In short
- We collect two very different things, your private account and workspace data, and public social content with identifiable authors and source links. Video and image processing can involve external AI providers.
- We never sell your data, and Reacast has no workflow for training a shared model on your products, media or projects. AI-provider retention and reuse terms still require contractual verification; no blanket provider training exclusion is claimed.
- You stay in control, request an export from Settings before deleting your workspace. Deletion ends access immediately. You can also contact us to exercise your data rights or request removal of public content.
Who we are
Reacast helps e-commerce brands discover video inspirations, analyze them and prepare creations for their products. Reacast determines the processing of account, security and public discovery data. Its role for personal data entrusted by a business in its workspace must be specified in the applicable data processing agreement.
Pending legal review
Publisher: Reacast. Registered address: {{REACAST_LEGAL_ADDRESS}}. Registration number: {{REACAST_REGISTRATION_NUMBER}}. Privacy contact: {{REACAST_PRIVACY_EMAIL}}. The placeholders must be completed before public launch; the Data Protection Officer must be identified if one is appointed.
Data we collect
The categories below reflect the current pilot. Account identification is needed to access a private workspace. Optional profile and product details depend on the features you use. The Contact page prepares a draft locally; its contents reach the support inbox only when you send the email from your mail application.
Account information
Email, profile name, workspace, brand preferences and authentication identifiers. If you choose Google sign-in, Google supplies your email, account identifier and profile, including your name and picture if provided, to Supabase Auth; this does not grant access to Gmail, Drive or Contacts.
Billing information
Pilot access, generation quotes and a credit ledger distinguishing available, reserved, consumed and refunded credits. Payment checkout and subscription purchases are not active in the current pilot; Reacast does not collect card details.
Product & workspace data
Brand and audience information, product descriptions and public product-page URLs, search queries, followed accounts, saved inspirations, analyses, briefs, storyboards and projects.
Uploaded media
Product photos, videos and audio you import, temporary copies of selected public videos, sampled frames, prepared references and generated outputs. Video analysis and generation send the required media and instructions to the relevant AI provider.
Technical & usage records
Task status, errors, quotas, credit movements and provider receipts are recorded to operate the service and reconcile failures. Technical logs can contain IP addresses and browser information. No audience-measurement or advertising tracker is integrated in the current application.
Social media data processed by Reacast
Public posts and accounts from the enabled TikTok, Instagram and Facebook connectors: handles, profile images, captions, source URLs, dates and available counters. These records can identify people and are not anonymous. Public counters do not establish sales or exclusively organic reach.
When you choose Continue with Google, Reacast receives your Google account identifier, email address and verification status, name and profile picture, when provided by Google. Reacast uses this information to create or sign in to your account and identify your profile. It is stored in Supabase Auth, Reacast's authentication provider. This sign-in requests only basic identity permissions and does not grant Reacast access to your Gmail messages, Google Drive files or Google Contacts. You can remove Reacast's access from your Google Account's third-party connections settings. Removing access does not automatically delete your Reacast account; for a data deletion request, contact contact@reacast.com.
Your data vs public data
This distinction is central to how Reacast works, and we want it to be unambiguous.
Data you own
Your workspace records and private files are isolated from other workspaces. Processing includes storage, format validation, metadata removal from product photos, video preparation and the analysis or generation operations used in your workflow. Required files, frames and prompts can be transmitted to the providers listed below.
Export your data before deletion
Public data we analyze
Public sources retain account handles, source links, captions and available metrics. New publications can be analyzed automatically when the connector and analysis service are enabled; existing publications are analyzed on request. A selected video can be downloaded and prepared for product replacement without a separate rights attestation. A public URL does not grant a reuse license.
Sourced exclusively from public pages
Why we process data & legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Account, workspace and requested creative processing | Identity, products, media and instructions | Contract performance |
| Public discovery and account monitoring | Public posts, handles, links and available metrics | Legitimate interests, subject to documented assessment |
| Security, quotas and failure reconciliation | Technical logs, task and credit records | Legitimate interests in security and service reliability |
| Account emails and support replies | Email and message content | Contract performance or pre-contractual steps |
| Future optional marketing or audience measurement | Not active in the current pilot | Prior consent where required; no consent inferred from using Reacast |
Pending legal review
The discovery legitimate-interest assessment, information of people whose public data is collected, and controller/processor roles must be documented before commercial launch. Public availability alone is not a legal basis. AI interpretations are estimates to review, not verified facts or decisions with legal effects about individuals.
