Privacy Policy

AiReelEngine is operated by Quantum AI WebApps Digital LLC (“we”, “us”), registered at 30 N Gould St # 43951, Sheridan, WY 82801, United States. This policy explains what we collect, who we send it to, how long we keep it, and how to get it deleted. Questions or requests: support@aireelengine.com.

1. What we collect

• Account data — business name, email address, and a hashed password. We never store your password in readable form.
• Content you provide — reviews, photos, video footage, brand assets, scripts and URLs you submit for video generation.
• Voice samples — only if you choose to clone a voice for a presenter. These are audio or video clips you upload deliberately.
• Connected accounts — the access tokens you authorise for publishing (TikTok, Instagram, Facebook, YouTube, Pinterest, X) and for reading your Google Business Profile reviews. These tokens are encrypted at rest.
• Generated output — the videos, images, captions and presenter models the service produces for you.
• Usage & technical data — pages viewed, actions taken, and server logs kept for security, billing accuracy and reliability.
• Billing data — handled by Stripe; we hold the subscription state and invoice history, not your card number.

2. How we use it

• To create, render, quality-check and deliver your videos and ad assets.
• To publish on your behalf to the platforms you connect, when you ask us to.
• To process payments, enforce plan limits, prevent abuse, and provide support.
• To keep the service working — diagnosing failed renders, monitoring errors, improving reliability.

We do not sell your personal information, and we do not use your content to advertise to you.

3. AI processing — what leaves our systems

Producing a video means sending parts of your content to specialist AI providers. In practice that can include the text of your reviews and business details, the photos and footage you upload, the audio we transcribe for captions, and — if you clone a voice — the voice samples you provided. Your Persona Studio training images are generated by us and stored in our own private storage; they are shared with the training provider only for the duration of a training run.

We send content to the AI providers listed in the table below only to produce your requested output. We do not grant those providers rights to train their models on your content beyond what their published API terms provide; where a provider offers an opt-out from training, we use it.

4. Who we share it with

We share the minimum necessary with the service providers that power the product:

We also share information where the law requires it, and with a buyer if the business is ever sold — in which case this policy continues to apply until you are told otherwise.

5. International transfers

The providers above operate internationally, so your content may be processed outside the country you are in. Where personal data is transferred outside the EEA/UK, we rely on Standard Contractual Clauses. Our application and database are hosted on Railway (United States); rendered videos and uploads are stored on Cloudflare R2, and on Amazon S3 where configured. The subprocessors that receive data are listed in the table above.

