Privacy Policy

1. Who We Are (Data Controller)

2. Information We Collect

2.1 Information You Provide

• Account data: name, email address, password (hashed).
• Billing data: payments are handled by Stripe. We never receive or store your card number. We store your Stripe customer and subscription identifiers, billing country, subscription status, and a card fingerprint used solely to prevent free-trial abuse.
• Content: scripts, prompts, uploaded images, voice samples (if you use voice cloning), Craft brand presets, and generated reels.
• Communications: support emails, feedback you submit.

2.2 Information Collected Automatically

• Usage data: pages viewed, features used, reels generated, timestamps, IP address, browser, device, and operating system. Product analytics are first-party only: events are stored in our own database and are not sent to any third-party analytics provider.
• Fraud-prevention signals: during signup we compute a device fingerprint locally in your browser using the open-source FingerprintJS library; we store only a salted hash of it, used solely to prevent free-trial abuse. Signup is also protected by Google reCAPTCHA v3, which sends device and behaviour signals to Google for bot detection (see Google's privacy policy).
• Cookies & similar technologies: essential cookies (authentication), analytics cookies (aggregated usage), and preference cookies. See Section 9.

2.3 Information From Third Parties

• OAuth platforms (TikTok, YouTube, Instagram, Facebook): when you connect a social account, we receive your platform username, profile/channel ID, and an access token scoped only to publishing content you explicitly create within ManifestReelAI. We do not read your existing posts, followers, DMs, or analytics unless required to confirm a publish succeeded.

3. How We Use Your Data (Legal Bases under GDPR)

We do not sell your personal data. We do not use your content to train AI models without your explicit opt-in.

4. Third-Party Sub-Processors

We share data with the following providers strictly to deliver the Service:

All non-EU providers operate under Standard Contractual Clauses (SCCs) and appropriate safeguards.

5. Social Platform Connections (TikTok, YouTube, Instagram, Facebook)

When you connect a social account:

• We request only the minimum scopes required to publish content you explicitly create:
  • TikTok: video.publish, user.info.basic
  • YouTube: youtube.upload, youtube.readonly
  • Instagram & Facebook: instagram_basic, instagram_content_publish, pages_show_list, pages_manage_posts, business_management
• We store an encrypted access token and refresh token.
• We never post without your explicit action.
• You can disconnect any platform at any time in Settings → Connected Accounts. Disconnecting deletes the tokens stored in our database.
• We do not download, read, or store your existing posts, followers, DMs, or audience analytics.

YouTube: our use of YouTube API Services is subject to the YouTube Terms of Service. The Google Privacy Policy applies to data held by Google. In addition to disconnecting in Settings, you can revoke ManifestReelAI’s access to your Google account at any time via the Google security settings page.

6. Data Retention

When you request account deletion (Section 8), we process the request manually and aim to erase all personal data within 30 days, except records we are legally required to retain.

7. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA). We rely on the EU Standard Contractual Clauses (SCCs), the UK IDTA where applicable, and additional safeguards to ensure your data receives an equivalent level of protection.

8. Your Rights

Under GDPR, CCPA, and similar laws you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”) — request at manifestreelai.com/data-deletion.
• Restrict or object to processing.
• Data portability — available on request by email to support@manifestreelai.com.
• Withdraw consent at any time.
• Lodge a complaint with your local Data Protection Authority.

To exercise any right, email support@manifestreelai.com. We respond within 30 days.

9. Cookies

We use:

• Strictly necessary cookies (authentication, security) — always on.
• Functional cookies (preferences) — strictly functional, used on the basis of our legitimate interest in remembering your preferences.
• First-party analytics — we collect product usage events on the basis of our legitimate interest in operating and improving the Service. These events are stored in our own database, are not shared with any third party, and are not used for advertising.

You can manage cookies via your browser settings. Refusal of non-essential cookies does not affect access to the Service.

10. Security

We implement industry-standard safeguards: encryption in transit (TLS 1.3), encryption at rest (AES-256), hashed passwords (bcrypt), encrypted OAuth tokens, and role-based access control. No system is 100% secure, but we work hard to protect your data.

11. Children

The Service is not directed to persons under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, email support@manifestreelai.com and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be announced via email and/or a notice on the website at least 30 days before taking effect. The “Last updated” date at the top reflects the latest revision.

13. Contact

Questions? Contact us at:

For Data Protection inquiries: support@manifestreelai.com