Política de privacidad

Descargar

PRIVACY POLICY

Last updated on 21 October 2026


1. WHO IS RESPONSIBLE FOR YOUR DATA

Tim Zierer, trading as Reelwire, Calle 47A x 47Y 100-1 #818, Fraccionamiento Las
Americas 2, 97302 Merida, Yucatan, Mexico. Sole trader.

Email: contact@reelwire.io
Phone: +52 999 567 5838

This policy covers the Reelwire website, its documentation, the checkout, the Reelwire
application, its API and its MCP server, and the pages Reelwire serves for its customers:
syndication sign-up pages and post kits. Where this policy says "we" it means the sole
trader named above. It is also our privacy notice (aviso de privacidad) under Mexican law;
section 8 covers what that law adds.

1.1 When we act for a customer

Most of this policy is about data we decide on ourselves. Some data we hold only because a
customer of ours put it into Reelwire or had Reelwire collect it: the content of their
workspace, and the details of their syndication participants (2.8). For that data the
customer decides what it is for, and we process it on their behalf and on their
instructions. The customer is responsible for telling the people concerned. If you are a
syndication participant, or somebody shown or named in a customer's content, that customer
is the one to ask first; we will help them answer you. Our Data Processing Agreement
(https://www.reelwire.io/data-processing-agreement/) is our contract with every customer
for this data.


2. WHAT WE COLLECT, AND WHY

We collect the following and nothing else. Each entry says what it is for and how long it
is kept. An email address and a password are needed to open an account, and billing
details and a payment method to buy a plan; everything else is up to you.

2.1 Your account

Your email address, the name you give, and a one-way hash of your password. We never store
the password itself and cannot recover it, which is why a reset replaces it rather than
sending it to you. We also record when you agreed to our terms and this policy, and whether
you want our optional emails (2.9). For each signed-in session we keep when it started,
when it was last active and the browser it came from, so that you can see and end your
sessions. If you switch on two-factor sign-in, we also keep the secret your authenticator
app shares with us, encrypted, and one-way hashes of your recovery codes; both go when you
switch it off.

Kept while your account exists, and deleted with it.

2.2 Your workspace and its billing details

The workspace name, the plan it is on, the people in it and what each may do, and the
billing details you enter: company name, billing address, and a tax identifier (RFC or VAT
number) where you give one. If you are in Mexico and ask for a CFDI, also the Constancia de
Situacion Fiscal and the uso de CFDI you send to facturacion@reelwire.io.

Billing details are frozen onto each invoice at the moment it is raised, because an
invoice has to say what was true when it was issued rather than what is true today.

The workspace is kept while it exists, and our own copy of its billing details goes with
it. The invoices themselves are issued and kept by Stripe (2.3), and we keep them, with any
CFDI, in our accounting records for five years, as Mexican tax law requires, also after the
workspace is deleted.

2.3 Payment details

Payments are processed by Stripe. You enter your card or bank details on Stripe's own
page, and they never reach our servers. Stripe tells us the state of the subscription and
of each payment and, for a card on file, its brand, last four digits, expiry and the
holder's name, which we keep so you can see which card is on file.

The card's details are kept until the workspace is deleted, so that subscribing again
shows the same card. Stripe also uses payment data for its own purposes, such as preventing
fraud, as an independent controller under its own privacy policy:
https://stripe.com/privacy

2.4 What you put into the product

Media you upload, posts you write, brands you configure, the data you send over the API,
and the clips Reelwire renders from all of it.

This is your content. We process it to run the service you asked for and for nothing else.
We do not mine it, sell it, or use it to train anything, and we look at it only when you
ask us to help with it, or when we have to in order to keep the service running or to
investigate abuse.

Kept while your workspace exists. Media stays until you delete it. Rendered clips are kept
first in, first out: when a new clip does not fit in your plan's storage for clips, the
oldest are removed. When the workspace is deleted, all of it goes with it. The working
copies a renderer makes while it draws a clip are deleted within a day of the render.

2.5 Keys, credentials and addresses you give us

The API keys you make and the AI assistants you connect with them; the keys you add for the
AI services the assistant uses; the credentials you give a channel's platform connector; the
webhook address and signing secret your clips are handed over to; and, if you syndicate, the
mail server details you give for its emails and each group's webhook secret and portal key.

