Privacy Policy
Effective date: 29 October 2026
This Privacy Policy explains how vibereel uses personal data. vibereel is a service at https://vibereel.studio. The agent connects to vibereel and makes videos ("reels") there. In the vibereel web app, you watch the reels, comment on them, see their versions and export them.
The service is in alpha. It is free. Every account is on the free plan. You cannot buy credits or a plan, and we collect no payment data.
1. Who we are
The controller of your personal data is:
- Name: amanellacompany
- Postal address: [POSTAL ADDRESS]
- Email: support@vibereel.studio
In this policy, "vibereel", "we" and "us" mean this controller. "You" means a person who visits our website or uses our service. For questions about this policy or your data, email support@vibereel.studio.
2. Summary
- We collect the data that we need to run your account and to store, show and export your reels.
- We do not sell personal data. We do not show ads. We use PostHog for usage statistics and error reports. Analytics uses no cookies or device storage.
- vibereel does not run the agent. The agent runs at a provider that you choose, for example Anthropic for Claude. That provider receives the results of our tools.
- When the agent asks for a sound effect, we send its description to fal, which makes the sound with an AI model.
- When the agent asks for a voiceover or for music, we send the script or the description to Google, which makes the audio with an AI model.
- When you or the agent ask for a transcript, or when you record a voice comment, we send the sound to Groq, which turns speech into text with an AI model.
- Anyone who has the address of a reel can open that reel without signing in.
- The owner of a workspace can invite other people by email. The people in a workspace see each other's names, and the owner's account pays for the work there (section 3.12).
- The agent can send product feedback to us. Our tool tells it to send only the exact text that you approve in the chat.
- You can delete your account in the app, on the Account page. To see, correct or export your data, email support@vibereel.studio.
3. The data we collect, why, and our legal basis
3.1 Your account
When you create an account, you give us your email address, a password and a name. If you leave the name empty, we use the part of your email address before the "@".
We store your name, your email address, whether you verified your email address, a hash of your password (never the password itself), the time when you created the account, and the workspace that you used last.
You can also create an account and sign in with Google. Then Google sends us your name, your email address, whether Google verified that address, and your Google account ID. We store these. We do not store your Google profile picture or any Google token, and we do not use other Google services for your account. Google learns that you sign in to vibereel. Google uses this data under its own privacy policy (https://policies.google.com/privacy). If your vibereel account already uses the same verified email address, the Google sign-in opens that account.
When you sign in, we create a session. The session record holds a random token, its expiry time and the user agent of your browser (the browser and operating system type). It can also hold your IP address.
We send you emails only to verify your email address, to reset your password, to confirm that your account is deleted, and to invite you to a workspace when its owner asks for it (section 3.12). A verification, reset or invite email holds a personal link. We send no newsletters and no marketing emails. To limit abuse, we count the account emails that we send to each mailbox in the last hour.
To stop automated signups, the sign-up form and the password reset form use Cloudflare Turnstile, a security check. The check runs in your browser when you open one of these forms. Cloudflare receives your IP address, data about your browser (the user agent and the TLS fingerprint) and the address of our form. Cloudflare answers with a one-time code. We send the code to Cloudflare again to confirm the check. We do not store the code or the result of the check.
To limit abuse, each mailbox can have only one verified vibereel account at a time. When you verify your email address, or when you sign in with Google for the first time, we keep a keyed hash of your normalized email address with your user ID. We delete this record when you delete your account.
Purpose: to create your account, to let you sign in and to protect your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). For the email counter, the security check and the one-account rule: our legitimate interest in the prevention of abuse (Art. 6(1)(f) GDPR).
3.2 Agent connections
You connect an AI agent to vibereel through OAuth. When an agent registers with vibereel, we store the name, the icon address and the redirect addresses that the agent sends. When you sign in and approve the agent, we store your consent, the permissions that you gave, the tokens of the connection, and a request counter with the time of the last request. An access token is valid for 1 hour. A refresh token is valid for 7 days.
