Legal
Privacy Policy

Privacy Policy

Last updated: 9 July, 2026

ReelFlow Ltd is committed to protecting your personal data and being transparent about how we use it. This policy explains what data we collect, why we collect it, who we share it with, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

1. Who we are

ReelFlow Ltd ("ReelFlow", "we", "us", "our") is a UK-based company providing an interactive short-form video platform for B2B websites.

  • Registered address: ReelFlow Limited, Studio 9, 50–54 St Paul's Square, Birmingham, B3 1QS, United Kingdom
  • Companies House registration: 15612956, registered in England and Wales
  • ICO registration number: ZB724572
  • Privacy contact: privacy@reelflow.com

We have not appointed a Data Protection Officer (we are not legally required to do so at our current size). Any privacy enquiry should be directed to privacy@reelflow.com.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time: www.ico.org.uk / 0303 123 1113. We would appreciate the opportunity to address your concern first.

2. What this policy covers

This policy applies to three distinct groups:

  • Application users — people who hold a ReelFlow account (customers, administrators, team members)
  • Marketing website visitors — people who browse reelflow.com
  • End-users — people who watch ReelFlow-powered videos on our customers' websites

Each group has a different data relationship with us, explained in section 3.

3. The data we collect and why

3.1 Application users

When you use the ReelFlow platform we collect:

Data type
Examples
Legal basis
Account and identity data
Name, email address, job title, organisation
Contract
Billing data
Subscription plan, invoice history (payment card details handled by Stripe — see section 5.5)
Contract
Product usage data
Features used, videos created, flow interactions, session events
Legitimate interest
Technical data
Browser type, IP address, device type
Legitimate interest
Support communications
Messages exchanged with our team
Contract / Legitimate interest
Marketing preferences
Email opt-in status
Consent

We use this data to:

  • Deliver and operate the ReelFlow platform
  • Process your subscription and billing
  • Provide customer support
  • Analyse and improve product performance through aggregated usage data
  • Send product updates and, where you have opted in, marketing communications

3.2 Marketing website visitors (reelflow.com)

When you visit our marketing website we may collect:

Data type Examples Legal basis
Analytics data Pages visited, session duration, traffic source, device/browser type Consent
Marketing attribution Ad clicks, campaign source Consent
LinkedIn member data Professional profile data linked to LinkedIn ad campaigns Consent
Contact form submissions Name, email address, company, message Legitimate interest
Cookie preferences Your consent choices Legal compliance

These tools collectively build a profile of your visit for the purposes of understanding how our marketing performs and for retargeting. You have the right to object to this profiling at any time — see section 7.

3.3 End-users (viewers of videos on customer websites)

ReelFlow is embedded on our customers' websites to deliver interactive video experiences to their visitors. In this context, ReelFlow acts as a data processor on behalf of our customers, who are the data controllers for their own website visitors.

What we collect from end-users on behalf of our customers:

  • Video interaction events (plays, pauses, chapter completions, button clicks)
  • Flow progression data
  • Anonymous session identifiers

What we do not collect from end-users:

  • Names, email addresses, or other directly identifying personal data
  • Biometric or sensitive personal data

If you are a visitor to a customer's website and have questions about how your personal data is used, please contact that website's operator. Our customers' obligations to their users are governed by their own privacy policies, not this one.

4. How long we keep your data

Data Retention period
Account data Duration of subscription, plus 6 months
Billing records Duration of subscription, plus 7 years (UK statutory accounting requirements)
Support communications Duration of subscription, plus 3 years
Product usage and analytics Duration of subscription, plus 3 years
Marketing website analytics 14 months
AI Stand-in source material Deleted within 30 days of processing
Marketing active prospects (engaged in last 3 years) Retain while in active pipeline
Marketing cold leads (not engaged in last 3 years) Delete personal data

If you request deletion of your user account, we will remove your personal data within 30 days, subject to the legal retention periods above.

5. Our infrastructure and sub-processors

We use a number of trusted third-party services to operate ReelFlow. Where these services process personal data on our behalf, we have Data Processing Agreements in place with each supplier.

