Privacy Policy

Last updated 2026-10-18.

Who we are

ReelCrew (reelcrew.ai) is operated by CHEN BOWEN, an individual operator based in Hong Kong (“we”, “us”), who is responsible for the personal information described here. Privacy requests: privacy@reelcrew.ai. General support: support@reelcrew.ai. Abuse and takedown reports: report@reelcrew.ai.

What we collect and why

  • Photos you upload. Used only to generate the video you asked for. Legal basis: performance of our contract with you.
  • Generated videos. The watermarked preview and the full-quality file (both carry a visible “AI-generated” badge and metadata stating that the video is AI-generated), stored so you can watch, share and download them. We may also add C2PA Content Credentials to these files; they record that the video was AI-generated with ReelCrew and contain no personal information about you, only a random job ID.
  • Google sign-in (optional). If you sign in with Google we receive your Google account ID, name, email address, profile picture and whether Google has verified your email. We use the account ID to issue and count your daily credits, to hold your paid credits, and to recognise you as the creator of your videos. Your name, email and picture are kept only in your encrypted session cookie on your device; we do not store them on our servers or send you marketing email.
  • Payments. At checkout you choose between Stripe (cards, including Apple Pay or Google Pay where shown, and Link) and PayPal. These are the only ways to pay. We never see or store card numbers or PayPal logins. We receive from the provider your email address, billing country, its order / payment / transaction IDs, the payment method type, the amount and what was bought, and we keep these together with your ReelCrew account or browser ID and your acceptance of our Terms, to deliver the video, handle refunds and chargebacks and meet accounting obligations.
  • IP address and device signals. Used to prevent abuse: rate limits on uploads and generation, daily-credit and free-preview limits (per network and per browser), our block list, and Cloudflare Turnstile human verification. We store IP addresses only as a salted one-way hash. Legal basis: our legitimate interest in keeping the service secure and affordable.
  • Content safety checks. Your photos, any text you enter and the generated video are automatically checked for prohibited content (see SeeAPI below). Results are automated and can be wrong; if you think a photo was rejected by mistake, contact us. Legal basis: our legitimate interest and legal obligations in preventing abuse, non-consensual and illegal content.
  • Face checks on uploaded photos. Each uploaded photo is sent once to Amazon Rekognition to estimate the age range of every face, to check whether it matches a well-known public figure, to count faces and, if no face is found, to check whether a person is shown, so we can refuse photos of minors and public figures. We keep only the outcome (accepted or the rejection reason) in our logs; we do not create or store face templates or collections, and we do not use these checks to identify you. AWS’s own handling of the photo is described under “Service providers” below. Legal basis: our legitimate interest and legal obligations in preventing non-consensual content and content involving minors.
  • Consent confirmation. When you upload, we record that you ticked the consent box (wording version, time, browser ID, Google account ID if signed in and a hashed IP address) and keep it for 90 days as evidence in case a video is reported.
  • Removal requests. If you report a video, we keep your request and our response for as long as we need them to handle the request and to show we complied, and then delete them.
  • Usage analytics. Google Analytics 4 records pages visited and events such as starting an upload, a finished preview, opening checkout and purchases, each tagged with the template used. Analytics only runs if you click “Accept” in our cookie banner (legal basis: your consent). Until then the Google Analytics script is not loaded and no analytics cookies are set; you can change your choice any time via “Cookie settings” in the footer.

We do not sell personal information and do not use your photos or videos to train AI models.

Service providers (processors)

  • MiniMax (Nanonoble Pte. Ltd., Singapore, and its affiliates) runs the AI video model for all our templates, through MiniMax’s own international API service (platform.minimax.io). Your photo or photos (via a link that expires after one hour) and the template prompt are sent to MiniMax; MiniMax returns the generated video, which we copy to our own storage. We do not use MiniMax’s mainland-China service for your photos. MiniMax’s privacy policy says it stores personal data in a data center in the United States and keeps it for as long as necessary for the purpose it was collected or as permitted by law, and then deletes or anonymises it.
  • SeeAPI — automated content safety checks. Each uploaded photo (via a link that expires after 10 minutes), the finished video (via a link that expires after one hour) and any text you type are sent to SeeAPI to detect sexual, violent or other prohibited content, including content involving minors, before we generate or show anything. Flagged photos are deleted from our storage immediately; a flagged video is deleted and never shown, and any payment or credit for it is returned. We keep only the yes/no outcome and category labels in our logs. SeeAPI states that it does not use submitted content to train AI models, that it keeps the files and moderation results it stores with no scheduled automatic expiry and its request logs for 60 days, and that customers can ask it to delete them.
  • Amazon Web Services (Rekognition) — one-time face checks on uploaded photos (age estimate, public-figure match, face count, person detection), sent as image bytes over an encrypted connection. Under AWS’s published terms, AWS may store the images it processes to provide and maintain Rekognition and, unless the customer has opted out, to improve AWS’s machine-learning services, which can involve storing them in another AWS region.
  • Cloudflare — R2 storage for photos and videos; Turnstile human verification; content delivery for example videos; email forwarding for our support and report addresses.
  • Upstash — fast database for job status, rate-limit, daily-credit and free-preview counters, paid credits, consent records and our block list.
  • Vercel — hosting; processes requests and keeps short-lived server logs, including IP addresses.
  • Stripe — card, wallet and Link payments (hosted checkout on checkout.stripe.com; Link is Stripe’s saved-payment service, used only if you choose it), fraud prevention, refunds and disputes. For our Hong Kong Stripe account, Stripe’s contracting entity is Stripe Payments Europe, Limited (Ireland). Stripe also uses payment data for its own fraud-prevention and legal purposes as an independent controller under its own privacy policy.
  • PayPal — PayPal payments, refunds and disputes. You log in on PayPal’s own site. For our Hong Kong PayPal account, the PayPal entity is PayPal Hong Kong Limited. PayPal is an independent controller of the data it collects there, under its own privacy policy.
  • Google — sign-in (OAuth) and Google Analytics.