On the Connected agents page, you can revoke an agent. Then we delete its tokens, your consent and its request counter.
Purpose: to let the agent use vibereel for you. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
3.3 Your content
You and the agent create content in vibereel:
- workspaces, projects and reels, and their names;
- the files of a reel: text files (for example HTML, CSS, JavaScript and JSON) and uploaded files (for example images, video, audio and fonts);
- the draft and the saved versions of each reel;
- the comments that you write on a reel, with you as the author, and the frame of the reel that a comment points to;
- the transcripts of the speech in your video and audio files, with the time of each word, and your corrections to them;
- screenshots of your reels;
- the files that we make from your media, for example stills, filmstrips, sound waves, editor copies, media inspection results and sound mixes;
- the sound effects, voiceovers and music that the agent makes. Sound effects and music go into the sound library of your account. A sound in your library stays available in all your workspaces until you delete it;
- brand data: website addresses, page titles, colours, fonts, logos and page text;
- the files in your asset catalog;
- export jobs and the MP4 files of your exports.
Content can contain personal data, for example a face in a video or a name in a text. You decide what goes into your content.
Purpose: to store your content, show it to you, check it, render it and export it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
3.4 Website reads
The agent can ask vibereel to read up to 4 pages of a website (the
read_website tool). We send the addresses of these pages to our provider
Firecrawl. Firecrawl loads the pages and sends us their text, HTML, links,
image addresses and a screenshot. Our servers then download images, style
sheets and fonts from that website. We store the result in your asset
catalog.
The website sees requests from Firecrawl and from our servers, not from your
device. Its pages can contain personal data of other people, for example
names or photos. Use read_website only for websites that you have the right to
use.
Purpose: to give the agent the brand material of a website. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). For personal data of other people on these pages: our legitimate interest and your legitimate interest in the use of public brand material (Art. 6(1)(f) GDPR).
3.5 Sound effects, voiceovers and music
The agent can ask vibereel for a sound effect. We send the description that the agent writes, the length and the sound settings to our provider fal. We do not send your name or your email address. fal makes the sound with an AI model and sends it back to us. We store the sound in your sound library.
The agent can also ask for a voiceover or for music. For a voiceover, we send the script that the agent writes and the voice settings to our provider Google. For music, we send the description that the agent writes and the length to Google. We do not send your name or your email address. Google makes the audio with an AI model and sends it back to us. We store a voiceover with the reel files of your project and music in your sound library. To get the time of each word of a voiceover, we send the voiceover audio to Groq, as section 3.6 explains.
Do not put personal data in a sound description, a script or a music description.
Purpose: to make the sound effects, voiceovers and music that the agent asks for. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
3.6 Transcripts and voice comments
You or the agent can ask for a transcript of a video or audio file. Then we send the sound of the file to our provider Groq. Groq turns the speech into text with an AI model and sends back the words and their times. We store the transcript with the file in your content.
You can also record a voice comment on a reel. Your browser records your voice only after you start the recording. We send the recording to Groq and write the text that Groq returns into your comment. We do not store the recording.
We do not send your name or your email address to Groq. A recording can hold the voices of other people. Record or upload the voices of other people only when you have the right to do so.
Purpose: to make the transcripts, captions and voice comments that you or the agent ask for. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
3.7 Credits, storage and usage
Your account is on the free plan. When you verify your email address, or when you sign in with Google for the first time, your account gets a small number of free credits once. The free plan also has limits for storage and for the number of workspaces, projects and reels. In the alpha, you cannot buy credits or a plan. We store your balance, the storage that your files use, your plan, a record of each credit grant and each credit use, and usage records of the work that used credits, for example an export, a website read or a sound effect.
To give the free credits only once to each mailbox, we keep a keyed hash of your normalized email address with the record of your free credits. The hash is a fixed code. We cannot turn it back into your address, and without our secret key nobody can test an address against it. It stays after your account is deleted, so a new account with the same mailbox gets no free credits again.
