI presenters of our library involve no processing of your face. If you make one, you first sign a separate release, on a screen of its own, before any camera opens. This section repeats what it says.

• What we collect: a clip of about 12 seconds that you record on your AI avatar page, in which you read aloud a code shown on the screen and turn your head as asked; a portrait and a small thumbnail cut from the end of that clip; the facts of the check — when the code was shown and the clip uploaded, the clip's fingerprint (a SHA-256 hash, which can't be turned back into the clip), the automatic check's answers and the reviewer's decision; the version of the release you signed and when you signed it; and how you want the label to refer to you and the stock AI voice you pick for your avatar, which never speaks with your own voice. We never compute or keep a template of your face, or any measurement of its shape.
• Who looks at it: a person at ProductToReel watches your clip to confirm that a live adult reads the code and that the portrait shows the same person. An AI model looks at frames of the clip and at the portrait for picture quality and for content we don't accept, such as a child or a public figure; it is never asked who you are. Our video vendors analyse your face only to animate it. Nobody uses it to recognise you.
• Why: to confirm that the face is yours and live, and to keep a record of your consent; to make the AI videos you ask for, of you speaking and holding your products, for your own ads; and to check that the pictures and videos we generate keep your likeness, by comparing them with your portrait. Only your account can use your avatar. We rely on the consent you give in the release.
• Who processes it: Muapi.ai and the providers of the video models it runs (your portrait and the lines your avatar speaks, to animate it); OpenRouter and Anthropic (frames of your clip, your portrait and the pictures generated from it, for the checks above); Railway (storage, US).
• How long: the clip until the reviewer decides, at most 7 days — a clip that fails a check is deleted at once, and one uploaded but never submitted, after 1 hour; a setup you never finish, and what is left of one that was turned down, 7 days; the portrait, its thumbnail, your avatar's hello video and the pictures made from them, until you delete your avatar, 12 months after it was last used (we email you 14 days before), or with your account; a record that you signed the release — its version, when you signed it, when you made your check attempts, and when and why your avatar was verified and deleted, without your face or the clip — for 5 years after your avatar is deleted, so we can show your consent if it is ever questioned, with your email address only as a hash. Videos made with your avatar stay in your account like any video, unless you delete them with it.
• What we never do: sell it, share it with anyone but the processors above, use it to train AI models, or use it for anything not described here, our own marketing included.
• Withdraw any time: “Delete my face” on your AI avatar page withdraws your consent and takes effect at once: generation with your face stops, and your clip, your portrait and the pictures made from them are deleted. Videos already made stay in your account unless you tick “also delete them”; videos you published are yours to take down. You can also ask by email from the address on your account, and we delete it within 30 days, usually within two business days.

Some laws give images of a face special protection, such as Washington's My Health My Data Act, Illinois' Biometric Information Privacy Act and the GDPR. We apply the rules above to every avatar, wherever you live. If you live in Washington State, our Consumer Health Data Privacy Policy sets out your rights.

Processors

Used today: Railway (hosting and file storage, US), Cloudflare (bot protection, US), OpenRouter (script writing, content screening, and some video clips and voice-overs, US), Anthropic (script writing and content screening, US), Muapi.ai (video, image and voice generation, India), Whop (payment processing, sales tax and ad measurement, US), PostHog (product analytics, session recordings and error reports, US), Resend (email, US) and Zernio (publishing to social networks and ad accounts, Spain). Each receives only what its function needs: OpenRouter and Anthropic receive the text you submit for screening, and the product photos and looks they check for Product in hand and Hands only, and, for an AI avatar, frames of its clip, its portrait and the pictures generated from it, and Muapi receives product photos and scripts and, for an AI avatar, its portrait and the lines it speaks, and OpenRouter, for a clip or a voice-over it makes in Muapi's place, receives that product photo or script and passes it to the model's provider, and Whop receives your email and payment details at checkout, and, through its pixel, the pages you visit (see Cookies), and PostHog receives the usage data described above, and Zernio receives the videos you share, their captions and, for an ad, its settings, never your email address. Whop handles payments as an independent controller, under its own privacy policy. The networks you share to — TikTok, Meta (Instagram and Facebook) and YouTube — receive your posts and ads under their own terms and privacy policies. Besides them, a proxy service fetches the product pages some stores block, our email host receives what you write to us, and Telegram carries our alerts about failures, with internal ids only.

