Privacy policy

• the email address entered in the form
• the date and time of the sign-up
• the language of the form (Polish or English), so that we email you in that language
• the version of the consent text agreed to when signing up, so that it is clear what exactly the consent covered
• a record of the address confirmation: when a link was last requested, when we sent the last link, how many links we sent and when the address was confirmed
• when the controller was notified about a new person on the list

We don’t store your IP address with your entry on the list. To stop anyone from flooding the form with thousands of addresses, we count sign-up attempts from a single connection. For this, we keep a hash of your IP address (for IPv6, only of its first half, which usually identifies a single connection) for no longer than 3 hours after the last sign-up attempt. We calculate the hash with our secret key and the date, so the same address gives a different hash every day, and without the key the IP address cannot be recovered from it.

An entry in the server log (see “Website visits and the server log”) is also created when the form is submitted and when the link from the email is opened, and that link contains the identifier of your entry on the list. So for the 15 days that we keep the log, your email address could be linked to your IP address. We don’t do that.

The list has one purpose: to send you an email saying that Reelumi has launched. The legal basis is your consent (Article 6(1)(a) GDPR). The launch email is information about our service, and the law requires your prior consent to send it by email (Article 398 of the Polish Electronic Communications Law of 12 July 2024). By ticking the box in the form, you give both consents at once, and you can withdraw both at any time.

After you sign up, we send an email with a confirmation link to the address given in the form. Only addresses confirmed by clicking this link will get the launch email. This is how we check that the consent was given by the person the address belongs to, and how we can prove it (Article 7(1) GDPR). The email also contains a link to remove the address. We send another link only if the same address is entered in the form again: up to 3 links, each at least 10 minutes after the previous one. The confirmation email is only for confirming the address and contains no ads. The legal basis is our legitimate interest (Article 6(1)(f) GDPR): the launch email should only reach people who asked for it themselves.

We don’t check whether anyone opened the confirmation email: the logo is embedded in the email, so opening it doesn’t load anything from the internet, and the links lead straight to reelumi.ai. If this email reached you without your involvement, someone else entered your address in the form on reelumi.ai — that is the only place we got it from. You can simply ignore the email: without confirmation, we will delete the address after 7 days, and you can delete it right away with the removal link.

When someone confirms their address, the controller receives an email through Resend with the number of new people on the list and the time of the first and last sign-up. Your address is not in that email. We don’t add you to a newsletter or to any other mailings.

The short-lived hash of your IP address is used only to protect the form from abuse. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).

If you write to us, including by replying to the confirmation email, your message will reach our inbox. We describe the purpose, legal basis and retention period for correspondence in the section “Emails”.

We don’t sell the list or share it with anyone for their own purposes. The list can be accessed by the controller, people authorised by the controller who have access to the Reelumi panel, and people who maintain the service on our behalf. The following store or transmit the data on our behalf:

• IT services — people and companies that maintain the Reelumi server and the accounts of the services listed below. They only access the list when this is needed to maintain the service or delete data, for example after you withdraw consent.
• OVH — the server and the database where the list is kept, and the server log. The server is located in the European Union.
• Resend (Plus Five Five, Inc., San Francisco, USA) — sends you the confirmation email and, when Reelumi launches, the launch email. It sends the controller notifications about new people on the list (without addresses).
• Cloudflare (Cloudflare, Inc., USA) — forwards messages sent to hi@reelumi.ai to the controller’s inbox.

In addition, the controller’s Gmail inbox receives the notifications about the number of new people on the list (without addresses) and the messages you send to hi@reelumi.ai, including replies to the confirmation email. This is a regular Gmail account — we describe the terms of this inbox in the section “Who we share data with”.

Resend and Cloudflare may process data in the USA. Resend always processes it there, even when the email itself is sent by its server in Ireland.

Both companies take part in the EU-U.S. Data Privacy Framework. The transfer is therefore based on a decision of the European Commission confirming an adequate level of protection (Article 45 GDPR). Our data processing agreement with Resend also provides for standard contractual clauses approved by the Commission. You can get a copy of these safeguards by writing to hi@reelumi.ai.

Google may transfer messages from the Gmail inbox outside the EEA under the terms of its service. Google LLC also takes part in the Data Privacy Framework.

We delete an unconfirmed address 7 days after the last request for a link. The server checks this automatically every hour. Signing up in the form counts as a request for a link, and so does signing up again with the same address, as long as it is within the link limit described above.

A confirmed address stays on the list until the first of these events:

• We send the news that Reelumi has launched. We then delete the list within 30 days of that mailing.
• You withdraw your consent. The removal link in our email deletes your address right away, and if you write to hi@reelumi.ai, we delete it promptly.
• It has been 12 months since the sign-up. The server then deletes the entry by itself (it checks this automatically every hour).

