Privacy Policy

Effective date: October 17, 2026

This Privacy Policy explains how PodReel (operated by Marius Eikenes, Norway, "PodReel", "we", "us") collects, uses, and protects personal data when you use the Service at podreel.app. PodReel is the data controller for the processing described here. You can reach us at hello@podreel.app for any privacy matter.

1. What data we collect

Account data (provided by you): name, email address, hashed password, optional profile image.
Usage and technical data: IP address and user-agent (collected with your session for security purposes), timestamps, and records of the episodes you process.
Your Content: podcast video/audio files you upload, titles, the "context" and "intent" text you provide, and the transcripts and generated Clips produced from them.
Billing data: subscription status, plan, Stripe customer ID, and a ledger of processing-minute credits. We do not receive or store your card details — Stripe handles payments.
Media assets: uploaded files, transcripts, and rendered Clips are stored on Hetzner Object Storage (EU, Helsinki region).

We do not use third-party analytics, advertising, or tracking cookies. We only set the strictly necessary authentication session cookie required to keep you logged in.

2. Why we process your data (legal bases)

Provide the Service (transcription, AI clip selection, rendering, storage) — account data, Your Content — performance of contract (Art. 6(1)(b)).
Account management and security (sessions, preventing abuse) — account data, IP, user-agent — performance of contract; legitimate interest (Art. 6(1)(b), (f)).
Payments and subscription administration — billing data — performance of contract (Art. 6(1)(b)).
Service communication (transactional emails about your account, processing status) — email address — performance of contract (Art. 6(1)(b)).
Complying with accounting and tax law — billing records — legal obligation (Art. 6(1)(c)).

We do not use Your Content to train AI or machine-learning models, and we do not sell personal data.

3. Third-party processors (sub-processors)

We share personal data and Your Content only with providers necessary to run the Service:

AssemblyAI — transcription of uploaded audio/video (including speaker labels). AssemblyAI states it does not train models on customer data by default.
Google (Gemini API) — analysis of transcripts to select the best clip moments. Paid-tier API usage; data is not used to train Google's models.
Hetzner — object storage for uploads and rendered Clips (EU/Helsinki); also the infrastructure the Service runs on.
Stripe — payment processing; Stripe processes your payment data under its own privacy policy.
Active speaker detection service — a in-house/contracted microservice that detects speaker faces to auto-frame Clips; it processes video frames transiently for this purpose.

All processors are bound by data-processing agreements and are not permitted to use your data for their own purposes. The current list of sub-processors is available on request.

4. Data retention

Full episode uploads (source video/audio and intermediate files) are deleted once processing is complete.
Transcripts and rendered Clips are retained until you delete your account (or delete the episode/clip in the app), so you can keep producing and re-downloading Clips.
Account data is retained until you delete your account, then deleted within 30 days, except where law requires longer retention (e.g., accounting records, which Norwegian bookkeeping law requires us to keep for 5 years).
Session/IP data is retained for as long as the session is active and for a short security window thereafter.

5. Your rights (GDPR)

If you are in the EEA, you have the right to:

access your personal data (Art. 15);
rectify inaccurate data (Art. 16);
erase your data (Art. 17);
restrict or object to processing (Arts. 18, 21);
data portability of data you provided to us (Art. 20);
withdraw consent where processing is based on consent, without affecting prior processing.

To exercise any right, email hello@podreel.app. We respond within 30 days. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no, or your local supervisory authority.

6. Data transfers

Your data is primarily stored and processed within the EU/EEA (Hetzner, EU region). Where a provider processes data outside the EEA (e.g., Google or Stripe), transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision, with supplementary safeguards where required.

7. Security

We use encrypted connections (TLS) in transit, password hashing for credentials, scoped access keys, and session-based authentication. No system is fully secure; if a personal-data breach affects your rights, we will notify you and Datatilsynet as required by law.

8. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy. Material changes will be announced in-app or by email before they take effect. The effective date at the top always reflects the current version.

10. Contact

PodReel — Marius Eikenes, Norway
hello@podreel.app