Privacy Policy

1. Scope and contact

This notice explains how the operator of titlereel.com (TitleReel) handles personal data when you visit the website, open an account, create media, use the API, or contact support. For account, service, and security administration, the operator determines the purposes of processing.

If you submit personal data about other people in content, you are responsible for having a lawful basis to use it. Organisations needing a data-processing agreement should contact us before using the service for that purpose.

For privacy questions or requests, including if you cannot sign in, contact:

2. Information we process

We collect information you provide and records created when the service operates. Web-page content is obtained from the URLs you submit or from a domain configured for automatic generation.

• Account details: email address, password hash, account dates, verification status, permissions, and authentication or security records. If enabled, two-factor settings and recovery-code hashes are also stored.
• Creation data: submitted URLs, page titles, images, favicons, uploaded assets, templates, design settings, generated media, and creation or deletion history.
• Magic Room data: briefs, prompts, conversation history, scenes, creative suggestions, model choices, and usage totals.
• Billing and usage: credit balances and transactions, monthly allowances, purchases, payment-provider references, and subscription status. Full card numbers and security codes are handled by the payment provider, not stored by TitleReel.
• Connected services: provider settings and encrypted credentials or OAuth tokens required for enabled integrations. API keys are stored as hashes with a display prefix, not as the original key.
• Support and operations: messages, privacy requests, administrative actions, and technical information such as IP addresses and request or error logs used for delivery, security, and troubleshooting.

3. Purposes and legal bases

Where the GDPR applies, we rely on performance of our contract with you to create and manage your account, retrieve submitted content, generate and deliver media, manage credits and purchases, and provide requested support.

We rely on legitimate interests to secure the service, prevent fraud and abuse, diagnose failures, and maintain operational records, taking account of your interests and rights. Legal obligations may require financial records, responses to lawful requests, and handling data-protection requests.

Optional analytics, if introduced, require your prior consent. You can refuse or withdraw that consent without losing access to essential service functions. We do not sell your personal data or use your content for targeted advertising.

4. Providers and disclosures

Providers that operate hosting, network security, transactional email, payments, and support infrastructure process data needed for those functions. The current service uses Webtropia for hosting, Cloudflare for network delivery and protection, Amazon SES for configured transactional email, and Lemon Squeezy for enabled payments.

When you use Magic Room, relevant source text, instructions, and scene or conversation context are sent to the selected AI provider. Supported providers include OpenAI, Anthropic, DeepSeek, and Kimi. A platform key or your connected key may be used. Review the selected provider’s policies before submitting confidential information; provider processing and retention may differ.

When enabled by you, storage integrations receive generated files and Slack receives creation notifications and links. We may also disclose information where required by law or reasonably necessary to protect rights and security. Access by authorised administrators is used for support and operation of the service.

5. International processing

Hosting and service providers, and integrations you select, may process information in countries other than your own, including outside the European Economic Area. The destination depends on the provider, account configuration, and region you select.

Where data-protection law requires safeguards for international transfers, those safeguards must apply, such as an applicable adequacy decision or appropriate contractual safeguards. Contact us for information about the destinations and safeguards relevant to your use before submitting data with particular residency requirements.

6. How long information is kept

Account information, templates, creation history, Magic Room sessions, and support conversations are kept while needed to provide the account and handle support, security, and legal obligations. A privacy request can ask us to review or erase that information. We retain only what remains necessary when resolving the request and explain any applicable exception.

Generated media follows the retention period configured for the service and displayed in the app; a disabled automatic-deletion setting means it is kept until removed or reviewed as part of an erasure request. Cached MP4 files may be evicted separately while a render source and thumbnail remain available. Deleting media does not itself erase the account’s creation or credit history.

Administrative audit records are configured to expire after 90 days. Operational backups follow a rolling 14-day retention schedule. Removing live data does not immediately erase every backup copy; copies are restricted to recovery and expire on that schedule. Data in a connected provider or downloaded by another person follows that recipient’s controls and retention rules.

Financial or dispute records may need to be retained for applicable legal obligations. Ask us for the retention period and reason applicable to a particular record.

7. Cookies and browser storage

The app uses local browser storage for sign-in tokens, cookie preferences, and interface choices. Essential storage is required for sign-in and requested service functions. Clearing it may sign you out. Security services or a configured CAPTCHA may also use information needed to protect requests.

No optional analytics scripts are currently installed. The cookie-preference control records your choice, its date, and its revision in this browser. Optional analytics remain disabled without permission. Use Cookie preferences in either footer to change or withdraw your choice at any time. Choices apply per browser, not automatically across your devices.

8. Your data-protection rights

Where applicable law provides them, you can request access, correction, erasure, restriction of processing, objection to processing based on legitimate interests, and a portable copy of data. These rights have conditions and exceptions; they are not waived by using TitleReel. You can withdraw consent for consent-based processing without affecting earlier lawful processing.

Account → Privacy & data offers a downloadable JSON export and a request form. The export includes account and creation records, designs, activity, billing records, support requests, API-key metadata, integration settings, and Magic Room data. Passwords, credential secrets, and other people’s private information are excluded. Media binaries are downloaded separately from the Gallery; contact us if you need additional data or another accessible format.

Submitted requests appear in Support with a reference and initial response due date. We respond without undue delay and normally within one calendar month. If a permitted extension is necessary because of complexity or the number of requests, we will explain it within that first month. We may request proportionate identity verification. Requests are normally free; any lawful exception will be explained.

You may lodge a complaint with the data-protection authority in your place of residence or work, or where an alleged infringement occurred. You do not have to contact us first.

9. Security and automated processing

Controls include password hashing, encrypted integration credentials, authenticated access, permissions, transport security, and operational backups. No system can eliminate every security risk. Keep credentials private and use available two-factor authentication.

The service automates extraction, media rendering, abuse controls, and account limits. Magic Room generates suggestions for you to review. We do not use those creative suggestions to make decisions about you with legal or similarly significant effects. Contact us to query an account restriction.

10. Children

Accounts are intended for adults aged 18 and over. If you believe a child has supplied personal data without appropriate authority, contact us so we can investigate and take appropriate action.

11. Changes to this notice

The version and effective date identify this notice. Policy history keeps permanent links to every tracked revision starting with 1.0.1; earlier notices were not versioned. The /privacy address shows the current notice. We will provide further notice, and obtain fresh consent where required, for material changes in processing.