API keys are stored as a hash for checking. Some credentials, such as a key made on the API
keys screen or the webhook's signing secret, are also kept so that a person holding
Administration can copy them again after typing their own password; every such copy is
written to the workspace's audit log.
AI keys, connector credentials and the mail server's password are encrypted at rest and
shown back to you only in part. Each is used for one purpose: reaching the service,
platform or address it belongs to, when your workspace asks for it.

Kept until you remove them, or until the workspace is deleted.

2.6 The AI assistant

When you use the assistant, what you write, the files you attach and the pictures you
choose are sent to the AI service you chose, with your own key, under your agreement with
that service. Chats, their attachments, and results you did not keep in your media library
are deleted a day after the chat was last used.

2.7 Records of what the system did

An audit log of what changed in a workspace and who changed it, delivery records, render
records and the session records in 2.1. Separately, our application server logs each
request with the IP address it came from.

These exist so that a failed post can be explained, a bill can be justified, and abuse can
be investigated. They are not used to build a profile of you.

The records in a workspace are kept while it exists and deleted with it. Server logs are
kept for 30 days and then deleted automatically.

2.8 Syndication participants

If you sign up on a Reelwire customer's syndication page, or that customer adds you, we
hold what you or they gave: an email address, a webhook address and a contact email
address for it, the participant ID the customer's own site passes, and the channels you
chose. We also keep a record of what was sent to you and when. We use it to confirm your
address, to send you that customer's posts in the ways you chose, and to stop when you ask.

We do this for the customer, as 1.1 describes. A sign-up that confirms nothing within a
week is removed, and a participant with no way left to receive anything is removed at
once. If the customer blocks you, what identifies you is kept so that the block holds,
until the customer unblocks or removes you. Everything else is kept until you unsubscribe,
the customer removes you, or the customer's group or workspace is deleted.

2.9 Email we send you

Some letters come with having an account and cannot be switched off: confirming your email
address, password resets, security notices, notices about your plan, allowance and
payments, the posts handed over to you by email and their reminders, posts waiting for your
approval, and the confirmation that an account was deleted. Receipts and invoices are sent
by Stripe on our behalf.

Others are optional: tips while you start, monthly reports, offers, and an occasional
personal letter from the founder. You can refuse them when you sign up, and stop them at
any time with the link at the foot of each one or the switch on My account.

Our server log records that a message was sent and whether the mail service accepted it,
for the 30 days in 2.7. Emails that hand a post over, to you or to a syndication
participant, also leave a delivery record in the workspace. Our emails load nothing from
anybody else's servers.

2.10 The website's forms

The contact form sends your name, email address and message to our mailbox, where it is
kept as correspondence for two years after our last exchange with you, then deleted. So
that nobody can make us send you more than one receipt a day, we also keep a one-way code
of your address for two days.

The newsletter form passes your email address, and the IP address the form was sent from
as a record of your consent, to MailerLite, which sends you a confirmation first and adds
you only once you confirm it. Every newsletter carries a link to unsubscribe; MailerLite
then keeps your address marked as unsubscribed, so that it is never written to again.

2.11 The affiliate programme

If you take part in the affiliate programme, we hold the details you give for it: your or
your company's name and address, your tax details, any documents you upload, and for each
payout the bank account it is sent to. Bank details are encrypted at rest and shown back to
you only by their last four characters. We also record which customers you referred and
the commission each earned; you see only totals, never who they are.

To catch somebody referring themselves, we compare a referred workspace's email domain,
tax number and card with the affiliate's own, and hold matches for a person to review
rather than paying them.

Used to run the programme, pay commission and keep the records tax law requires. If you
delete your workspace, the agreement is closed rather than deleted: your details stay while
commission can still be paid to you, for up to twelve months, and the payout records and
statements, with the tax details on them, are kept for five years after the payout, as
Mexican tax law requires. If you arrived through an affiliate's link, we record that
affiliate against your workspace (see 4.2).


3. WHAT WE DO NOT DO

We do not run advertising, and we carry no advertising trackers anywhere.