Purpose: to apply the free limits, to show your balance and to prevent abuse. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in the prevention of abuse (Art. 6(1)(f) GDPR).
3.8 Technical data and security
- Each request to our website and servers carries your IP address, data about your browser (the user agent) and the cookies of our site. Our hosting providers process this data to deliver the service and to protect it against attacks.
- To limit attempts to sign in, sign up and reset a password, we keep a request counter for each IP address and each of these actions.
- For each tool call of the agent, we record the tool name, your user ID, the time and the duration, the result (success or failure), an error message of up to 500 characters, data sizes, and the IDs of the workspace, project and reel. We delete these records after 14 days.
- Our system logs hold the tool name, your user ID, error messages, and the name and version of the agent app. Our providers keep these logs for a limited time (see section 10).
Purpose: to run the service, to keep it secure, to find and fix errors and to prevent abuse. Legal basis: our legitimate interest in a secure service that works (Art. 6(1)(f) GDPR).
3.9 When you contact us
When you email us, we use your email address and your message to answer you. Legal basis: performance of a contract when your message is about your account (Art. 6(1)(b) GDPR), our legitimate interest in answering other messages (Art. 6(1)(f) GDPR), and our legal obligation when you use a right under the GDPR (Art. 6(1)(c) GDPR).
The agent can also send us feedback about vibereel. Our tool tells it to send only the exact text that you approve in the chat. The text can name a project or a reel when that helps. We store the text, these optional references, the date, your account and the email address of your account. We add our own notes and an open or closed status. We can email you at that address to ask for more detail. When a ticket is saved, we send an alert with only its ticket number to our support mailbox. The alert does not contain your text. We treat this feedback like a message to us, so the legal bases above apply to it in the same way.
3.10 Usage statistics and errors
We use PostHog to measure how people use vibereel and to find errors. The browser sends page addresses without query strings or fragments, referral sources, clicks with element text and attributes masked, performance data, and errors without their messages. We do not record sessions. PostHog receives the IP address of each browser request. It uses the address to find the country and, before sign-in, to make the anonymous daily ID. Then it discards the address. It does not store it.
After sign-in, browser events and server usage events carry the account's internal user ID. This joins use on different devices. We send no email address or name to PostHog. The landing page and signed-out pages use anonymous cookieless measurement. We do not join those anonymous visits to your account.
Our servers send usage events each hour. These cover signups, projects, reels, saved versions, agent tool calls, exports, credits used, supplier costs, failed jobs and feedback counts without feedback text. A daily account event includes the plan, credit balance and storage use of active accounts. We send no reel text, brief, comment or feedback text.
Purpose: to measure use, improve the service, find errors and check costs. Legal basis: our legitimate interest in a service that works and costs that we can control (Art. 6(1)(f) GDPR).
When you delete your account, we do not delete these events or your PostHog person. They keep your internal user ID. They are pseudonymous, not anonymous. Section 10 explains this.
3.11 What we do not do
- We do not sell or rent personal data.
- We use no ad trackers and no tracking cookies.
- We do not train AI models with your data or your content.
- We make no decisions about you that are based only on automated processing and that have legal effects or similar significant effects on you (Art. 22 GDPR).
3.12 Shared workspaces
The owner of a workspace can invite other people to work in it. Then:
- The owner gives us the email address of the invited person. We send one invite email to that address, with the name of the owner and the name of the workspace. We store the address with the invite. We delete the invite within one day after the person joins or the owner cancels it, and at the latest 30 days after it expires. An invite expires after 7 days.
- The invite link holds a secret code after the
#sign. Your browser keeps this code in its local storage until you join, so that you can sign in or create an account first (section 7). We do not send the code to our usage statistics. - The people in a workspace see the names of the other people in it. Only the owner sees their email addresses.
- The owner's account pays for all work in the workspace. The credit history of the owner names the person who did each piece of work.
- When a person leaves or the owner removes them, their access ends at once. Their comments, versions and files stay in the workspace. A file that the person opened before can still open from its address (section 5).
