Privacy Policy

Last updated: October 21, 2026

This Privacy Policy explains how Reelclock (“Reelclock”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with the Reelclock video scheduling and publishing platform (the “Service”) and the websites at reelclock.com and related sub-domains, including mcp.reelclock.com (the “Site”). It applies to visitors to the Site, account holders, and anyone else who interacts with us. By using the Site or the Service you acknowledge this Policy. For our contractual terms, see our Terms of Service.

1. Who We Are (Data Controller)

Reelclock is operated by Veloris LLC. References to “Reelclock” mean Veloris LLC.

Veloris LLC is the contracting party for paid subscriptions and the data controller for account, billing, customer-support and Service-usage data. Veloris LLC is also the integrating party with the third-party platforms whose APIs the Service uses (TikTok, Meta for Instagram, and X) and processes the OAuth credentials and platform-side metadata required to publish on your behalf.

For all privacy questions, requests and complaints you can reach us at support@reelclock.com. Contact details are set out at the end of this Policy.

2. The Service in Brief

Reelclock lets you post and schedule short vertical videos to the TikTok, Instagram and X accounts you connect. You can use it from the web app, or from AI agents you connect over MCP (mcp.reelclock.com) or with API keys. Agents may create posts on your account, and you can require your approval of agent posts before they are published.

3. The Data We Collect

3.1 Account & identity data

• Your email address, which you use to sign in with an email magic link.
• If you sign in with Google, the basic profile fields and email returned by Google.
• API keys you create for AI agents or other software. We store API keys only as hashes.

3.2 Connected platform data

When you connect a TikTok, Instagram or X account to Reelclock we receive and store, via that platform’s API:

• OAuth access and refresh tokens, encrypted at rest (AES-256-GCM).
• The platform account identifier, handle, display name and avatar.
• The posts you create or schedule, and the post status and publish logs the platform returns when we publish them.

Your use of TikTok through the Service is also subject to the TikTok Terms of Service and the TikTok Privacy Policy. Your use of Instagram is also subject to Meta’s terms and policies, including the Meta Terms of Service and the Meta Privacy Policy. Your use of X is also subject to the X Terms of Service. You can revoke Reelclock’s access at any time in Reelclock (Disconnect, on the Accounts page) or in each platform’s settings (see Data deletion). Reelclock uses platform data only to publish what you ask it to publish and to show you post status. We never use it for advertising and we never sell it.

3.3 Content you upload

Videos you upload, the thumbnails we generate from them, captions, schedules, post status and publish logs, and any other content you upload to or create within the Service, including content created by AI agents you connect.

3.4 Billing data

When paid plans are offered, payments are processed by Stripe. Your plan and subscription status are kept with your account. Card numbers are collected and stored directly by Stripe and never reach Reelclock.

3.5 Logs & usage data

• Server logs of requests to the Service, which may include IP address, user-agent and request time, and error reports.
• Usage counts of the posts you publish to X.
• Session and authentication data, including login timestamps and session tokens.

3.6 Communications & support data

Messages you send to us by email and any information you include in them.

3.7 Cookies & similar technologies

We use cookies and local storage for authentication and security. We do not use analytics or advertising cookies. You can manage cookies through your browser settings; disabling these cookies will break sign-in and other parts of the Service.

4. How We Use the Data & Legal Bases

We process the data described above for the purposes below. Where the GDPR (or UK GDPR) applies, the legal basis for each purpose is shown in brackets.

• Provide the Service: authenticate users, create and manage your account, store and publish your content to connected platforms, show post status, and provide customer support. (Performance of contract.)
• Bill and collect payment: when paid plans are offered, manage subscriptions, prevent payment fraud, comply with tax law. (Performance of contract; legal obligation.)
• Secure the Service: detect and prevent abuse, fraud, account takeover, brute-force attacks, spam and infrastructure attacks; investigate incidents; enforce the Terms. (Legitimate interests in keeping the Service safe; legal obligation.)
• Operate and maintain the Service: debug, monitor uptime and measure performance. (Legitimate interests in running a reliable Service.)
• Communicate with you: send service-related messages (sign-in links, security alerts, post-failure notices) and, where you have opted in or where permitted, marketing communications. (Performance of contract; consent or legitimate interests, depending on the message and your jurisdiction.)
• Comply with law: respond to lawful requests, enforce our rights, defend claims. (Legal obligation; legitimate interests.)

We do not use the content of your scheduled posts or your connected-platform data to send you advertising, and we do not sell that data.

5. AI Agents

Reelclock does not include AI features of its own. AI agents you connect to Reelclock over MCP or with API keys are third parties governed by their own terms and privacy policies.

6. Reelclock as Controller vs Processor

For account, billing and security data, Reelclock acts as a data controller.

For the content you publish through the Service and any personal data of other people that it contains, Reelclock acts as a data processor on your behalf, and you are the controller. You are responsible for having a lawful basis for that processing, for providing notices and obtaining consents from the people concerned, and for honouring their rights.