We download a file with the list from the panel only for the launch mailing and delete it after that mailing. Database backups are made once a day on the same server, and we keep the last 7, so a deleted address disappears from the backups after the next seven nightly backups, usually after a week. We delete the hash of your IP address no later than 3 hours after the last sign-up attempt, and if it ends up in a nightly backup, it disappears together with that backup. We delete server log entries after 15 days. How long we keep correspondence is explained in the section “Emails”.

Resend keeps sent emails, including the confirmation email with your address, in its sending log for 30 days. If a mailbox permanently rejects an email from us or the recipient marks it as spam, Resend adds the address to our account’s block list so that nothing more is sent to it. That entry stays there with no time limit — we will remove it if you ask us to. Removing your address from the waitlist does not remove it from Resend’s sending log or block list.

• You can withdraw your consent at any time — the easiest way is the removal link in our email. This does not affect the lawfulness of what we did before you withdrew it.
• You can object to processing based on our legitimate interest: the confirmation email, the hash of your IP address that protects the form, server log entries and our correspondence with you.

Just write to hi@reelumi.ai, preferably from the address on the list, so that we can easily confirm the address is yours. You also have the right to access your data and get a copy of it, to have it corrected or deleted, to restrict its processing, to data portability and to lodge a complaint with the President of the Personal Data Protection Office (UODO). See the section “Your rights” for details.

• Giving your address is voluntary. Without it, or without confirming it with the link, we can’t let you know about the launch — and that is the only consequence.
• We don’t profile you or make automated decisions about you.
• Joining the waitlist does not create a Reelumi account and is not a newsletter subscription.

We store:

• email address, name and account type: a person who uses Reelumi, a person who manages accounts, or administration
• password — only as a hash from which the password cannot be read
• if you log in with Google — the identifier of your Google account, which links it to your Reelumi account, and the scope of the consent given in Google (access to your email address). When you log in, Google sends us this identifier, your email address, whether the address is verified and, for Google Workspace accounts, also the company’s domain. We don’t get your name or picture from Google, and we don’t store access tokens to your Google account
• login session: when the login took place, from which IP address and in which browser
• one-time link for setting a password — it works until it is used, for up to 7 days, and one sent by email after a request for a new password — for up to an hour
• panel language (Polish or English)
• name and address of the profile in the panel, time zone, plan and its limits
• who gave access to the profile and when

To make it harder to guess passwords and flood other people’s inboxes, we count login attempts, requests for a new password and attempts to set a new password from a single IP address, and we also count emails with a link for each account. These counters exist only in the server’s memory and disappear when it restarts.

We also store what is created in the panel:

• the channel profile: how you film, your channel goals, your audience, the channel’s topics, topics and words you avoid, the direction of the channel, your way of speaking and writing with a sample text, niche hashtags, content language and notes
• chats with the assistant: questions, answers, pinned notes and the data the assistant quoted
• the Content planner: ideas, their versions, chats about ideas and the publishing calendar
• weekly summaries and notification settings: the day, the time and an email address, if you provide one
• tracked profiles and a note on why you track them, if you write one
• the cost register and task log: what we asked providers to do for your account and when, how much it cost and how it ended

We describe data from Instagram and analysis results in the sections “Data from Instagram” and “AI analysis”. Fields you fill in with your own words are sent to AI models together with the rest of the channel profile. Don’t enter data there that you don’t want to pass on, especially about your health.

This is a test feature, available to selected accounts. In it, you upload one to three video clips with sound. We prepare a preview of them, describe their content (shots, key moments and a transcript of speech) and, at your instruction, put them together into a Reel. The clips may show the image and voice of the person who uploaded them and of people in the frame.

In a project, we store the clips, their working copies (for example the preview and thumbnails), the description of their content, the speech transcript, captions, the chat with the assistant about the Reel and the finished Reels. You can also record your voice for the Reel with your microphone — we store this recording and its speech transcript, and delete them together with the project. We keep the files in Cloudflare R2. The description and the speech transcript are prepared by an AI model, to which OpenRouter forwards our requests — on the same terms as for Reel analysis (see “AI analysis”). Clips from this feature are not sent to deAPI.

The legal basis is our contract with you (Article 6(1)(b) GDPR). We receive the data of people who appear in the clips from the person who uploaded them. We process it on the basis of our legitimate interest (Article 6(1)(f) GDPR), in order to provide the service requested by the person uploading the clips. Objecting to this processing is described in the subsection “Right to object (Article 21 GDPR)”.

Today we settle payments manually: the controller issues an invoice outside Reelumi and marks the period as paid in the panel. In Reelumi, we store the plan and its status, billing periods, amounts, payment dates, invoice numbers, requests to change the plan and statements concerning the right to withdraw from the contract. Reelumi doesn’t collect a tax ID or an address — invoice details stay in the controller’s accounting records.

