Privacy Policy

As of 26 October 2026

This policy applies to the Reelfox website and web app at reelfox.de. It tells you which personal data we process, for what purpose, on what legal basis, to whom it is passed and how long we keep it.

1. Controller

Noosmedia, owner Ben Biallas
Im Brückfeld 12, 39114 Magdeburg, Germany
Phone: +49 391 88687150
Email: hallo@reelfox.de

2. Data protection officer

We have not appointed a data protection officer because the legal requirements under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not met.

For questions about data protection, write to hallo@reelfox.de.

3. Summary

We do not use analytics, tracking or advertising cookies. We embed third-party content in one place only: on the order page in the customer area, Stripe provides the payment field (sections 5 and 9). Fonts are served from our server.
The website, the database, the assembly of the videos and the storage of your media run on a server we rent in Germany. We send and receive emails through a provider in Germany.
We only store what is needed for your account, your videos, billing and security.
To create your videos, we pass your inputs to AI providers, partly in the USA. These providers are contractually bound.
We do not train AI models with your data ourselves. What applies to our AI providers is set out in section 7.2.

4. Visiting the website and hosting

When you access Reelfox, your browser transmits technically necessary data to our server: IP address, date and time, requested address, browser and operating system, and the referring page if your browser sends it. The server needs this data to deliver the page to you.

Purpose: delivering the page, stability, defending against attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and functioning operation.
Logs: Our web server does not store access logs. The application only writes technical error logs so that we can fix faults. In individual cases they may contain identifiers such as an account ID or an email address. The logs are limited in size, at most 50 MB per service, and are overwritten continuously once this limit is reached. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is fault-free operation.
Hosting: The entire application runs on a server we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. Hetzner is our processor. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. This server hosts the website, the database, the job queue, the assembly of the videos and the file storage for videos, images, audio tracks and uploads. We operate the file storage ourselves. Your browser retrieves your media directly from s3.reelfox.de, which is also on this server.
Backups: Hetzner backs up the entire server daily and keeps each backup for seven days. In addition, we back up the database every night on the server and keep these backups for 14 days. Deleted data may therefore remain in backups for up to three weeks, after which it is overwritten. We only use backups to restore operation after an error or outage. We do not use any other provider for backups.

5. Cookies and browser storage

We only use cookies and browser storage that are strictly necessary for the service you request. Under Section 25 (2) no. 2 of the German TDDDG, no consent is required for this. We base the subsequent processing on Art. 6(1)(b) GDPR (providing your account and carrying out the payment) and Art. 6(1)(f) GDPR (security and fraud prevention). We therefore do not show a cookie banner.

Name	Type	Purpose	Retention
`NEXT_LOCALE`	Cookie	remembers your language (German or English)	until you close the browser
`__Secure-better-auth.session_token`	Cookie	keeps you signed in	30 days, extended with use, ends when you sign out
`__Secure-better-auth.session_data`	Cookie	cache that speeds up checking your sign-in	5 minutes
`__Secure-better-auth.two_factor`	Cookie	remembers during sign-in that you are entering your second factor	only during two-factor sign-in
`__Secure-better-auth.trust_device`	Cookie	only if the box "Trust this device for 30 days" is ticked during two-factor sign-in: the second factor is then not requested again on this device. The box is not preselected	30 days, renewed with every sign-in
`__stripe_mid`	Stripe cookie, only on the order page	fraud prevention for the payment	1 year
`__stripe_sid`	Stripe cookie, only on the order page	fraud prevention for the payment	30 minutes
`reelfox:pending-email-change`	local storage (localStorage)	remembers that you need to confirm a new email address	until the change is completed or cancelled
`reelfox:nav-collapsed`	local storage (localStorage)	remembers whether you collapsed the menu in the customer area	until you clear your browser storage
`reelfox:pending-email`	session storage (sessionStorage)	remembers your email address after sign-up so that you can request the confirmation link again	until you close the tab
`reelfox:draft`	session storage (sessionStorage)	carries your input from the home page or a template over to the studio	until the studio has taken it over or you close the tab

Order page: On the order page in the customer area, Stripe embeds the payment field (Stripe.js, loaded from js.stripe.com). Stripe receives your IP address and technical details about your browser and device and sets the cookies __stripe_mid and __stripe_sid for fraud prevention. This is necessary for the payment you request (Section 25 (2) no. 2 TDDDG). The legal basis for the further processing is Art. 6(1)(b) and (f) GDPR. Our legitimate interest is a secure payment free of fraud. Stripe.js is not loaded on any other page. More on Stripe in section 9.

If we later add cookies that are not strictly necessary, we will ask for your consent first.

