1Controller
The controller of personal data is Michał Fox, trading as Reelelle, in Kraków, Poland ("Reelelle", "we"). For anything about personal data write to hello@reelelle.com. We have not appointed a data protection officer because Article 37 GDPR does not require one.
This policy describes the data we process as controller: about visitors to the Website reelelle.com, people who send the contact form, Clients and Panel Users. Data in Client Materials and on Client Accounts is processed on the Client's behalf under the Data Processing Agreement, and the Client is its controller.
2Where the data comes from
We get data directly from you: from the contact form, when you create an account in the Panel, while you use the Panel, in e-mails and on calls. Data of a person added to a Client's account comes from the person who adds them.
The server records technical data of every request: IP address, time, page address, response code and browser information.
3Purposes, legal bases and retention
We process data for the following purposes:
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Replying to a contact form enquiry and proposing to work together | name, e-mail, company or profile address, country, chosen Plan, message, page language | steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in replying (Article 6(1)(f) GDPR) | 12 months from the last contact, unless we conclude the Agreement |
| Protecting the form against abuse | IP address and time of sending | legitimate interest (Article 6(1)(f) GDPR) | 10 minutes, in server memory only; the limit is 5 submissions in that time |
| Creating and running a Panel account | company name, full name, e-mail, password hash, chosen Plan, language, date and version of the Terms accepted | performance of a contract (Article 6(1)(b) GDPR) | for the term of the Agreement and until the data is deleted after it ends (section 18 of the Terms) |
| Performing the Agreement: plan, approvals, revisions, calls, requests, reports | Request content and attachments, comments, decisions with the person's name and time, call agendas and tasks, call times, Client Account names and connection status | performance of a contract (Article 6(1)(b) GDPR) | as above |
| Users added by the Client | full name, e-mail, role, invitation status, last activity | the Client's and our legitimate interest in the account being run by the people chosen (Article 6(1)(f) GDPR) | until the User is removed from the account or the account data is deleted |
| Billing and invoices | company name, address, tax ID, invoice e-mail, amounts, payment method and, for a card, its brand, last 4 digits and expiry date | legal obligation (Article 6(1)(c) GDPR) under tax and accounting law | 5 years from the end of the year in which the tax obligation arose |
| Push notifications in the Panel | the device's push service address, encryption keys, account ID, language, chosen categories, browser name, date enabled and date last sent | your consent given in the browser and in the Panel (Article 6(1)(a) GDPR) | until you turn notifications off, sign out in that browser or the subscription expires |
| Sign-in session and Panel security | session ID, account ID, e-mail, name, company name, Plan, expiry time | performance of a contract and legitimate interest in protecting the account (Article 6(1)(b) and (f) GDPR) | 14 days or until you sign out |
| Password reset | e-mail and a one-time token | performance of a contract (Article 6(1)(b) GDPR) | 60 minutes or until the link is used |
| Server logs | the data in clause 2.2 | legitimate interest in security and diagnosing errors (Article 6(1)(f) GDPR) | 30 days |
| Establishing, pursuing and defending claims | Agreement data, correspondence, approvals | legitimate interest (Article 6(1)(f) GDPR) | until the limitation period ends, for Agreement matters 3 years after it ends |
| Contact about the Agreement, including weekly summaries in the Start Plan | e-mail, name, message content | performance of a contract (Article 6(1)(b) GDPR) | for the term of the Agreement and until the data is deleted after it ends |
We do not send a newsletter and do not use data for advertising. We do not profile you or make decisions based solely on automated processing that have legal effects on you.
Giving data in the contact form and when creating an account is voluntary, but without it we cannot reply to the enquiry or conclude the Agreement. Invoice details are required by law.
4Client panel
In the Panel we store account data, the content plan, Materials, comments pinned to reel seconds and carousel slides, version and decision history with the name of the person who decided, Requests with attachments, call times and agendas, reports, invoices and invoice details.
Everyone with access to a Client's account sees that account's data according to the role the Client gave them: Owner, Approves materials, View only, or Invoices and billing.
After the Agreement ends the Panel stays read-only for 30 days, and then we delete the account data within 30 days, except the data for accounting and claims, which we keep for the periods in clause 3.1.
5Push notifications
You turn push notifications on in the Settings tab of the Panel, separately on each device. The browser asks for permission, and you choose the categories: replies in requests, materials to review, payments and renewals, loyalty discount changes.
A notification is delivered through the push service of your browser's provider: Google (Chrome and browsers built on it), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge). The notification content is encrypted with keys from your browser, so the provider sees only the device address, the size and the time of the message.
You turn notifications off in the Panel or in the browser settings. Signing out removes that browser's subscription from our server, and a subscription the push service reports as expired is removed on the next delivery attempt.
6Recipients
We share data only with those the Website and the service cannot work without:
- 1)the server provider in Poland on whose servers the Website and the Panel run and files are stored;
- 2)the e-mail server we run ourselves on those servers;
- 3)the browser providers' push services, within clause 5.2;
- 4)a payment operator if you pay by card; the operator processes the card data, and we receive only the card brand, last 4 digits and expiry date;
- 5)people who work with us on production, under a contract with a confidentiality obligation, to the extent needed to work on your account;
- 6)public authorities where the law requires it.
We give the providers' names on request sent to hello@reelelle.com. We do not sell data.
When we post Materials on the Client Accounts, the data in them goes to the operators of the social platforms with which the Client has its own agreements.
7Transfers outside the EEA
The servers on which we store data are in Poland. The push service providers in clause 5.2 may process the device address outside the European Economic Area, in particular in the United States. This takes place under the mechanisms of Chapter V GDPR, in particular the European Commission's adequacy decision for organisations certified under the EU-US Data Privacy Framework or standard contractual clauses used by these providers.
8Your rights
You have the right to:
- 1)access your data and receive a copy;
- 2)have your data corrected; you can also correct account and company details yourself in the Panel;
- 3)have your data deleted where we are not required to keep it by law or to protect claims;
- 4)restrict processing;
- 5)data portability for data processed under a contract or consent, in electronic form;
- 6)object to processing based on legitimate interest;
- 7)withdraw your consent to push notifications at any time, without affecting the lawfulness of earlier processing.
To exercise your rights, write to hello@reelelle.com or send a Request. We reply within one month. We may ask you to confirm your identity, for example by replying from the account's e-mail address.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in the country where you live or work.
9Security
Connections to the Website and the Panel are encrypted (HTTPS). Passwords are stored only as a salted hash (scrypt). The session is a signed HttpOnly cookie that page scripts cannot read. An account's files are available only after signing in to that account.
If a data breach is likely to result in a high risk to your rights, we will tell you without undue delay.
10Cookies and browser storage
The Website and the Panel store in your browser only what they need to work: your language choice, theme, sign-in session and Panel settings. We use no analytics, advertising pixels or third-party scripts. The full list with retention times is in the Cookie policy.
11Changes and contact
We update this policy when the way we process data changes. The new version shows its effective date at the top of the page, and we tell Clients about significant changes by e-mail and in the Panel.
Contact about data: hello@reelelle.com, Michał Fox, Reelelle, Kraków, Poland.
This policy applies from 24 October 2026.