How we collect, use, and protect your information. The short version: we never sell personal data, and we only keep what the Service needs.
Privacy policyEffective: Sep 29, 2026Updated: Oct 10, 2026
iReelz (“we”, “our”, “us”) operates the iReelz platform at ireelz.com. This Privacy Policy explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have when you use our website, applications and services (the “Service”).
01Who we are
The data controller is iReelz (ABN 73 151 582 872), Cairns, QLD 4870, Australia. For questions about this policy or to exercise your rights, email support@ireelz.com.
02Information we collect
2.1 Information you give us
Account details: your name, email address and password (stored only as a hash by our authentication provider), or your name and email from Google if you sign in with Google.
Profile and preferences: your timezone, default language, platform and tone, brand kits and saved styles.
What you ask the tools for: topics, briefs, captions, scripts and other text you enter, and the results we generate for you.
Images you upload: photos for the thumbnail and caption tools (which may show your face or other people), and style reference images. See section 04.
Links you give us: website, social profile and YouTube channel or video addresses you enter for brand import, channel analysis and trend tools.
Purchases and licences: which plans, credit packs, music albums, LUT packs and motion templates your account holds, order references and the licence certificates issued to you. Card details go to Stripe, never to us.
Messages to us: your name, email, country and message when you use the contact form or email support.
2.2 Information collected automatically
Usage events (our own, no cookies): which pages are viewed, which features are used, generation counts and music plays, with the date, your account (if signed in) and the country your connection comes from. We do not store your IP address or browser details with these events.
Google Analytics (only if you accept): if you choose “Accept” in the cookie notice, Google Analytics 4 sets cookies and receives your IP address, device and browser information and the pages you visit, so we can understand how the site is used. It is not loaded at all until you accept.
Security and hosting logs: our hosting and infrastructure providers (Cloudflare and Supabase) process your IP address and request details to deliver the site, keep it secure and prevent abuse, including the Cloudflare Turnstile bot check on sign-in and the contact form.
2.3 Frames you preview locally
When you use “try your own frame” in a LUT pack preview, the image is processed entirely in your browser. It is never uploaded to our servers and we never see it.
03How we use your information, and our legal bases
To provide the Service (contract): run your account, generate captions, scripts, thumbnails and trend insights, deliver and unlock purchases, issue licence certificates, enforce plan limits and send the emails the Service needs (sign-up confirmation, password reset, receipts, licences).
To keep it safe and working (legitimate interests): prevent fraud and abuse, fix problems, and count page views and feature use with our own cookieless usage events so we know what to improve.
With your consent: Google Analytics cookies, and the optional daily trend digest email. You can withdraw either at any time (section 08 and 09).
Legal obligations: keeping records of purchases and refunds for tax and accounting.
04Photos and images you upload
Photos you add to the thumbnail tools, style references and their results (renders, cutouts, face renders) are stored in private storage. Only you can open them, through links that expire after an hour. To produce the result you asked for, an image is sent to the AI provider that does the work: fal.ai (image generation, background removal), Anthropic (describing what is in the photo) or OpenAI (image captions). Only upload photos of other people with their consent. Your uploads and renders are deleted when you delete your account.
05Who we share it with
We use the following service providers. Each processes data only to provide its service to us, under its own privacy terms and data processing agreement:
Supabase — authentication, database, file storage and serverless functions.
Cloudflare — website hosting and CDN, file storage (R2) for music, media and your private uploads, and the Turnstile bot check.
Stripe (Stripe Payments Company and Stripe Technology Europe, Limited) — merchant of record for subscriptions and one-time purchases: payment, tax, receipts and order management through Link. See stripe.com/privacy.
Resend — sending our emails: sign-in, purchase and licence emails, and the trend digest if you switch it on.
Anthropic and OpenAI — AI processing of your text inputs for captions, scripts, trend analysis and chat, and of images as described in section 04.
fal.ai — AI image generation and editing for the thumbnail tools, including photos you upload.
Jina AI — fetching the public web pages you enter for brand import, so we can read them.
Google — Google Analytics (only with your consent); Google Sign-In (if you use it); YouTube API Services (public video data, section 06); YouTube thumbnails and, when you press play, video embeds from youtube-nocookie.com; and Google Fonts, only for a brand-kit font you choose that we don’t host ourselves (every font in our pickers is served from ireelz.com).
Meta — Instagram Graph API and Facebook Login (connecting your Instagram account, insights for your own content, public hashtag posts, public account lookups, section 07) and, where a page shows them, Instagram post embeds. See Meta Privacy Policy.
unpkg — when you export a ProRes video in the Studio, your browser downloads the free ffmpeg encoder from unpkg.com.
We do not sell or rent your personal information, and we do not share it for advertising. We may disclose information if required by law, or to protect our rights or the safety of others.
06YouTube API Services
iReelz uses YouTube API Services to retrieve publicly available video and channel data (titles, view, like and comment counts and channel information). We do not access private YouTube account data or require YouTube sign-in. By using features that access YouTube data, you acknowledge the following:
YouTube data retrieved for your analyses is kept in your account history until you delete it or your account. You can ask us to delete it sooner at support@ireelz.com.
07Instagram and Meta platform data
iReelz works with Instagram in two ways: through an Instagram account you choose to connect, and through public posts we retrieve for hashtags.
7.1 Connecting your Instagram account (optional)
You can choose to connect an Instagram Business or Creator account to iReelz using Facebook Login. Connecting is optional.
When you connect, we access: your Instagram profile info (username, account ID, profile picture, follower count), your own posts and Reels (captions, media type, timestamps, permalinks), insights for your own content and account (such as reach, views, likes, comments, saves), and the list of Facebook Pages you manage, only to find the Instagram account linked to them.