6. Your account

6.1 Registration

For an account we need your email address, a password and your name. We only store the password as a secure hash, never in plain text. We also store your language, the time at which you accepted the Terms and acknowledged the Privacy Policy, the version of the Terms, and your confirmation that you are at least 18 years old. You confirm your email address via a link.

Legal basis: Art. 6(1)(b) GDPR (contract for the use of Reelfox); for the record of acceptance Art. 6(1)(f) GDPR.
Retention: until your account is deleted.

6.2 Sign-in with password, sign-in link and two-factor authentication

You can sign in with a password or with a sign-in link sent by email. If you enable two-factor authentication, we store a secret key for your authenticator app and recovery codes. We store both encrypted in our database. If you tick the box "Trust this device for 30 days" when signing in, we also store a random identifier with an expiry date that matches the cookie on your device.

Legal basis: Art. 6(1)(b) GDPR.
Retention: until you disable two-factor authentication or delete your account. The identifier for a trusted device until it expires after 30 days.

6.3 Security: sessions and abuse prevention

For each sign-in we store a session with IP address, browser identifier (user agent), start and expiry. You can see your sessions in the settings and end them there. To fend off attacks on sign-in and registration, we count requests per IP address and limit them for a short time.

Purpose: protecting your account, overview of signed-in devices, defending against attacks and abuse of the free allowance.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security of Reelfox and of your account.
Retention: sessions until they expire, at most 30 days after last use. We delete expired sessions and rate-limit counters no later than seven days after they expire.

6.4 Account emails

We send you emails that are necessary for your account and contract: email confirmation, sign-in links, password reset, notices about sign-in attempts, contract confirmations, confirmations of cancellation and withdrawal, confirmation of account deletion. We do not send advertising without your consent.

Legal basis: Art. 6(1)(b) and (c) GDPR.
Delivery: via the mailbox hallo@reelfox.de at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, as processor. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO. Our server hands the emails over in encrypted form to STRATO's mail server (smtp.strato.de), which delivers them. STRATO states that it processes data exclusively in data centres in Germany. We do not track whether you open our emails or click links in them.

6.5 Data export and account deletion

In the settings you can download your data as a file (profile, sign-in methods, sessions, plan, credit ledger, partner program). You can also delete your account there. For security, you confirm the deletion via a link sent by email.

Deletion has the following effects:

We end a running subscription at Stripe immediately so that no further charges are made. There is no pro rata refund. Unused credits are forfeited. We point this out to you before deletion.
We delete your account with all associated data in our database and all files of your account in the file storage, i.e. videos, uploads, intermediate results and the files of your brand kit.
Excepted is data we must retain for tax and commercial law reasons, in particular the settlement data of the partner program (section 9.1), as well as your cancellation and withdrawal declarations (section 9.2). This data is restricted and only used for these purposes.
Deleted data may remain in the backups described in section 4 for up to three weeks.

7. Creating videos

7.1 What we process

When you create a video, we process your inputs: idea or script, selected settings, change requests, content from your brand kit (for example logo, colours, font, website) and files you upload. If you provide a website, our server retrieves this page and the images embedded in it and uses the texts and images for the video. All of this results in a blueprint with script, scenes, images, audio track and timestamps. We store the blueprint and all versions so that you can change the video later or reuse a style.

Please do not enter sensitive data about yourself or others unless your video requires it.

Legal basis: Art. 6(1)(b) GDPR.
Retention: We do not delete videos automatically after a set period. They remain stored until you delete the video or your account. Intermediate results such as images, voice recordings and scenes belong to the respective video and are deleted with it. Temporary files created while a video is assembled are deleted immediately after each run.

7.2 AI providers

For the individual steps we use specialised providers as processors:

Anthropic (script, scene plan): your text inputs and texts from a website you provide.
fal.ai (images, video clips, lip sync): image and video instructions, uploaded images, audio track.
ElevenLabs (voice, timestamps): the script text.

We do not pass your name, email address or payment data to these providers. Details, location and safeguards are in the list of processors.

The assembly of the finished videos and the storage of all media (videos, images, audio tracks, uploads) run on our server rented from Hetzner Online GmbH in Germany (see section 4).

Training: We do not train AI models with your inputs and videos ourselves. Under their terms, as of 26 October 2026, the following applies to our providers:

Anthropic may not train models on customer content.
fal.ai processes your inputs to provide its services. It may only use data derived from them in anonymised or aggregated form to develop its own services and models.
ElevenLabs may use content to improve its services and models unless the customer objects in its account settings. Only the script text is sent to ElevenLabs.

7.3 Images and voices of other people

For a presenter video you upload a photo of a person. You may only use photos of yourself or of people who have consented. You confirm this before every presenter video. We store this confirmation with a timestamp as evidence.