How long we keep data

  • Uploaded photos: deleted immediately if they fail the content check; otherwise deleted as soon as generation finishes (successfully or not). Photos that never lead to a generation are deleted automatically within about 1 day.
  • Generated videos and the job record: deleted automatically 30 days after creation. Download anything you want to keep.
  • Daily-credit, free-preview and rate-limit counters (keyed by Google account ID, hashed IP address or browser/device ID): up to 48 hours.
  • Consent records: 90 days.
  • Paid credits: kept while unused, linked to your Google account ID (or, if you bought without signing in, to a cookie in your browser until you sign in).
  • Block-list entries (Google account ID, email, hashed IP, browser/device ID): until the block is lifted.
  • Order records in our database (provider order and payment IDs, amount, what was bought, your account or browser ID): about 13 months.
  • Payment and accounting records: at least 7 years after the transaction, as Hong Kong law requires for business records (Inland Revenue Ordinance, Cap. 112, section 51C).
  • MiniMax: we can look up a task for 7 days and its download links are time-limited; how long MiniMax keeps data is set by its privacy policy (see above).
  • SeeAPI and AWS: as described under “Service providers” above.
  • Google Analytics: no longer than 14 months, the longest retention Google Analytics allows for standard properties.

Cookies and similar technologies

Necessary cookies are always on because the service cannot work without them. Analytics cookies are optional and off by default: Google Analytics loads only after you click “Accept”, with Google Consent Mode set to “denied” for everything until then and advertising signals always denied (we run no ads). “Reject” is as easy as “Accept”, and you can withdraw consent at any time via “Cookie settings” in the footer — we then stop analytics and delete the _ga cookies on this site.

  • rc_uid (necessary, 1 year): a random ID for your browser — owns your uploads and videos and holds unused 3-pack credits until you sign in. It is not linked to your name.
  • rc_dev (necessary, 1 year, set only when you claim a daily credit): a random ID used solely to limit how many accounts claim daily credits from one browser.
  • authjs.session-token, authjs.csrf-token, authjs.callback-url (necessary, only if you sign in; session up to 30 days): your encrypted sign-in session.
  • Cloudflare Turnstile (necessary): checks you are human; Cloudflare processes browser and device signals for this purpose.
  • Google Analytics _ga, _ga_* (analytics, optional, only after you accept; up to 2 years).
  • rc_consent_v1 in your browser’s local storage (necessary): remembers whether you accepted or rejected analytics, so we don’t ask on every page.
  • Stripe (checkout.stripe.com) and PayPal (paypal.com) set their own cookies on their hosted payment pages, under their own policies.

International transfers

We are based in Hong Kong, and our providers process data outside Hong Kong and outside the country where you live, including in the United States (for example, MiniMax stores personal data in the United States). Where the law requires it, we rely on the safeguards our providers offer in their data-processing terms, such as the EU Standard Contractual Clauses.

Your rights

Depending on where you live (for example under Hong Kong’s Personal Data (Privacy) Ordinance, the GDPR/UK GDPR or the California Consumer Privacy Act), you can ask to access, correct, delete or export your personal information, object to or restrict processing, and withdraw consent at any time. To delete a video before the 30 days are up, or for any other request, email privacy@reelcrew.ai with the video link. We will not discriminate against you for exercising your rights. You can also complain to your local data-protection authority.

Children

ReelCrew is not for anyone under 18. Do not upload photos of minors. We delete such content when we become aware of it.

Changes

We will post any changes on this page and update the date above.

Popular templates: AI Kiss Generator · AI Hug Generator · AI Romantic Video · Home