We use this to show you analytics for your own content, run hashtag research on your behalf, and look up the public Business or Creator accounts you enter.
We do not access your direct messages, do not post or publish on your behalf, and never see your password.
We store an access token so the connection keeps working. Tokens are stored securely and never shared. We also keep the ID Facebook gives your account for iReelz, so a deletion request you make from Facebook can find your data.
7.2 Public hashtag content
iReelz uses Meta’s Instagram Graph API (Hashtag Search) to retrieve publicly available posts for hashtags. For each post we receive its caption, like count, comment count, media type, timestamp, media URL and a permalink to the post on Instagram.
We do not receive or display the usernames of people whose public posts appear in hashtag results, and we do not collect data from private accounts.
Every item links back to the original post on Instagram. We do not download or re-host the media.
7.3 Looking up a public account
When you enter the handle of a public Instagram Business or Creator account, iReelz uses your connected account to retrieve that account’s public profile details (its profile photo and follower and post counts) and its recent public posts, with their like, comment and view counts, from Meta.
We show them to you and do not store them.
If you choose to use a post’s caption as the topic for a script, that topic becomes your own script input: it is handled like any other text you enter in the tools (section 2.1) and kept with the script in your history.
7.4 How we handle this data
We do not sell Instagram or Meta data and do not use it for advertising.
Hashtag results are cached for up to 24 hours and then refreshed. Data from a connected account is kept until you disconnect it or delete your iReelz account.
You can disconnect Instagram at any time in Settings. Disconnecting deletes your stored token and the Instagram data we hold for your account. You can also revoke access from your Facebook settings, or email support@ireelz.com to request deletion.
If you remove iReelz in your Facebook settings and ask for your data to be deleted, we delete the Instagram data we hold for that Facebook account, and Facebook gives you a confirmation code and a link where you can check the request’s status. Once it is done, we keep only that code, the dates and the outcome.
Some pages may show embedded Instagram posts using Meta’s official embed. Embedded content is loaded from Meta, which may collect data under the Meta Privacy Policy.
If you believe a post shown in iReelz should not appear, contact support@ireelz.com and we will remove it from our display.
08Cookies and browser storage
Essential (always on): your sign-in session and your cookie choice, kept in your browser’s local storage, plus small preferences such as player volume, recently used templates, dismissed tips and an in-progress thumbnail draft. We don’t use these to track you.
Analytics (only if you accept): Google Analytics cookies (_ga, _ga_*).
We do not use advertising or retargeting cookies. You can change or withdraw your choice at any time from (also in the site footer); choosing “Essential only” deletes the Google Analytics cookies.
09Emails
We send emails the Service needs, such as sign-up confirmation, password reset, receipts and licences. The daily trend digest is sent only if you switch it on, and every digest has an unsubscribe link that works without signing in. We do not send marketing newsletters.
10How long we keep it
Account data, generation history and uploads: until you delete them or your account. On the free Starter plan, saved scripts are deleted automatically after 30 days; on paid plans they are kept until you delete them. Videos saved to the Studio library expire after 7 days.
Instagram data: hashtag results are cached for up to 24 hours and then refreshed. Data from a connected Instagram account is kept until you disconnect it or delete your iReelz account.
Usage events: deleted after 90 days. Purchase and refund records are kept for as long as tax and accounting law requires.
Email delivery records: the address, type and date of each email we sent are kept as a record of what was sent.
Payment data: held by Stripe under its own retention rules; we never store card numbers.
Backups: deleted data can remain in our providers’ encrypted backups for a limited period before it is overwritten.
11Deleting your account
You can delete your account yourself under Settings → Delete account. This cancels any subscription so you are not charged again, deletes your uploads and renders, and permanently removes your account and the data linked to it. It takes effect immediately and cannot be undone. If you have connected an Instagram account, deleting your iReelz account also deletes your stored Instagram access token and the Instagram data we hold for your account.
12Data security
TLS encryption for all data in transit, and encryption at rest by our providers.
Row-level security policies so each account can reach only its own data.
Uploads kept in private storage, opened only through short-lived signed links.
Access controls limiting personnel access to personal data.
No method of transmission or storage is 100% secure. If a data breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.
13International transfers
Our providers process data in the United States and other countries outside Australia and your own. Where required, transfers are protected by Standard Contractual Clauses or equivalent safeguards and the providers’ own compliance programmes.
14Your rights
Depending on where you live, you have some or all of these rights:
Access and portability: a copy of your personal data, in a machine-readable format.
Correction: fix inaccurate or incomplete data (most of it you can edit in Settings).
Deletion: delete your account yourself (section 11), or ask us to delete specific data.
Restriction and objection: ask us to limit processing, or object to processing based on legitimate interests.
Withdraw consent: for analytics cookies or the trend digest, at any time.
California (CCPA/CPRA): the right to know, delete and correct, and to non-discrimination. We do not sell or share personal information for cross-context advertising.
Complain: to us first, then to your regulator: in Australia the Office of the Australian Information Commissioner (oaic.gov.au); in the EEA your local data protection authority; in the UK the Information Commissioner’s Office.
To exercise any of these rights, email support@ireelz.com. We will respond within 30 days.
15Children
The Service is not directed at children. You must be at least 13 years old (16 in the EEA) to create an account. We do not knowingly collect personal information from younger children; if you believe a child has given us personal data, contact support@ireelz.com and we will delete it.
16Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or an in-app notice at least 14 days before they take effect. Previous versions are available on request.
17Contact
Questions about this policy or your data: email support@ireelz.com, use the contact form, or write to iReelz, Cairns, QLD 4870, Australia.