Legal basis: for your own data Art. 6(1)(b) GDPR. For the person depicted Art. 6(1)(f) GDPR. Our legitimate interest is carrying out the order for which you have confirmed the person's consent. We do not process biometric data for the purpose of uniquely identifying a person.
Business customers: If you use Reelfox as a business and process personal data of third parties for your own purposes, we act as your processor in that respect. Business customers receive a data processing agreement pursuant to Art. 28 GDPR on request to hallo@reelfox.de.

7.4 Protection against prohibited content (moderation)

The AI models we use work with their providers' safety filters. Anthropic's language model refuses requests that violate its usage policies; creation then stops. fal.ai's image and video models run with the safety filter switched on. In addition, we review created projects in our administration, also with the help of a list of search terms that we look for in your inputs and the texts of the blueprint. A human always decides whether a video is blocked or an account restricted.

Legal basis: Art. 6(1)(f) GDPR (protecting affected persons, preventing illegal content, protecting our service) and Art. 6(1)(c) GDPR in conjunction with Regulation (EU) 2022/2065 (Digital Services Act).
Recipients: The safety filters run at Anthropic and fal.ai as part of creation (section 7.2). We do not pass data on separately for review.
Retention: We do not store search term hits separately. Other review notes are deleted after six months. In case of a violation, we store the block and its reasons until the case is closed. A blocked video remains blocked until it is deleted. An account suspension remains stored with its reasons until we lift it or the account is deleted.

7.5 AI labelling

Every finished video receives a signed, machine-readable label according to the C2PA standard. It contains the title of the video, Reelfox as the generating software, the statement that images, voice and editing were generated with AI, and technical details of the signature. It does not contain account details such as your name or email address. You set the title of the video yourself.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 50(2) of Regulation (EU) 2024/1689 (AI Act).

8. Autopilot

With Autopilot, Reelfox creates videos on a topic of your choice according to a schedule you set and provides them for download together with a suggested post text. For this we store your settings (topic, video type, style, weekdays, time, time zone) and the planned episodes with their topics. Section 7 applies to the topic suggestions and the creation.

Reelfox does not publish anything for you. We do not connect any accounts on TikTok, YouTube, Instagram or other platforms. You download the videos and publish them yourself. The publication is then governed by the terms of the respective platform.

Legal basis: Art. 6(1)(b) GDPR.
Retention: until you delete the series or your account. Section 7.1 applies to the videos created.

9. Payment, credits and invoices

Payments are handled by Stripe. The contracting party is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. The basis is Stripe's standard terms and Stripe's data processing agreement.

On the order page you enter your payment data directly into Stripe's payment field (section 5). We only receive what we need for billing and your customer account: a customer ID, plan, status, term, invoices, type of payment method. Stripe processes payment data partly as an independent controller (payment processing, fraud prevention, its own legal obligations) and partly as our processor. Transfers to Stripe, LLC in the USA are possible. Stripe states that it is certified under the EU-U.S. Data Privacy Framework; in addition, Stripe's data processing agreement contains the EU Commission's Standard Contractual Clauses.

For each order we store the plan or pack, price, credits, time, Stripe's payment identifiers, the wording and time of your consent to the immediate start of performance, and the version of the Terms and of the withdrawal information. This is our evidence for the contract and the right of withdrawal.

We keep your credits in a credit ledger: every grant, reservation, deduction, refund and expiry as a separate entry.

Legal basis: Art. 6(1)(b) GDPR; for retention obligations Art. 6(1)(c) GDPR; for fraud prevention Art. 6(1)(f) GDPR.
Retention: orders and credit ledger until your account is deleted. Invoices and accounting records are held at Stripe and in our bookkeeping. We retain them pursuant to Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code for six, eight or ten years depending on the document, also after your account has been deleted.

9.1 Partner program

The partner program is governed by the partner terms. Attribution works without a cookie: we do not store anything in your browser for it.

If you arrive through a partner link or enter a partner code: A partner link leads directly to our sign-up page and contains the partner's code in the address (for example ?ref=ABCD2345). We copy the code visibly into the "Partner code" field of the sign-up form. You can change or delete it there. When a partner link is opened, we only increase a counter of the partner by one. We do not store any information about you in the process. If a valid code is in the field when you submit the sign-up, we store that your account is assigned to this partner, and the time. For your payments in the 12 months after sign-up we use this to calculate the partner's commission and store the invoice ID, the amount paid and the net amount.