- When a member deletes their account, we remove them from the workspace. Their comments, versions and files stay in the workspace, and their comments show the author name "A member".
Purpose: to let people work together in one workspace. Legal basis: performance of a contract with the owner and with each member (Art. 6(1)(b) GDPR). For the invite email to a person who has no account, our legitimate interest and the owner's legitimate interest in the invite (Art. 6(1)(f) GDPR).
4. The agent and its provider
vibereel does not run the agent. The agent runs at a provider that you choose, for example Anthropic (Claude), OpenAI (ChatGPT, Codex) or Cursor. The agent sends requests to our MCP server, and our tools send results back to the agent.
In a host app that supports it, for example the Claude app, our tools also show a card in the chat. The card plays a saved reel. It loads the files of the reel as section 6 explains.
These results can hold your name and email address, the content of your workspaces, projects and reels, your comments, brand data, screenshots of your reels and the addresses of your reels. The agent's provider processes these results under its own terms and privacy policy. You choose that provider. It is not our processor. Read its privacy policy before you connect the agent.
5. Reel addresses
Each reel has a secret address. The address holds a random key of 128 bits. It opens the draft, the saved versions, the screenshots and the MP4 exports of the reel without sign-in. Anyone who has the address can open these files. The agent receives the addresses of your reels.
Share the address of a reel only with people that you trust. Today, you cannot turn off the address of a reel. When you delete the project of a reel, the address stops working. For help, email support@vibereel.studio.
6. Content from other services
- The fonts of our website and our app come from our own servers. Our pages do not load fonts from Google Fonts, except as this section explains.
- A reel can load scripts from jsDelivr (cdn.jsdelivr.net) and fonts from Google Fonts. When you or another person opens a reel, in the app, at its address or in a card in the chat of a host app, the browser connects to these services. They receive the IP address and data about the browser.
- When we render an export or make screenshots, our servers at Cloudflare load these files. Then these services see our servers, not your device.
- The Brand page of the app shows samples of brand fonts. To show them, your browser loads these fonts from Google Fonts. Google then receives your IP address and data about your browser.
These services are not our processors. They use the data under their own privacy policies. Legal basis: our legitimate interest in showing the reels and the font samples correctly (Art. 6(1)(f) GDPR).
7. Cookies and local storage
We use only the cookies and the browser storage that the service needs: for sign-in, for agent connections and for your interface settings. We use no analytics, advertising or tracking cookies. PostHog uses no cookies, local storage or session storage, before or after sign-in. The analytics identity stays only in memory while the page is open. We show no cookie banner.
All our cookies are first-party cookies of vibereel:
| Cookie | Purpose | Duration |
|---|---|---|
better-auth.session_token | Keeps you signed in. | 7 days |
better-auth.convex_jwt | Holds a short sign-in token for our database. | 30 minutes |
better-auth.dont_remember | Ends a sign-in when you close the browser, if the sign-in asked for this. | Until you close the browser |
better-auth.state | Checks that a Google sign-in comes back to the browser that started it. | 5 minutes |
better-auth.last_used_login_method | Shows on the sign-in page whether you signed in with Google or with your email last time. | 30 days |
oidc_login_prompt and oidc_consent_prompt | Continue an agent connection after you sign in and give consent. | 10 minutes |
sidebar_state | Remembers if the sidebar of the app is open or closed. | 7 days |
On a secure connection, the names of the sign-in cookies start with
__Secure-. The better-auth.last_used_login_method cookie keeps its name.
The security check of section 3.1 runs in a frame of Cloudflare
(challenges.cloudflare.com) on the sign-up form and on the password reset
form. vibereel sets no cookie for it, and we do not turn on the Cloudflare
option that sets a clearance cookie. Cloudflare reads the browser signals that
section 3.1 lists. The check is strictly necessary to protect these forms
against automated abuse.