We do not sell personal data, and we do not share it for anyone else's marketing.

We do not use your content to train machine-learning models, ours or anybody else's.

We do not ask for sensitive personal data, such as health, religion or political opinions.

We make no decision about you with legal or similarly significant effect by automated means
alone.


4. COOKIES AND BROWSER STORAGE

4.1 The consent question

When you first arrive on the website we ask what we may set. Your answer covers the
website, the documentation, the checkout and the application alike, because they share
it.

  Necessary. One cookie recording the answer you gave, kept for a year. Without it we
  would have to ask again on every page, which is not a question, it is pressure.

  Analytics. If you agree, we load Google Analytics, which sets cookies that let us see
  which pages are read and for how long, and which steps of signing up and buying are
  taken. Nothing about your workspace's content, posts or customers is sent. If you
  decline, or never answer, no Google Analytics script is loaded at all: it is not loaded
  first and disabled afterwards.

  Referrals. If you agree, and you arrived through an affiliate's link, we remember that
  link in a cookie for sixty days. See 4.2.

Analytics and Referrals both start switched off. You can change your answer at any time
with Cookie Settings at the foot of every page of the website. Saying no then also deletes
the Analytics and Referrals cookies already set.

4.2 An affiliate's link

If you arrive through an affiliate's link (an address ending in ?ref= and a code), and you
tick Referrals when we ask (4.1), we keep that code in a cookie for sixty days, so the
affiliate is credited if you sign up or buy within that time. It holds the code and nothing
about you. Without that yes no cookie is set: the code only travels in the address when you
go on from the website to the checkout or the application in the same visit, so a signup
made then is still credited to the affiliate. The checkout keeps it in the browser tab,
with any promo code you type, until you close the tab, so that the discount it carries
reaches your payment.

4.3 The website, the checkout and the application

The website, the checkout and the application remember the language you chose, in a cookie
the three share and in your browser's local storage, for a year; until you choose one they
follow your browser's language. When you sign in to the application, your session is kept
in your browser's local storage until you sign out or it expires; in the checkout it is kept
in the browser tab until you close it, with the plan you are paying for. The application
also remembers on your device the AI model you last used, the brand you last picked, the
shape you last chose in a preview and where you are in Get started. None of this is used
for tracking, and none of it is sent to anybody but us.

The website, the documentation, the checkout and the application load nothing from anybody
else's servers except Google, as 4.1 and 4.4 describe, and Stripe's own page when you pay.

4.4 reCAPTCHA

Signing in, signing up and resetting a password, in the application and in the checkout,
and the forms on the website, are protected by Google reCAPTCHA v3, which tells us whether
a submission came from a person or from a script. To do that, Google's script collects
information about the device and the browser and how it is being used, and may set
cookies of its own, under Google's privacy policy and terms:

  https://policies.google.com/privacy
  https://policies.google.com/terms

It is not covered by the choice in 4.1. We rely on the exception for storage that is
strictly necessary for a service you asked for, because signing in and the forms could not
be offered safely without it, and on our legitimate interest in keeping the service
secure. Google receives this data as a controller of its own. We receive a score, not a
profile, and we use it for nothing else.


5. WHO ELSE PROCESSES IT

We use a small number of providers, each for one job:

- Hetzner Online, whose servers in Finland and Germany the service runs on. Where exactly,
  and what leaves the European Union, is on https://www.reelwire.io/hosting/.
- Stripe, for payments, subscriptions, receipts and invoices. See 2.3.
- Postmark, for sending the emails listed in 2.9.
- Google, for our mailboxes, which hold what you write to us and the contact form's
  messages; for reCAPTCHA (4.4), as a controller of its own; and, only if you agreed to
  it, for Google Analytics (4.1).
- MailerLite, for the newsletter list, only if you subscribed to it.
- For customers in Mexico who ask for a CFDI, the authorised certification provider (PAC)
  that stamps it and the Servicio de Administracion Tributaria (SAT), which receive what a
  CFDI must carry, as Mexican tax law requires.

And the services you choose, which receive exactly what you or your workspace send them
and are then governed by their own terms and their own privacy policies: the AI services
you connect with your own keys, the platforms your platform connectors post to, the
webhook addresses and posting services you hand clips to, and your syndication
participants.

