Privacy Policy
1 · What we collect
Account data (your email, name, and sign-in identifiers), workspace data (products, photos, and videos you submit, and the videos and captions we generate), billing data (handled by Stripe — we never see or store card numbers), and operational logs kept free of personal information beyond what is needed to run and secure the service. If you use the free policy checker without an account, we store the email address you give us to receive a rewrite — that address and the date, and nothing else: the copy you paste into the checker is never stored.
2 · How we use it
To generate and check your videos, deliver them to you, bill you correctly, prevent abuse, and provide support. Product photos are sent to the AI providers that paint and judge your videos solely to produce your output. We do not sell personal information, and we do not use your products or photos to advertise to anyone else. An address given to the free policy checker is used only to send you your rewrite, and we may email occasional notes if the policy pack changes; you can have it removed at any time by writing to hello@certireel.com.
3 · Where data lives
Data is stored on Cloudflare's global network, with media in object storage scoped to your workspace and served through time-limited signed URLs. Payment records live with Stripe. Shotstack composites your finished video from the pieces our pipeline generates. The video- and language-model providers that paint, judge, and voice your videos are reached through OpenRouter, which routes each request to the underlying model provider. If you connect a Telegram chat, your finished videos and job notices are delivered to Telegram. Email delivery providers process recipient addresses to send the messages you request.
4 · Cookies and sessions
We use one first-party session cookie to keep you signed in, and no third-party advertising cookies anywhere. If you arrive from an ad, we store the ad platform's click identifier and campaign labels in a second first-party cookie (30 days, HttpOnly) so that a video you later make can be credited to that ad in our own records; it holds no personal information and no third party can read it. Arrive without ad parameters and the cookie is never set.
5 · Retention and deletion
Workspace data is kept while your account is active. You can request deletion of a workspace at any time; this wipes its products, media, jobs, and receipts, keeping only the billing records the law requires us to retain. Magic sign-in links expire after 15 minutes and are stored only as hashes. Free policy checker addresses are kept until you ask us to remove them.
6 · Your rights
You may access, correct, export, or delete your personal information. We honour these rights under PIPEDA, GDPR, UK GDPR, and the Australian Privacy Act, whichever applies to you. Write to hello@certireel.com and we will respond within 30 days.
7 · Security
Sessions are signed and HTTP-only; secrets are stored in the platform's secret store; access to production data is limited and audited; sign-in tokens and invite tokens are single-use and hashed at rest. Report a vulnerability to hello@certireel.com and we will respond within 24 hours.
8 · Changes and contact
If this policy changes materially, we will email account holders before the change takes effect. Privacy questions: hello@certireel.com.