Reels Engine Privacy Policy

1. Who is responsible

Reels Engine is provided by The Wavee Media Ltd, a company registered in England and Wales under company number 16605667, with its registered office at Westgate House, Harlow, CM20 1YS ("The Wavee Media"). The Wavee Media is the controller of the personal data described in this policy.

Contact for any privacy question or request: info@thewaveemedia.com

2. The short version

• -Only the information needed to provide the service is collected.
• -Footage and finished full-quality files are deleted 30 days after approval.
• -Account details are deleted 30 days after a plan ends.
• -Advertising cookies run only after consent is given.
• -Personal data is never sold.

3. What is collected and why

Account details: full name, business name, email address and, if provided, a phone number. Used to create and run the account, send service emails and provide support. Lawful basis: performance of a contract.

Payment details: handled by Stripe. Card numbers are never seen or stored by The Wavee Media. A record of payments, invoices and the plan bought is kept. Lawful basis: performance of a contract and legal obligation (tax and accounting records).

Footage, brand kits and briefs: video, audio, images, logos, brand details, written briefs and reference material supplied by the Client, which may include images or voices of people. Used only to produce the Reels and provide the service. The Client confirms they have permission for everyone who appears (Terms of Service, section 8). Lawful basis: performance of a contract.

Messages, review notes and call bookings: messages and notes sent through the dashboard, and booked strategy or discovery calls. Used to deliver the service, resolve questions and keep a record of what was agreed. Lawful basis: performance of a contract and legitimate interests (resolving disputes).

Service records: what was delivered and approved and when, review rounds used, and acceptance of the Terms of Service. Lawful basis: legitimate interests (evidence of service) and legal obligation.

Time zone: detected from the browser so that dates and times show correctly. Lawful basis: legitimate interests.

Website and advertising data: campaign information from the link used to reach the website (for example the advert or campaign name) and, only if advertising cookies are accepted, the Meta and TikTok pixels and related identifiers (such as click identifiers, IP address and browser details), used to measure which adverts lead to a purchase. Lawful basis: consent, which can be withdrawn at any time through the cookie settings.

Security records: sign-in records, two-factor authentication for staff, and a log of blocked attempts to share contact details through the dashboard. Lawful basis: legitimate interests (keeping accounts and the service secure).

Fraud prevention: where a plan ends after a payment dispute or a serious breach of the Terms of Service, a protected, non-readable (hashed) record of the email address may be kept so the account cannot be reopened. Lawful basis: legitimate interests (preventing fraud).

4. Cookies

Essential cookies keep sign-in and checkout working and cannot be switched off. Advertising cookies (Meta and TikTok) load only after "Accept" is chosen on the cookie banner. The choice is remembered for 6 months and can be changed at any time. No analytics or tracking runs inside the client dashboard or the editor portal.

5. Who the data is shared with

Personal data is shared only with the service providers needed to run Reels Engine, under contracts that protect it:

• -Supabase: account database and sign-in (stored in the UK or EU)
• -Vercel: website hosting
• -Cloudflare R2: storage of footage and finished files (stored in Western Europe)
• -Mux: video previews for review
• -Stripe: payments
• -Resend: service emails
• -Google: calendar bookings and video call links
• -Meta and TikTok: advert measurement, only with consent

Editing is carried out by The Wavee Media's production team. Some editors work from Nigeria. Editors see only what is needed to edit: a client code instead of the business name, the brief and brand kit, and the footage for the batches assigned to them. They never see email addresses, phone numbers or payment details, and their access ends when the batch is approved.

Personal data is never sold, and is shared with others only where the law requires it.

6. International transfers

Some providers and editors are outside the UK. Where personal data is transferred outside the UK, it is protected by appropriate safeguards recognised by UK law, such as the UK International Data Transfer Agreement or Addendum, or the UK-US data bridge where a provider is certified under it.

7. How long data is kept

• -Raw footage: 30 days after the batch it was used for is approved
• -Full-quality finished Reels: 30 days after approval, with a reminder 7 days before deletion
• -A reduced-quality portfolio copy of finished Reels: kept, as set out in the Terms of Service, section 8.4
• -Brand kits, briefs and their files: 30 days after the plan ends, or up to 6 months if the Client chooses "Keep my brand kit" when cancelling
• -Messages and review notes: 6 months after the end of the billing month they relate to
• -Account details: 30 days after the plan ends
• -Advertising identifiers: cleared as soon as a purchase is reported, or after 30 days if there is no purchase
• -Blocked attempt logs and email logs: 30 days
• -Payment and invoice records, terms acceptance and service records (with no footage or Reels): 6 years, as required for tax and legal purposes
• -Hashed fraud prevention record: 6 years

8. Your rights

Under UK data protection law, the right is held to: access personal data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, and withdraw consent at any time where consent is the basis. To use any of these rights, email info@thewaveemedia.com. A response is given within one month.

If there is a concern about how personal data is handled, please get in touch first. A complaint can also be made to the Information Commissioner's Office (ico.org.uk).

9. Security

Data is encrypted in transit, access is limited to the people who need it, staff accounts require two-factor authentication, and file access links expire after a short time.

10. Changes

This policy may be updated from time to time. Material changes are notified by email to active clients. The version and effective date are shown at the top of this page.