We are in Mexico, the servers are in the European Union, and Stripe, Postmark, Google and
MailerLite may process data in the United States or elsewhere. Where personal data is
transferred, it is transferred under the safeguards each provider offers, such as the
EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses;
write to us for a copy. We pass personal data to another controller only where that is
needed to carry out our contract with you (Stripe), to keep the service secure (Google's
reCAPTCHA), where the law requires it (the SAT), or where you or your workspace asked for it
(the services you choose).


6. LEGAL BASES

Where the GDPR applies to you:

- Running the service, billing you for it and supporting you: performance of a contract.
- Answering what you send us through the contact form or by email: our legitimate interest
  in replying, or steps you asked for before a contract.
- Keeping invoices, CFDIs and tax records: a legal obligation.
- Security, fraud prevention, abuse investigation, reCAPTCHA, the affiliate programme's
  self-referral check and the server logs: our legitimate interests.
- Crediting an affiliate with a signup made in the same visit as their link: our
  legitimate interest in paying affiliates for the customers they bring.
- Optional emails to our customers about Reelwire: our legitimate interests, which you can
  refuse when you sign up and object to at any time with the link in each one or on My
  account.
- Google Analytics, the affiliate link's cookie and the newsletter: your consent, which you
  can withdraw at any time.
- Content and syndication participants' details processed for a customer (1.1): the
  customer's own legal basis.


7. YOUR RIGHTS

You may ask us to give you a copy of your personal data, correct it, delete it, restrict
what we do with it, or hand it to somebody else in a portable form. You may object to
processing we base on legitimate interests. Where processing rests on consent, you may
withdraw it.

Write to contact@reelwire.io. We answer without undue delay and within one month; where a
request is complex we may take up to two months more, and then tell you so within the first
month. For people in Mexico, the deadlines in section 8 apply as well. If you are in the EU
or the UK and you are not satisfied with the answer, you may complain to your national
supervisory authority.


8. FOR PEOPLE IN MEXICO

This section is what the Ley Federal de Proteccion de Datos Personales en Posesion de los
Particulares adds to the rest of this policy.

Primary purposes, which our relationship with you needs: providing the service, your
account and workspace, billing, issuing invoices and CFDIs, support, the emails that come
with an account, security and abuse prevention, and, if you take part, the affiliate
programme and its payouts.

Secondary purposes, which it does not need: the optional emails in 2.9, the newsletter,
Google Analytics and the affiliate link's cookie. You can refuse each of them without it
affecting the service: with the switch when you sign up, the stop link in any optional
email or the switch on My account, the unsubscribe link in the newsletter, Cookie Settings
on the website, or by writing to us.

The transfers in section 5 are needed to carry out our contract with you, to keep the
service secure or to meet the law, or you asked for them, so they need no separate consent.

Your ARCO rights (access, rectification, cancellation and opposition), and withdrawing a
consent you gave, are exercised by writing to contact@reelwire.io, from the email address
on your account if you have one, saying which right you are exercising and which data it
concerns, and showing who you are (or, for a representative, that they may act for you).
We answer within 20 business days, and carry out what was agreed within 15 business days
after that. If you believe your rights have been infringed, you may turn to the authority
Mexican law makes responsible for the protection of personal data.

Changes to this notice are made as section 11 describes.


9. SECURITY

Traffic is encrypted in transit. Keys for AI services, platform connector credentials, API
keys kept for copying again, mail server passwords, two-factor sign-in secrets and
affiliates' bank details are encrypted at rest. Passwords are stored as one-way hashes, and
API keys as hashes for checking (2.5). Every account can add two-factor sign-in with an
authenticator app. Access to production data is limited to the people who need it to
operate the service.

No system is perfect. If a breach affects your personal data, we will tell you and the
relevant authority as the law requires.


10. CHILDREN

Reelwire is not directed at children. We do not knowingly collect data from anyone under
16.


11. CHANGES

We will post any change here and move the date at the top. Where a change is material, we
will tell account holders by email rather than relying on you to notice.


12. CONTACT

contact@reelwire.io, or the postal address in section 1.