Service providers & subprocessors
The providers below are integrated in the pilot workflows. They receive data needed for their role: identity and private records for authentication/storage, job identifiers for orchestration, public queries and URLs for collection, and the necessary media, frames, descriptions and prompts for AI processing. A provider integration does not establish that its processing agreement, retention or hosting region has been legally validated.
| Role | Provider | Location |
|---|---|---|
| Authentication, database and private files | Supabase | Deployment region to confirm |
| Optional Google sign-in | Google via Supabase Auth | Processing countries to confirm |
| Authentication emails | Resend via Supabase SMTP | Sending region eu-west-1 observed in DEV; other processing to confirm |
| Background jobs | Trigger.dev | Processing countries to confirm |
| Public social content collection | Apify and configured Actor publishers | Processing countries to confirm |
| Video/image analysis and creative text | Google Gemini API | Processing countries to confirm |
| Enabled video-generation workflows | Kie.ai, including Redpanda input uploads | Processing countries and downstream providers to confirm |
Pending legal review
The deployment host, exact contracting entities, downstream AI subprocessors, processing agreements and provider training/reuse settings remain to be confirmed. Kie.ai input transfers use its Redpanda upload service. No payment processor or product analytics provider is active in the current pilot.
International data transfers
Reacast does not claim that all data stays in the European Union. Authentication, email, task processing and AI calls involve the providers listed above; their hosting, support access, backups and downstream services must all be considered. Processing outside the EEA requires an applicable transfer mechanism and any necessary additional safeguards.
Pending legal review
The exact countries, transfer assessments and applicable safeguards are not yet fully verified. Request details and copies of applicable safeguards through Contact; these points must be resolved before commercial launch.
How long we keep data
| What | How long | Why |
|---|---|---|
| Private account, products and projects | While the workspace is active and the data is needed; deletion on request | Deletion blocks access and new jobs immediately; physical purge is queued |
| Media and AI-provider copies | Analysis sources: 24-hour validity by default; other media and provider retention periods still to validate | Analysis copies have purge jobs after processing or expiry; provider expiry or an upload receipt is not proof of deletion |
| Workspace export archives | Access expires 24 hours after the request; cleanup is queued | Temporary private download, unavailable after workspace deletion |
| Technical, credit and processing records | For operation, security and reconciliation; exact periods still to validate | Records support incident investigation and credit reconciliation; a retention and deletion schedule remains to be validated |
| Public social records and backups | Removal on an applicable request; retention windows and backup rotation still to validate | Public authors remain identifiable; no verified 30-day backup deletion deadline |
Security
- Private workspace access checked on the server, including access to media
- Private file storage, authenticated downloads and time-limited access where used
- Server validation of file formats, sizes and external download destinations
- Breach notification to the competent authority within 72 hours where required; affected people informed without undue delay where required
Pending legal review
Certifications (e.g. SOC 2, ISO 27001) will be listed here once obtained, none are claimed today.
Your rights
You can request access, correction, erasure, restriction and, where applicable, portability or withdrawal of consent. You can object to processing based on legitimate interests, including public discovery data. In /app/Settings, Export data prepares a private ZIP of your records and eligible files; it excludes third-party source videos, raw uploads and unapproved generated takes. The archive expires 24 hours after the export request. Download it before deleting the workspace: access ends immediately and there is no 30-day recovery period.
Pending legal review
Use Contact for rights requests or public-content removal, including the relevant account or source URL. Identity may be checked where reasonably necessary. Requests must be answered within one month; a lawful extension of up to two further months must be explained within that first month. You can complain to the CNIL (www.cnil.fr) or your competent supervisory authority.
Children
Reacast is a professional tool and is not intended for children. We do not knowingly collect data from minors.
Pending legal review
Account eligibility follows the Terms. The applicable age requirements and any age-verification measures remain to be finalized before commercial launch.
Changes to this policy
The date at the top identifies this version. Material changes require appropriate information before the new processing starts and consent where required. Automated email and in-app policy-change notifications are not yet implemented in the pilot.
Contact
Data protection questions
Privacy contact: {{REACAST_PRIVACY_EMAIL}}. Until this address is completed, use the existing Contact page for data rights, provider questions or content-removal requests. It prepares an email for you to review and send; no request is submitted automatically.
Other legal documents