You see your account data in the panel. If your account is managed by the controller or a member of the Reelumi team, that person sees everything in your profile in the panel, including chats with the assistant and the Content planner. People who maintain the service on our behalf also have access to the database (see “Who we share data with”).

• We run your account and provide the service: logging in (with a password or with Google) and the new-password link, downloading and analysing Reels, statistics from a connected Instagram account, the assistant, the Content planner, building Reels from clips, weekly summaries and billing. The legal basis is our contract with you (Article 6(1)(b) GDPR).
• We protect your account from takeover: we store the session with the IP address and the browser name, and count login attempts and requests for a new password. The legal basis is our legitimate interest, namely account security (Article 6(1)(f) GDPR).
• We keep invoices and payment confirmations because tax law requires it (Article 6(1)(c) GDPR).
• We record which member of the Reelumi team carried out certain actions in the panel, for example marked a payment or gave access to a profile, so that this can be verified later. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).

Giving an email address and a name is a condition for creating an account. Without an Instagram profile name, we can’t prepare analyses.

You can delete your account in the panel: Channel profile → the “Your account” section → “Delete account” (reelumi.ai/app/konto/usun). On a phone, “Channel profile” is the gear icon in the header, next to the light and dark mode switch. The page first shows what will disappear and when, and you confirm the deletion with your password.

• We immediately log you out on all devices, it is no longer possible to log in, and we stop downloading data from Instagram.
• 30 days after the account is closed, at the latest the following night, we delete all account data: profiles with their Reels, covers and videos, transcripts, analyses and advice, tracked profiles and niche trends, chats with the assistant, the Content planner, “Build a Reel from clips” projects with their clips and finished Reels, the channel profile, settings, the connection to the Instagram account and its statistics, weekly summaries, billing history, the cost register and the task log.
• We delete login data (email, name, password hash, Google account identifier) together with the account. It stays only if you have access to another Reelumi account.
• The data disappears from database backups after the next 7 nightly backups.

If another person in Reelumi tracks your Instagram profile, their copy doesn’t disappear together with your account. You can object — we describe this in the section “Data from Instagram”.

For 30 days after deletion, the account can be restored: write to hi@reelumi.ai. We restore it only at the request of the person it belongs to.

An account can also be closed by the controller or by the member of the Reelumi team who manages it. The effects are the same, and the closure can be reversed within 30 days.

If you manage other people’s profiles in Reelumi, those profiles stay — you only lose access to them. Reelumi team accounts aren’t deleted in the panel: we delete them on request sent to hi@reelumi.ai.

Invoices and payment confirmations are kept by the controller in their own accounting records for the period required by tax law. Deleting the account doesn’t cover them.

When you give the name of your Instagram profile (or the person setting up your account gives it), we download its publicly available data: the profile name, the name or display name, bio, link, profile picture (we keep a copy of it to show it in the panel), category, the numbers of followers, following and posts, as well as Reels: the video with sound, the cover, caption, hashtags, accounts tagged in the caption, the audio used, the date and the numbers of views, likes and comments. From the provider’s response, we store the profile and Reel data. We don’t store other people’s comments or lists of similar profiles.

Apify downloads the data for us from publicly available Instagram pages. On the first download, we fetch some of the earlier Reels (how many depends on the plan), and then once a day we refresh the profile and the latest Reels. We store videos, covers and the copy of the profile picture in Cloudflare R2.

The legal basis is our contract with you (Article 6(1)(b) GDPR). We process the data of people who appear in your Reels or are tagged in them on the basis of our legitimate interest, like the data of the people described below.

When this feature is available for your account, you can connect your Instagram account (a creator or business account) to Reelumi in the channel profile: Instagram account → “Connect Instagram account”. You then log in on Meta’s page — with Instagram or Facebook — and choose the account. We don’t see your password. Connecting is voluntary.

From Meta, we receive the account’s identifier and name, the identifiers of the business portfolio and of the connection itself, the scope of the consent you gave and an access key (token). Once a day, we use the token to download statistics on your latest posts: reach, saves, shares and the total number of interactions, and for Reels also the average and total watch time and the percentage of views skipped in the first 3 seconds. We store them only for posts that are already in Reelumi and show them in the panel. We don’t pass them to AI models. We store the token encrypted.

We don’t read messages or comments, we don’t publish anything on your behalf and we don’t download data about the people who watch your Reels.

You can disconnect the account in the same place with the “Disconnect” button. We then delete the token and the statistics immediately, and they disappear from database backups after the next 7 nightly backups. You can also revoke Reelumi’s access in Meta: business portfolio settings → Integrations → Connected apps. When Meta stops accepting our token, we delete it, and the statistics already collected stay until you disconnect the account in the panel or delete your Reelumi account.