7. Who We Share Data With

We do not sell personal data and we do not rent it to third parties. We share data only with:

• Sub-processors and infrastructure providers: database and authentication, web hosting, background processing, video storage, DNS, sign-in and payment providers. We require these vendors to provide adequate security and to process data only on our instructions and for the agreed purposes. The full list is set out in Section 7.1 below.
• Connected third-party platforms: when you schedule or publish content, we transmit it to the platform you selected, and we receive the post status from that platform. Each platform’s own privacy policy governs what it does next.
• Professional advisors: accountants, auditors, lawyers, insurers and similar advisors, under confidentiality.
• Authorities: when we are legally required to disclose data (court order, valid law-enforcement request, regulatory request) or when disclosure is necessary to investigate or prevent fraud, abuse, security threats or harm to people. Where lawful we will attempt to redirect the request to you first.
• Successor entities: in the event of a merger, acquisition, financing, reorganisation or sale of assets, in which case we will require the recipient to honour this Policy or provide notice of any new policy.

7.1 Data processors and sub-processors

We currently use the following companies to process personal data on our behalf. Each processes only the data needed for the purpose listed. The third-party platforms that you choose to connect (TikTok, Meta for Instagram, and X) are not our processors; they receive your content because you instruct us to publish it there (see Section 7 above).

• Supabase: database and authentication.
• Vercel Inc. (USA): hosting of the Site and web app.
• Railway Corporation (USA): background worker.
• Cloudflare, Inc. (USA): video storage (R2) and DNS.
• Google LLC (USA): Sign in with Google.
• Stripe, Inc. (USA): payment processing, when paid plans are offered.

We may update this list as our vendors change. You can ask about any processor by emailing support@reelclock.com.

8. International Data Transfers

Reelclock is operated from the United States (Veloris LLC), and we use sub-processors in the United States and other jurisdictions. As a result, personal data we process may be transferred to and stored in countries outside your own, including countries that may not have been recognised as providing an “adequate level of protection” by the European Commission, the UK ICO or other regulators.

Where personal data subject to the GDPR or UK GDPR goes to a country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework for recipients certified under it, and otherwise on the European Commission’s Standard Contractual Clauses (with the UK Addendum where it applies). You can ask us which safeguard applies to any processor by emailing support@reelclock.com.

9. Data Retention

• Account data: kept while your account is active. When you ask us to delete your account, we delete your account data within 30 days of the request, unless the law requires us to keep it.
• Videos: we may delete uploaded videos after they are published or after 90 days.
• Connected accounts and OAuth tokens: kept while the connection is active. When you disconnect an account, its tokens are deleted immediately. You can disconnect a platform at any time on the Accounts page.
• Billing records: retained for the period required by tax and accounting law in the relevant jurisdictions.
• Logs and error reports: kept as long as our hosting providers keep them under our settings.

Where retention is required for legal, regulatory, dispute-resolution or fraud-prevention reasons, we may keep data longer than the periods above.

10. Security

We maintain administrative, technical and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include: TLS on every connection between your browser or agent and Reelclock, and from Reelclock to connected platforms and our processors; OAuth tokens encrypted at rest (AES-256-GCM); API keys stored only as hashes; and access to your account’s data only for you and the agents you authorise. No system is fully secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• request correction of inaccurate or incomplete data;
• request deletion of your data, subject to retention obligations;
• object to or restrict certain processing, including direct marketing;
• withdraw consent where processing is based on consent (without affecting the lawfulness of processing already carried out);
• opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising (Reelclock does not sell personal data and does not share it for cross-context behavioural advertising as those terms are defined under the California Privacy Laws);
• lodge a complaint with your supervisory authority (in the EU/UK).

You can disconnect a platform at any time on the Accounts page. To exercise rights that cannot be handled in-product, including deleting your account, email support@reelclock.com (see Data deletion). We will respond within the timeframe required by applicable law (typically 30 days, extendable for complex requests). We may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.

12. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “California Privacy Laws”) gives you the rights summarised in Section 11, including the right to know what categories of personal information we collect about you and the purposes for which we use them (described in Sections 3 and 4), the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising your rights. Reelclock does not sell personal information and does not share it for cross-context behavioural advertising. To exercise your California rights, email support@reelclock.com.

13. Children

The Service and the Site are not directed to children. We do not knowingly collect personal data from children under the age of 18. The Service is not designed for, marketed to, or directed at children under 13 within the meaning of the U.S. Children’s Online Privacy Protection Act (“COPPA”), the EU GDPR’s children’s-data protections, or comparable laws in other jurisdictions. If you are a parent or guardian and believe a child has provided us with personal data, please contact us at support@reelclock.com and we will delete it.

14. Marketing & Cookies Choices

You can unsubscribe from marketing emails at any time using the unsubscribe link in any such email. Unsubscribing from marketing does not stop transactional and account-related emails, which are necessary while your account is active. You can manage cookies through your browser settings.

15. Third-Party Sites and Services

The Site and the Service link to and integrate with third-party services. Their handling of your data is governed by their own privacy policies, not this one. We encourage you to review the privacy policy of any platform you connect to Reelclock, including the TikTok Privacy Policy, the Meta Privacy Policy for Instagram, the X Privacy Policy, and, if you sign in with Google, the Google Privacy Policy.

16. Changes to this Policy

We may update this Privacy Policy from time to time. If a change is material we will provide reasonable notice (for example by email or in-product notice) before it takes effect. The date the Policy was last updated is shown at the top of this page; we encourage you to review it periodically.

17. Contact Us

For privacy questions, requests, or complaints, contact:

Veloris LLC
support@reelclock.com