5.1 Core hosting and infrastructure

Supplier Purpose Data involved Location
Amazon Web Services (AWS) All product infrastructure — application servers (Elastic Beanstalk), video and media storage (S3), database hosting All product data EU — eu-west-1 (Ireland)
Cloudflare DNS management and edge network protection Request metadata (IP addresses, URLs) Global CDN; SCCs in place for EEA data
Sentry Application error monitoring and performance tracking Error reports and stack traces; may incidentally capture user identifiers (e.g. account ID) when an error occurs in an authenticated session US; SCCs in place

5.2 Marketing website

Supplier Purpose Data involved Location
Webflow Hosting and content management for reelflow.com Web visitor data US (global CDN); SCCs in place
Google Tag Manager Tag management container (loads analytics and marketing scripts) Acts as a loader only; data is collected by individual tags below US
Google Analytics (via GTM) Website traffic and behaviour analytics Session data, page views, traffic source, device/browser type US; consent required via cookie banner
LinkedIn Insight Tag (via GTM) Marketing attribution and ad performance measurement LinkedIn member data linked to website visits US; consent required via cookie banner
HubSpot (marketing, via GTM) Web visitor tracking and lead capture on the marketing site Contact data from form submissions, web visit data EU (Frankfurt data centre)
Microsoft Clarity Heatmapping and session recording on the marketing website — captures mouse movements, clicks, and page interaction patterns Web visitor behavioural data; may capture on-screen content US; consent required via cookie banner

5.3 Application communications and CRM

Supplier Purpose Data involved Location
HubSpot CRM, customer onboarding, and customer communications Customer name, email, company, product activity EU (Frankfurt data centre)
Amazon Web Services (SES) Transactional email delivery (account notifications, invoices, security alerts) Email address and email body content EU — eu-west-1 (Ireland)
Google Workspace Internal communications (Gmail) and document collaboration (Drive, Docs) — customer correspondence and shared files pass through these services Customer email content, shared documents, contact data US/EU; Google Workspace DPA in place; data residency configured to EU where available
Fireflies AI-powered transcription of customer-facing meetings and internal calls where participants have been informed of recording Meeting audio, transcript text, participant names — may include customer employee names and discussion content US; SCCs in place

5.4 Product analytics

Supplier Purpose Data involved Location
PostHog In-product analytics and feature usage tracking Usage events, session data EU (PostHog Cloud EU, Frankfurt)

5.5 Payments

Supplier Purpose Data involved Location
Stripe Subscription management and payment processing Billing details; payment card data handled directly by Stripe US/EU; Stripe is PCI-DSS Level 1 certified

We do not store payment card details. All card data is handled directly by Stripe and never touches ReelFlow's servers.

5.6 AI features — available to all users

Supplier Purpose Data involved Location
OpenAI (Whisper API) Automatic caption generation for uploaded videos Audio extracted from uploaded videos US; SCCs in place
Auphonic Audio quality enhancement applied to uploaded videos (standard feature, all users) Audio from uploaded videos EU — Auphonic GmbH is an Austrian company; data stored in Germany; no international transfer required

5.7 AI Stand-in feature — opt-in, separately priced

The AI Stand-in feature is an optional add-on that allows ReelFlow customers to generate new video content from original source footage, including synthetic video and audio in their own likeness and voice. It requires explicit opt-in, is separately priced, and carries its own usage agreement.

This feature is not available to standard ReelFlow accounts.

When a customer activates AI Stand-in, the following suppliers may process their data:

Supplier Purpose Data involved Location
ElevenLabs (voice synthesis) Generating text-to-speech audio in the customer's voice Customer voice recordings US; SCCs with UK Addendum, and certified under the UK Extension to the EU-US Data Privacy Framework
Tavus Generating new video from original source footage Customer likeness — original and generated video US; SCCs in place
HeyGen Generating new video from original source footage Customer likeness — original and generated video US; SCCs in place

Source material retention: Original video and audio recordings used for AI Stand-in generation are deleted within 30 days of processing. Customers are informed of all suppliers involved when they enrol in the Stand-in feature.

The data processed by these suppliers — voice recordings and facial likeness — constitutes biometric data within the meaning of UK GDPR Article 4(14) where it is processed for the purpose of uniquely identifying a natural person. We treat this data as Special Category personal data under UK GDPR Article 9. Our lawful basis for processing it is explicit consent under Article 9(2)(a): customers must actively opt in to the Stand-in feature, are presented with a clear description of how their biometric data will be used before enrolment, and may withdraw consent at any time. We only share this data with the suppliers listed above, only for the purpose of generating the customer's Stand-in content, and only with the customer's explicit consent.