The legal basis is our contract with you (Article 6(1)(b) GDPR).

In the Inspirations tab, you can also track other people’s profiles. We then download their publicly available data in the same way as the data of your profile, but we don’t copy their profile pictures. After you remove a profile from the list, we stop downloading it, and we delete its Reels, covers, videos, transcripts and analyses after 30 days, at the latest the following night. Mentions of it in your chats with the assistant, weekly summaries, advice and ideas stay for as long as you have an account.

Who this applies to. If you have a public Instagram profile, we may process its data even though you don’t use Reelumi. This happens when a person using Reelumi points to it, when you publish a Reel under a hashtag that such a person has entered, or when we use your public materials about Instagram for our tips. This also applies to people whom an analysed Reel shows, tags or mentions. For our tips, we also use public articles from blogs about social media, and we store them. Source and data. Apify downloads the Instagram data for us from publicly available pages, and we download the articles ourselves. We store the profile name, the name or display name, bio, link, the address of the profile picture (we copy the picture itself only when someone enters this profile in Reelumi as their own), the category and the numbers of followers, following and posts. For Reels, we store the video with picture and sound (and with it the image and voice of the people appearing in it), the cover, caption, hashtags, accounts tagged in the caption, the audio used, the date and the numbers of views, likes and comments. We also store the text of what is said in the Reel and its analysis prepared with the help of AI: a description of the scenes, the on-screen text and an assessment. From articles, we store the title, the author and the content. Purpose, legal basis, recipients. We process it to prepare analyses and tips for people who use Reelumi. The legal basis is our legitimate interest (Article 6(1)(f) GDPR). The data is seen by people in whose panel your profile or Reel appears, and by the providers listed in the section “Who we share data with”. How long. We keep profile data while someone tracks the profile and for 30 days after it is removed from the list. We keep videos for 30 days after downloading (in exceptional cases 37), Reels found under hashtags — 60 days, and the materials we use for our tips — currently with no fixed period (unreviewed statements — 180 days). Ideas and mentions of the profile in chats with the assistant, weekly summaries and advice stay until the account of the person who tracked it is deleted. Objection. You can object at any time by writing to hi@reelumi.ai. We will then delete, from all accounts, your profile data, your Reels, covers, videos, transcripts and analyses, ideas saved on their basis and materials in the knowledge base. On the list of objections, we will keep only the profile name and the date of the objection, so that we don’t save them again. Mentions of your profile in saved chats with the assistant, weekly summaries and advice disappear together with the account they are in. The same applies to ideas from a profile that someone removed from their tracked profiles more than 30 days earlier. If an article in the knowledge base was written by you, we will delete it at your request. We will remove quotes from your statements in the description of Instagram’s rules that we use for our tips with the next update of the application. The data will disappear from backups after the next 7 nightly database backups.

The server and the database are in the European Union. With the following recipients, data may end up outside the European Economic Area:

• Cloudflare, Google and Resend take part in the EU-U.S. Data Privacy Framework. The transfer is therefore based on a decision of the European Commission confirming an adequate level of protection (Article 45 GDPR). Videos, covers, the copy of the profile picture and files from the “Build a Reel from clips” feature in Cloudflare R2 are kept in the European Union, but Cloudflare may process messages forwarded to hi@reelumi.ai in the USA. Google may transfer messages from the Gmail inbox outside the EEA under the terms of its service. Resend always processes data in the USA, even when the email itself is sent by its server in Ireland; its data processing agreement also provides for standard contractual clauses approved by the Commission.
• OpenRouter processes requests in the USA. The transfer is based on standard contractual clauses approved by the European Commission (Article 46 GDPR), which are part of OpenRouter’s data processing agreement, incorporated into its terms of service. A request reaches the model provider under the terms of OpenRouter’s agreement with that provider.
• Apify may transfer data to the USA and other countries. Its data processing agreement provides for standard contractual clauses approved by the Commission.
• deAPI is based in Malta, but according to its policies it may also process data in other countries, on distributed infrastructure. In these policies, it names as safeguards the Commission’s decisions on an adequate level of protection and standard contractual clauses where they apply.

At your request sent to hi@reelumi.ai, we will provide information about these safeguards and, for our data processing agreements with Apify, OpenRouter and Resend, also a copy of them.

You can object at any time to processing that we base on our legitimate interest: the server and application logs, the session record and counting login attempts, the record of actions by the Reelumi team in the panel, data from public Instagram profiles, data of people in clips in the “Build a Reel from clips” feature, and correspondence. Write to hi@reelumi.ai. We will then stop processing that data, unless we can demonstrate compelling legitimate grounds that override your interests, or the data is needed to establish, exercise or defend legal claims. We describe the effect of an objection to data from Instagram in the section “Data from Instagram”.