The partner does not receive names, email addresses or other details that directly identify you. They only see figures: visits to their link, sign-ups, paying customers, net revenue and, for each commission, the date and net amount of the invoice.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the correct settlement of the commission with the partner whom you named yourself by entering the code. For retaining the settlement Art. 6(1)(c) GDPR. You may object to the assignment (section 14).
Retention: the assignment until your account is deleted. The commission records for your invoices are part of the settlement with the partner and are kept as long as it is (see below), after deletion of your account without a link to your account.

If you are a partner: We process your partner code, the time and version of your acceptance of the partner terms, the number of visits to your link, the sign-ups assigned to you, your commissions, payout requests and credit notes. For self-billing and the bank transfer we also process your name or company name, your address, your VAT status, your tax number or VAT identification number, and the account holder and IBAN. We store the IBAN encrypted and only show it shortened in the customer area.

Recipients: For the transfer our bank receives the account holder, IBAN, amount and payment reference. Where necessary, our tax advisers and the tax authorities receive settlement documents. We may have a VAT identification number confirmed by the German Federal Central Tax Office (Bundeszentralamt für Steuern).
Legal basis: Art. 6(1)(b) GDPR (partner terms). For credit notes and retention Art. 6(1)(c) GDPR in conjunction with Sections 14 and 14b of the German VAT Act (UStG) and Section 147 of the German Fiscal Code (AO).
Retention: partner code, acceptance, counter and current payout details until your participation ends or your account is deleted. Settlement data (commissions, credit notes and payouts with name or company name, address, tax details, account holder and IBAN at the time of payout) for as long as tax law requires, up to ten years from the end of the calendar year in which it arose. This also applies after your account has been deleted. During this period the data is restricted and only used for tax purposes, audits and the establishment or defence of legal claims.

9.2 Cancellation and withdrawal

If you cancel via our cancellation page (reelfox.de/en/cancel) or withdraw via our withdrawal function (reelfox.de/en/withdraw-contract), we store your name, your email address, the contract concerned, the content of your declaration with the date and time of receipt and, where provided, the type, reason and requested date of the cancellation. For a withdrawal we also store the order concerned, the compensation and the refund. You receive a confirmation by email. The same applies to declarations by email or letter.

Legal basis: Art. 6(1)(b) and (c) GDPR in conjunction with Sections 312k and 356a of the German Civil Code (BGB).
Retention: three years from the end of the year in which the declaration was received (regular limitation period), also after your account has been deleted. We retain refund records in accordance with section 9.

10. Contact and support

If you write to us, we process your details and your message to handle your request. Emails to hallo@reelfox.de are held in our mailbox at STRATO (section 6.4).

Legal basis: Art. 6(1)(b) GDPR if it concerns your contract, otherwise Art. 6(1)(f) GDPR.
Retention: until your request is resolved, then up to three years for evidence purposes, unless a longer retention obligation applies.

11. Reports of illegal content and complaints

You can report content you consider illegal using our reporting form at reelfox.de/en/report or by email. We process the type of violation, the reported content (link or video ID), your reasons, and your name and email address. For reports concerning child sexual abuse material, name and email address are optional. If we block content or restrict an account, we inform the person concerned and give reasons. We do not disclose the name of the reporting person unless this is strictly necessary for the review and legally permitted. The same applies to complaints against our decisions.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of the Digital Services Act.
Retention: two years after the case is closed.

12. Recipients

Your data is only received by the processors and recipients named in the list of processors and by the further recipients stated in this policy for the respective processing. We only pass data to authorities if we are legally obliged to do so. We do not sell data.

13. Transfers to third countries

Hosting, file storage, backups, the assembly of the videos and email traffic take place in Germany. Anthropic, fal.ai, ElevenLabs and Stripe also process data in the USA. We only transfer data there if the recipient is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023, Art. 45 GDPR) or if we have agreed the EU Commission's Standard Contractual Clauses with it (Art. 46(2)(c) GDPR). Which basis applies to which provider is stated in the list of processors. You can request a copy of the Standard Contractual Clauses.

14. Your rights

You have the right to:

access your data (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, write to hallo@reelfox.de. You can also export and delete your data yourself in the settings.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt).

15. Obligation to provide data

For an account we need your email address, a password and your name. For paid plans we need payment and billing details. Without this data we cannot conclude a contract with you. For payouts in the partner program we need the details listed in section 9.1. Without them we cannot pay out any commission.

16. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The AI providers' safety filters may refuse individual requests (section 7.4). A human decides on blocking a video or suspending an account.

17. Security

We transmit all data encrypted (TLS). We store passwords only as a hash. We store two-factor keys and recovery codes as well as IBANs in the partner program encrypted. Your media can only be retrieved via time-limited, signed addresses. Only people who need access for operation have access to customer data.

18. Changes

We adapt this policy when Reelfox or the legal situation changes. The version published here applies. We inform signed-in users of material changes by email.