5.8 Development tooling

The following tools are used internally and have access to code or system metadata only — no customer personal data passes through them.

Supplier Purpose Data involved Location
GitHub Source code repository and version control Code only — no customer data US
Zapier Internal workflow automation Notification triggers and limited operational metadata US; SCCs in place

6. International data transfers

ReelFlow's core product infrastructure is hosted in the EU (AWS eu-west-1, Ireland), so your primary account and workspace data stays within the EEA by default.

Some suppliers listed in section 5 are based in the United States. Where data is transferred outside the EEA we rely on one of the following lawful transfer mechanisms under UK GDPR and the Data (Use and Access) Act 2025:

  • Standard Contractual Clauses (SCCs) — the primary mechanism used with most US-based suppliers
  • UK-US Data Bridge — where the US recipient is certified under the UK Extension to the EU-US Data Privacy Framework, we may rely on this adequacy decision as an alternative to SCCs

Our HubSpot CRM is configured to a Frankfurt-based data centre, ensuring customer contact data remains in the EU.

In the event of a personal data breach, we will notify affected customers within 72 hours of becoming aware of it, in line with UK GDPR Article 33.

7. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

Right What it means
Right to be informed To know how your data is used — this policy fulfils that obligation
Right of access To receive a copy of the personal data we hold about you
Right to rectification To have inaccurate or incomplete data corrected
Right to erasure To have your data deleted where there is no lawful reason to keep it
Right to object To object to processing based on legitimate interests, including direct marketing
Right to restrict processing To pause processing while accuracy or an objection is assessed
Right to data portability To receive your data in a structured, machine-readable format
Rights relating to automated decision-making Under UK GDPR and the Data (Use and Access) Act 2025, you have protections against decisions made about you solely by automated means that produce legal or similarly significant effects. ReelFlow does not currently make such decisions about application users, but AI features (such as auto-captions and AI Stand-in generation) do involve automated processing — these are content generation tools, not decision-making systems.

To exercise any of these rights, email privacy@reelflow.com. We will respond within one calendar month. We may need to verify your identity before acting on your request.

You can also delete your ReelFlow account at any time from your account settings. Deletion triggers removal of your personal data within 30 days, subject to the retention exceptions in section 4.

8. Marketing communications

We only send marketing emails to people who have opted in. You can unsubscribe at any time by:

Unsubscribing from marketing will not affect transactional communications related to your account (invoices, security alerts, product notifications).

9. Cookies

Our marketing website uses cookies for essential functions and, with your consent, for analytics and marketing.

You can manage your preferences at any time using the Cookie Preferences link in the footer of reelflow.com. Without your consent, analytics and marketing tags (Google Analytics, LinkedIn Insight Tag, Microsoft Clarity) will not activate.

The Data (Use and Access) Act 2025 introduces reforms to cookie consent rules under the Privacy and Electronic Communications Regulations (PECR). We are monitoring the commencement of those provisions and will update this section and our consent implementation accordingly.

10. Sharing your data

We do not sell your personal data. We share data only with the sub-processors listed in section 5, subject to Data Processing Agreements.

We may also share data:

  • Where required by law or regulation, or to comply with a court order
  • With a successor entity if ReelFlow is sold or merged, with that entity bound by this policy
  • With professional advisers (legal, financial) under confidentiality obligations

11. Third-party links

Our website and application may contain links to third-party websites and services. We are not responsible for their privacy practices. We encourage you to read the privacy policy of any site you visit.

12. Children

ReelFlow is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe we have done so inadvertently, please contact privacy@reelflow.com and we will delete it promptly.

13. Changes to this policy

We review this policy regularly and publish updates at reelflow.com/legal/privacy. The date at the top of this page reflects the most recent revision. If we make material changes that affect your rights, we will notify active account holders by email.

14. Contact us

Email: privacy@reelflow.com

Post: ReelFlow Limited, Studio 9, 50–54 St Paul's Square, Birmingham, B3 1QS, United Kingdom

ICO (supervisory authority): www.ico.org.uk — 0303 123 1113

‍