International transfers

We are in Ukraine, and most of our processors are in the US; Muapi.ai is in India and passes each job to the providers of the models it runs. When the GDPR or the UK GDPR treats sending your data to a processor outside the EU or the UK as a transfer, we rely on the EU-U.S. Data Privacy Framework and its UK extension for Railway, Cloudflare, PostHog and Resend, which have joined it, and on the European Commission's standard contractual clauses, with the UK addendum, in OpenRouter's and Anthropic's data processing terms; you can ask us for a copy. India has no adequacy decision, and Muapi.ai's terms don't include these clauses yet: until they do, it receives only what each job needs, through links that expire within hours, and never your name or email address. Zernio is in Spain, in the EU, and its data processing terms cover its own transfers outside the EU with an adequacy decision or the standard contractual clauses.

Retention

Anonymous storyboards: 24 hours. Your videos: while your account exists; free preview videos: 30 days. Source clips: 7 days after the last video made from them. Looks: the one you pick, and any a video was made from, while it stays picked or the video exists; other looks 30 days. Product photos uploaded on a Looks page: as long as their storyboard, as the product's own photos are. Abuse logs: 7–30 days. Edit requests: 30 days. AI avatar: the consent clip until a person decides, at most 7 days; the portrait until you delete it, 12 months after its last use, or with your account; the record of your consent 5 years after the avatar is deleted (see “Your own face (AI avatar)”). Social and ad accounts you connect: Zernio keeps access to one only while it is connected — we disconnect it once a one-off post or ad is done, or when the period you paid for ends; its id and username, and your posts' and ads' ids, statuses and links, while your account exists. Session recordings: 30 days; usage analytics: 1 year. Account records: while your account exists. When your account is deleted, your storyboards, videos and personal data are removed from our systems within 30 days — except payment event records (described above), which we keep for bookkeeping and tax purposes for as long as the law requires, and do not remove when your account is deleted, and the record of an AI avatar's release, kept as described above. Our processors keep their own copies only as long as their terms allow: Anthropic deletes what it receives through its API within 30 days, or keeps it longer if it flags it under its usage policy, and Muapi.ai's terms set no fixed period, so when you delete your avatar or ask us by email to delete your data, we also ask Muapi.ai to delete its copies.

Cookies

Our pages load Whop's pixel, which measures page views and links purchases to our ads — Whop receives the pages you visit, your IP address and browser details, and keeps an identifier in a cookie and in your browser's storage for up to two years. PostHog keeps an identifier for your browser, and the site and page of your first visit, in a first-party cookie and in your browser's storage for up to a year, so repeat visits count as one visitor. We set a session cookie when you sign in, and Cloudflare Turnstile may set cookies to tell humans from bots. There are no other advertising or analytics cookies.

Your rights

You can ask us to access, export or delete your data at any time by emailing hello@producttoreel.com from the address on your account. We answer within 30 days, usually within two business days. You can also ask us to correct it or to restrict its use, and object to our use of it on the basis of our legitimate interests; for the reminder emails, their unsubscribe link does it at once. EU/UK residents have the rights set out in the GDPR, including the right to lodge a complaint with a supervisory authority: in the EU, the one where you live or work (the European Data Protection Board lists them), and in the UK, the Information Commissioner's Office. Residents of Türkiye can complain to the Personal Data Protection Board after writing to us, and residents of Brazil to the ANPD. You withdraw your consent to an AI avatar with “Delete my face” on its page, at once. Washington residents have the rights set out in our Consumer Health Data Privacy Policy.

Contact

hello@producttoreel.com