We also keep these settings in the local storage of your browser. They stay until you clear them:
| Entry | Purpose |
|---|---|
vibereel-theme | Your light or dark theme. |
vibereel:lastWorkspaceId | The workspace that you used last. |
vibereel:inviteToken | The secret code of a workspace invite, while you sign in. We delete it when you join or when the invite stops working, and at the latest after 7 days. |
reel-timeline-view | The timeline view that you chose on a reel page. |
8. Who receives your data
We use these providers. They process personal data for us, as our processors:
| Provider | What it does for us | Data that it receives | Location |
|---|---|---|---|
| Convex | Database, server functions, reel addresses and system logs | Your account data, your content, your credit and usage records, and request data with the IP address | United States (US East) |
| Cloudflare | Hosting of the website and of the sign-in; the security check at sign-up and password reset (Turnstile); file storage (R2); video export and media processing (Queues and Containers); screenshots (Browser Rendering); account emails and feedback alerts (Email Sending); system logs | Request data with the IP address and cookies; for the security check, the IP address, the user agent, the TLS fingerprint and the form address; your files and exports, your email address and the content of account emails | Global network; files in the United States (Eastern North America) |
| PostHog Inc. | Usage statistics, performance and error reports | Browser events and server usage events from section 3.10, with the internal user ID after sign-in, without email addresses or names | United States (US cloud) |
| Firecrawl | Website reads | The addresses of the pages that the agent reads, and the content of these pages | United States |
| fal | Sound effects | The descriptions, lengths and settings of the sound effects that the agent asks for | United States |
| Voiceovers and music | The scripts and voice settings of the voiceovers, and the descriptions and lengths of the music, that the agent asks for | United States | |
| Groq | Transcripts, word times of voiceovers and voice comments | The sound of the files that you or the agent ask to transcribe, the audio of voiceovers, and your voice comment recordings | United States |
We can also disclose personal data when the law requires it, for example to a court or an authority, or when we must protect our rights.
9. Transfers outside the EU
Some providers are in the United States or process data there. Our database and our stored files are in the United States. Firecrawl, fal, Google (for voiceovers and music), Groq and PostHog Inc. (US cloud) process data in the United States. Convex and Cloudflare are companies from the United States and can process data there. Google and jsDelivr receive browser connections as section 6 explains. If you sign in with Google, Google processes that sign-in as section 3.1 explains.
For a transfer outside the European Economic Area, we rely on an adequacy decision of the European Commission, for example the EU-US Data Privacy Framework for a certified company, or on the Standard Contractual Clauses of the European Commission (Art. 45 and 46 GDPR). You can ask us for a copy of these safeguards.
10. How long we keep data
| Data | How long we keep it |
|---|---|
| Account data | Until your account is deleted. |
| Session records | A session ends after 7 days. The records of ended sessions stay until your account is deleted. |
| Sign-in token cookie | 30 minutes. |
| Agent connections | An access token is valid for 1 hour, a refresh token for 7 days. The records stay until you revoke the agent or your account is deleted. |
| Your content in owned workspaces | Until you delete it or your account is deleted. |
| Your content in a workspace of another owner | Until the owner deletes it or the workspace. It stays when you leave, when the owner removes you and when you delete your account. |
| Workspace invites, with the invited email address | Up to one day after the person joins or the owner cancels the invite, at the latest 30 days after the invite expires. |
| Account sound library | Until you delete its sounds. Account deletion does not yet remove the library records and files. |
| Voice comment recordings | Not stored. We keep only the text. |
| Tool call records | 14 days. |
| Credit and usage records | Until your account is deleted. After that, only without your name and email address. |
| Keyed hash of your email address, with the record of your free credits | No fixed end. It stays after your account is deleted. |
| Keyed hash of your email address, with your user ID (one account for each mailbox) | From your email verification or your first Google sign-in until your account is deleted. |
| Result of the security check at sign-up and password reset | Not stored by vibereel. |
| PostHog usage statistics and error reports | No fixed end set by vibereel. Account deletion does not delete these events. They keep your internal user ID. |
| System logs of our providers | Cloudflare keeps the logs of our servers for up to 7 days. Convex keeps only a short window of recent logs. Groq can keep request logs for troubleshooting or abuse checks for up to 30 days. |
| Backups | We make no automatic database backups. A manual backup stays for up to 7 days. |
| Your emails to us | Until we close your request. Longer only when the law requires it. |
| Feedback that the agent sends | No fixed end. A closed ticket stays stored. When your account is deleted at your request, we delete your feedback tickets. |
When you delete a project, we delete its reels with their versions, comments and screenshots, and we schedule its stored files for deletion. When you delete a workspace, we delete its projects, its stored files and the text contents of its reel files. The text contents of the reel files of a deleted project stay stored until you delete its workspace or your account.