6. How long we keep things

• While your account is active, we keep your content. Your account, uploads, rendered videos and presenter models are retained for as long as you have an account. Your content is never deleted automatically on a timer — we would rather you not lose a video you paid for.
• You can delete at any time. Delete an individual upload, a presenter, or your whole account from your dashboard (Account → Delete account). Deleting your account first disables your sign-in and API keys, then cancels every subscription on the account, deletes your rendered videos and uploads from our object storage, and removes your account records, jobs, connected accounts, reviews and billing history from our database. The steps, in the order we run them:
  1. Your sign-in sessions and API keys stop working immediately, whatever else happens afterwards.
  2. Renders still running and posts still queued for your account are stopped.
  3. Every subscription billing your account is cancelled.
  4. Data held for you at outside providers is deleted where the provider lets us: cloned voices, social connections, your custom hostname, and your payment-provider customer record if it is yours alone.
  5. Your uploaded files and rendered videos are deleted from our object storage.
  6. Your account records, jobs, connected accounts, reviews, policy acceptances and requests are removed from our database.
  7. The account record itself is removed.
  8. We scan storage to confirm no object belonging to your account remains. A run is only reported complete when that scan is empty.
  Starting a deletion gives you a reference you can use at our deletion status page to see where it has got to, even after you can no longer sign in.
• If a step fails. If a payment-provider or storage step fails partway through, your account is already disabled and we finish the remaining steps ourselves and confirm by email — we never tell you it is done until every step has actually completed.
• What we cannot delete for you. If you trained a presenter avatar or a voice/face model, those live at the AI providers that trained them (fal.ai and HeyGen), and neither offers us a way to delete a stored model. The same is true of a payment-provider customer record that is shared with another account. When anything like that is left, the confirmation you get names it instead of telling you everything was deleted, and we remove our own access to it.
• Backups are the exception. Backups and snapshots taken before you deleted your account still contain your data until they age out on their own schedule. We do not reach into backups to erase individual accounts, and we will not tell you we have. If a backup is ever restored, completed deletions are re-applied to the restored data.
• What we must keep. Records we need for tax, accounting or fraud-prevention purposes are retained for as long as the law requires, even after account deletion. Stripe independently keeps the invoice and payment records for our own financial and tax reporting; we cannot remove those. We also keep our internal log of the actions our staff took on your account, and usage-cost records with your identity removed, so that our accounting and audit trail stay complete.
• How long the audit log is kept. Those internal audit records are not kept forever. Each kind is kept for a set period and then deleted: billing and payment actions for about 7 years (2555 days), account-deletion records for about 10 years (3650 days), publishing, media, sign-in and configuration actions for about 3 years (1095 days), and records of staff viewing or exporting the log for about 2 years (730 days). If a record is needed for an open deletion request or a legal hold, it is kept until that is closed, whatever its age.
• A custom domain. If you added a custom domain, the hostname is held at our hosting provider (Vercel) so it can serve your portal. It is taken off the provider when you remove it and again before your account is deleted; if the provider will not release it, the deletion is held until it does, and we say so rather than reporting it finished.
• Abandoned drafts that are never submitted expire on their own after a short period.

In full, after your account is deleted we keep only the following, and nothing else about you:

• Our internal log of the actions our staff took on your account.
• Usage-cost records with your identity removed.
• Records of provider spend authorisations with your identity removed.
• Invoice and payment records, which Stripe keeps as our financial record.
• Payment-provider identifiers that stop a late payment event from reactivating a deleted account. They hold no customer content.
• Backups taken before the deletion hold your data until they age out. We do not reach into backups, and completed deletions are re-applied if a backup is ever restored.

If an outside provider or our storage refuses a step, your account is already disabled and signed out, we do not tell you it is done, and our team finishes the remaining steps and confirms by email.

7. Your rights and how to use them

You can access, correct, export or delete your data, and withdraw publishing permission at any time by disconnecting an account. Depending on where you live you may also have the right to object to or restrict processing, and to complain to your data-protection regulator.

• Make a request. Signed in, open Account → Privacy & data and choose a request:
  • Access — a copy of the personal data we hold about you
  • Export — your data in a portable format
  • Correction — fix something that is wrong
  • Restriction — pause how we use your data
  • Objection — object to how we use your data
  • Something else about your data
  Each request gets a status you can see there (received, in progress, completed or declined). If we decline, we tell you why. We aim to answer within the target date shown on the request; that date is a target we set, not a deadline set by law, and the law that applies to you may set a different one.
• Delete your account. Deleting your account is not a request you wait on — it starts immediately from Settings → Delete account, and you get a reference you can use to check its status.
• Cannot sign in? Email privacy@aireelengine.com from the address on the account and we will open the request for you.

For EU/UK data-protection matters, including exercising the rights above, contact us at privacy@aireelengine.com — this is our designated privacy contact. General questions: support@aireelengine.com.

8. Children

AiReelEngine is a business tool and is not directed to children. You must be at least 18 years old to create an account — the same requirement stated in our Terms of Service, and enforced when you sign up.

9. Security

Passwords are hashed. Social publishing tokens are encrypted at rest. Rendered media is stored privately and served through short-lived signed links rather than public URLs. Secrets live only in server environments, and server-side fetches of URLs you provide are filtered to block internal network addresses. No system is perfectly secure, but we take this seriously and fix what we find.

10. Cookies

We use a small number of essential cookies to keep you signed in. See our Cookie Policy for the full list and your controls.

11. Changes

We may update this policy; the date at the top always reflects the current version, and we will tell you by email about a change that materially affects you.