Legal

Privacy policy

Last updated 28 October 2026

This policy explains what personal data Reelday collects, why, how long we keep it and the rights you have, wherever you live. VİSTA WAY TEKNOLOJİ LİMİTED ŞİRKETİ, established in the Republic of Türkiye, is the data controller (veri sorumlusu) under the Turkish Personal Data Protection Law No. 6698 (KVKK) and under the EU and UK General Data Protection Regulation (GDPR), which applies because we offer the Services to people in the European Union and the United Kingdom. This policy also meets the California Consumer Privacy Act (CCPA/CPRA) and other applicable privacy laws, and serves as our disclosure notice under KVKK Article 10 and GDPR Articles 13 and 14.

1. What we collect

Account data: your email address and a sign-in token. Instagram connection data: your Instagram user id, username, account type, whether the account is public, follower count, and an access token issued by Meta — we never receive or store your Instagram password. Content data: the clips and photos you upload, the reels built from them, the transcript used for subtitles and the captions written for them. Results data: views, reach, watch time, likes, comments, shares, saves and follows for reels posted through the Services, as reported by Meta. Onboarding answers: how often you post and your approximate follower range, if you tell us. Purchase data: your subscription status and transaction identifiers from Paddle, Apple or Google (never your card details). Technical data: device model, operating system, app version, language, crash reports and anonymised usage events.

2. Why we use it and on what basis

To provide the service you asked for (building reels from your clips, publishing them to your Instagram account, reading back the results, sending the reminders you turn on): performance of a contract. To keep the app secure, fix bugs and understand which features are used: our legitimate interest in running and improving the service. To send product news: only with your consent, which you can withdraw at any time. To meet legal and tax obligations: legal obligation.

Your clips and transcripts are processed to build and publish your reels and to show them back to you. We do not use them for advertising and we do not sell them.

3. Sharing

We share data only with processors who help us run the Services under contract (GDPR Article 28) and on our instructions: cloud hosting and file storage, crash reporting and product analytics providers, email delivery for account and support messages, a large-language-model provider used to write captions and weekly summaries from your transcripts and figures, Paddle, our merchant of record, for website purchases, and Meta, for measuring our advertising (section 10). Meta processes the publishing of your reels and returns their figures under its own terms. Apple and Google process App Store and Google Play purchases under their own privacy policies. We do not sell personal data and we do not share it with advertisers.

AI apps you connect. If you connect an AI app such as Claude or ChatGPT to your Reelday account (Settings → Connect your AI, or from the AI app itself), that app can read, on your request, the data its tools return: your reels made in Reelday (titles, captions, the text on screen, the music, the changes made and their scores) and, once Instagram is connected, your reels' results, when your followers are online and your audience breakdown. Nothing is shared until you approve the connection on our consent screen, and only reads are allowed unless you also approve changes. The AI app processes that data under its own terms and privacy policy, as a separate controller chosen by you; we do not send it your clips, your email address or your Instagram access token. We keep a record of each connection (the app's name, what you approved and when it was last used) for as long as it is connected. You can disconnect any app at any time in Settings → Connect your AI, which stops access at once.

4. Requests from public authorities

Governments, courts and regulators sometimes ask companies to hand over user data. We have never received such a request. If one arrives we review whether it is lawful and binding on us before we respond, and we refuse or challenge it where we believe it is not. We disclose only the minimum information the request actually requires, never an entire account where a single field would do, and we record every request, what we gave and why. We tell the person affected unless the law forbids it. These commitments apply to any request, including ones about data we receive from Meta.

5. International transfers

We are established in Türkiye and our servers and providers are located in the European Union and the United States, so your data is transferred between these regions to run the Services. Transfers out of the EU and UK rely on the GDPR Chapter V safeguards: the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the EU-US Data Privacy Framework where a provider is certified. Transfers out of Türkiye are made under KVKK Article 9 using the standard contracts published by the Turkish Personal Data Protection Authority or with your explicit consent where required. You can ask us for a copy of the safeguards in place.

6. Retention

We keep your data while your account is active. When you delete your account we erase your clips, reels, transcripts, figures and Instagram connection within 30 days, except for records we must keep for legal, tax or fraud-prevention reasons, which are kept only as long as the law requires. Reels already published to Instagram remain on your Instagram account and are under your control there. Anonymised usage statistics may be retained.

7. Your rights

Wherever you live you can ask us what data we hold, request a copy, correct it, delete it, restrict or object to processing, withdraw consent at any time and receive your data in a portable format. Most of this you can do directly in the app (Settings, then Account). For anything else email support@reelday.io from the address on your account. We answer within 30 days and never charge for a request unless the law allows and the request is clearly excessive.

EU and UK residents: your rights under GDPR Articles 15 to 22 are listed above, our lawful bases are set out in section 2, and you may complain to your national data protection authority or, in the UK, the Information Commissioner's Office. All users may also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr). California residents: you have the right to know, delete and correct your personal information and to opt out of its sale or sharing. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising your rights. Other regions (including Canada, Brazil, Australia and Switzerland): you have equivalent rights under your local law and may contact your local privacy regulator.

8. Security

Data is encrypted in transit and at rest, your Instagram access token is stored encrypted, access is limited to staff who need it, and we review our providers' security. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.

9. Children

The Services are intended for adults and are not directed at children under 16 (or under 13 in the United States). We do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

10. Cookies, advertising and measurement

reelday.io and quiz.reelday.io use the cookies needed for them to work and for checkout. On quiz.reelday.io we also keep our own record of your visit: an anonymous visitor id, which screens you saw and answered, the country your connection came from, which ad or link brought you, and your email address once you type it, so we can see where the questionnaire loses people and contact you about the plan you asked for. This record stays with us (hosted by Supabase) and is deleted on request; it never contains Meta's cookies or your payment details. To measure our advertising on Meta (Facebook and Instagram), these pages also use the Meta Pixel, and our server uses Meta's Conversions API: they tell Meta which pages and quiz steps were viewed, when someone gives their email, starts checkout or completes a purchase (with its amount), together with the browser's IP address and user agent, Meta's own cookies (_fbp, _fbc) and, where given, the email address in hashed form. Meta uses this to show who responded to our ads and to find similar people; Meta processes it under its own terms and privacy policy. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland (or we cannot tell where you are), none of this runs until you choose “Accept all” on the privacy card shown when you arrive; “Essentials only” loads nothing from Meta and the pages work the same. Your choice is kept in a cookie on reelday.io for 12 months and you can change it at any time with “Your privacy choices” in the footer. We honour the Global Privacy Control signal as a decline. Elsewhere the Pixel runs by default and “Your privacy choices” lets you turn it off. You can limit ads based on this data in your Meta ad settings (accountscenter.facebook.com) and by blocking third-party cookies in your browser. The app itself does not use third-party advertising SDKs, and on iOS we only track across apps if you allow it through App Tracking Transparency.

11. Changes

We will post any changes here and update the date above. For material changes we will notify you in the app or by email.

12. Contact

VİSTA WAY TEKNOLOJİ LİMİTED ŞİRKETİ, Barbaros Mah. Lale Sk. Agaoglu My Office No: 2 İç Kapı No: 13, 34758 Ataşehir, İstanbul, Türkiye. Email: support@reelday.io. Requests under KVKK may be sent to this address in writing or from the email address registered to your account. As required by GDPR Article 27 we will appoint a representative in the EU and the UK and name them here.