We keep PostHog usage statistics and error reports after account deletion. We do not delete the events or the PostHog person. They keep your internal user ID. They are pseudonymous, not anonymous. Retained credit records can still link this ID to the keyed email hash. If an account has billing records, these can also link it to a Stripe customer. Account sound library text and audio can also remain and identify you. We do not treat those linked records as anonymous.
11. Your rights
Under the GDPR, you have these rights:
- Access: you can get a copy of your personal data (Art. 15 GDPR).
- Rectification: you can have wrong data corrected (Art. 16 GDPR).
- Erasure: you can have your data deleted (Art. 17 GDPR).
- Restriction: you can have the use of your data limited (Art. 18 GDPR).
- Data portability: you can get the data that you gave us in a structured, machine-readable format (Art. 20 GDPR).
- Objection: you can object to processing that is based on our legitimate interest (Art. 21 GDPR).
- Complaint: you can complain to a data protection supervisory authority, in particular in the EU country where you live or work or where the infringement happened (Art. 77 GDPR). Our supervisory authority is the Garante per la protezione dei dati personali (Italy), https://www.garanteprivacy.it.
To use your rights, email support@vibereel.studio from the email address of your account. We can ask you to confirm your identity. We answer within one month. For a complex request, we can extend this period by two more months. Then we tell you why.
You can also do some things yourself: delete your account on the Account page, delete projects and workspaces in the dashboard, delete files in your asset catalog, sounds in your sound library and your comments, revoke agents on the Connected agents page, and reset your password.
Delete your account
Open the Account page from the menu of your name, choose "Delete account" and enter your password. Then:
- Your account is locked at once. You are signed out, and every session and connected agent loses access.
- Within a few minutes, we delete the workspaces that you own with their projects, reels, versions, comments, files and exports, and the feedback that the agent sent. We remove your name and email address from your profile.
- We remove you from the workspaces of other owners. Your comments, versions and files in those workspaces stay there. Your comments show the author name "A member" (section 3.12).
- We send a confirmation to the email address of the deleted account.
- Usage statistics stay in PostHog after deletion, with your internal user ID, as section 10 explains.
- Credit and usage records stay without your name and email address. The keyed hash of your email address stays (section 3.7). Unused credits are lost.
- Data in our backups and in the system logs of our providers goes when they expire (section 10).
You cannot delete your account while you have an active paid plan or while a workspace that you own has other members. Cancel the plan first. Remove the other members from the workspace, or delete the workspace first.
If you cannot sign in, email support@vibereel.studio from the email address of your account. We delete your account within one month.
12. Security
We protect personal data with technical and organisational measures. For example, all connections use HTTPS, we store passwords only as hashes, sign-in tokens expire, each request to private data passes an access check, and only the people who run vibereel can access the production systems. No system is completely secure. If a personal data breach puts your rights at risk, we tell you and the supervisory authority as the law requires.
13. Children
vibereel is not for children. You must be at least 18 years old to use it. We do not check your age. If you think that a child gave us personal data, contact us, and we delete the data.
14. Changes to this policy
We can change this policy. The effective date at the top shows the current version. Before an important change takes effect, we tell you by email.