Sign up

Legal

Privacy Policy

Last updated: 14 October 2026. This is our notice under India's Digital Personal Data Protection Act, 2023 ("the Act") and its Rules. It tells you what personal data ReelsDone collects, why, who handles it, how long we keep it, and how to use your rights. We wrote it in plain words on purpose. In this policy "we" means ReelsDone; for the Act we are the "Data Fiduciary" for your data.

What we collect, and why

We collect only what we need for the purposes below. We ask for your consent before we collect it, and we do not use it for anything else without asking you again.

  • Account details: your name, email address, password (stored only as a one-way hash) and WhatsApp or phone number. Used to create and secure your account, contact you about your orders, and give support.
  • Your reel material: the scripts, videos, photos and voice recordings you upload, and your instructions. Used only to make, deliver and fix your reels.
  • Photo avatar data: your photo, a voice sample, and a short live verification video in which you read a one-time code. Used only to make reels for your account, and to check that the person in the photo and voice is you. This can include your face and voice, which are personal to you, so we handle them with extra care (see "Photo avatars" below).
  • Order and payment records: what you ordered, amounts, and payment status. We never see or store your card or bank details; our payment partner handles them.
  • Messages: what you send to support, feedback forms and the help assistant, so we can answer you.
  • Technical data: your IP address and basic device information, used to keep the service secure, stop abuse and, for photo avatars, as part of the record that you consented.
  • Your consent choices: what you agreed to, which version of this policy, and when.

We do not sell your personal data. We do not use your reels, photo, voice or face as a demo, sample or advertisement without your written permission. We do not track you across other websites or show you targeted ads.

Your consent

  • When you sign up we ask you to agree to this policy and confirm you are 18 or older. These are separate tick boxes and are not pre-ticked.
  • Marketing emails (tips, offers, product news) have their own optional tick box, also not pre-ticked. If you leave it empty, we send you only messages about your orders and account.
  • For a photo avatar you give a separate consent, with a live verification video, at the moment you create it.
  • We keep a record of each consent: what, when and which version of the wording.

Withdrawing your consent

You can take back any consent at any time, as easily as you gave it. Sign in, open the account menu (the circle with your initial, top right) and choose Privacy and data. There you can switch marketing emails off and remove any photo avatar. Removing an avatar deletes your photo, voice sample and verification video from our storage and stops all use of them. We then delete the copy held by our video partner.

If you withdraw consent we stop the related processing. This does not affect anything we did lawfully before you withdrew. A photo avatar cannot be used for new reels once removed. If a reel that uses the avatar is still being made, you can remove the avatar as soon as that reel is delivered, or email us and we will remove it straight away.

Photo avatars: your face and voice

Your photo and voice are used only to make reels for your account. Before a new avatar can be used, you record a short live video reading a one-time code, and a member of our team compares it with your photo and voice. We do this so nobody can create an avatar of another person. We do not run automatic face-matching and we do not build a face or voice template. Opening the verification video is recorded in an audit log.

If you upload a photo or voice that is not your own, you must have that person's clear permission (see our Terms). If a person tells us their face or voice was used without permission, we will stop using it and remove it.

Who handles your data

Only authorised team members who need it for your order can open your files, and what they open is recorded. We use trusted providers, called "Data Processors" in the Act, who handle data only on our instructions to run the service:

  • Supabase: database, sign-in and private file storage (hosted in Mumbai, India).
  • Netlify: hosting of the website and app.
  • Razorpay: payments.
  • Resend and Google Workspace: sending and receiving email.
  • HeyGen: creating the talking-avatar part of Personal branding, using your photo and voice.
  • OpenAI: our automated help assistant. Please do not type sensitive personal details into the chat.
  • Cloudflare Turnstile: a security check on sign-up and login to block bots.
  • AI and editing tools that we use to build your reel from your material.

Some of these providers process data outside India. The Act allows this except to countries the Government restricts. We do not share your data with anyone else, except when the law or a court requires it. If we use an agency or contractor to handle personal data for us, we first sign a written agreement that binds them to protect it and use it only for our purpose.

How we protect your data

  • Your files are stored privately and are opened only through short-lived signed links, never public ones.
  • Data is encrypted in transit (HTTPS) and at rest.
  • Every customer can see only their own data. Team access is limited to signed-in team accounts, and sensitive actions are written to an audit log.
  • Team accounts are created and switched off by the admin, and a team member who leaves loses access straight away.
  • Sign-up and login are rate-limited to stop password guessing.

If a personal data breach ever affects you, we will tell you without delay, in plain language, what happened, what it may mean for you and what we are doing about it. We will also report it to the Data Protection Board of India as the law requires.

How long we keep it

We keep your data only as long as we need it for the purpose you gave it, or as the law requires. Uploads and finished reels are kept for a limited period so you can download your reel and ask for corrections, and are deleted once they are no longer needed. Your photo avatar files are kept until you remove the avatar or ask us to erase your data. Order and payment records are kept for as long as accounting and tax law requires. You can ask us to delete your data sooner (see below); we will do so unless the law requires us to keep it.

Your rights under the Act

  • Access: ask for a summary of the personal data we hold about you, what we do with it and who it is shared with.
  • Correction and updating: ask us to correct, complete or update your data.
  • Erasure: ask us to erase your data, including your whole account.
  • Withdraw consent: at any time, as described above.
  • Grievance redressal: complain to us first (below).
  • Nominate someone: name a person to exercise these rights for you if you die or cannot act.

Use the buttons on the Privacy and data page, or email support@reelsdone.com. We reply within 15 days. We may need to check it is really you, and we may keep what the law requires us to keep. These rights are free.

Children

ReelsDone is for people aged 18 and over. We do not knowingly collect personal data of anyone under 18, and we do not track or advertise to children. If you are a parent or guardian and think a child has given us data, or appears in material that was uploaded without your consent, email support@reelsdone.com and we will delete it. Our Terms do not allow you to upload material showing a child under 18 unless you are that child’s parent or legal guardian, or you have the parent or guardian’s verifiable consent. A photo avatar can only be made of an adult (18 or over), and the person in it must be the one who records the verification video.

Complaints

Grievance officer: Ali, Founder of ReelsDone, support@reelsdone.com. Write to us first. We will reply within 15 days. If you are not satisfied, you can complain to the Data Protection Board of India.

How we follow the Act

In short, this is what we do and where you can see it:

  • Notice before collection: this page, linked at sign-up, says what we collect and why.
  • Real consent: separate, unticked boxes; marketing is optional; photo avatars need their own consent and a live verification video; every consent is recorded with its version and time.
  • Easy withdrawal: Account menu, then Privacy and data. Same account, a couple of clicks.
  • Purpose limits: your material is used only to make your reels; no sale, no ads, no public samples without written permission.
  • Security safeguards: private storage, signed links, per-customer access rules, audit logs and encryption.
  • Breach reporting: we notify you and the Data Protection Board.
  • Limited retention: we keep data no longer than needed and delete on request.
  • Contracts with processors: providers handle data only on our instructions.
  • Children: 18+ only, with no tracking or targeted ads.
  • Your rights and a grievance officer: listed above, with a reply time.

The Act's main duties for companies like us come into force fully in 2027. We are following them now, and we will update this page if the law or the way we handle data changes. If a change needs your consent again, we will ask you.

Cookies

We use only the cookies and local storage needed to keep you signed in and the site working. We do not use advertising or tracking cookies.

Questions about this page? Email support@reelsdone.com.