Privacy Policy

Version 1.0 · In force since November 6, 2026

The essentials

We keep only what is needed for your account, your computers, your connected Instagram accounts, publishing your reels and your payments.
Your reels are created by the pilot on your computer. The videos it uploads to be published are kept on our server only until they are published; if they don't go out, 24 hours after their time at most. Then they are deleted.
Your Instagram accounts: we keep their username, their identifier, the permission Instagram gives us to publish on your behalf and your reels' numbers, while they stay connected. You can withdraw that permission whenever you want: we delete it immediately.
Payments are handled by Stripe: we never see your card.
Our server is in Canada (OVHcloud), a country with an EU adequacy decision.
We do not sell your data or use it for advertising. Your Claude login details and what your Claude Code says to Anthropic never go through us.

1. Who processes your data

The controller is Adverter Group SLU, with tax ID L-719034-U and registered office at Fiter i Rosell 30, AD700 Escaldes-Engordany (Principality of Andorra). For any privacy matter, write to hola@reelsvirales.com.

2. What data we process, why and for how long

Data	Purpose	Legal basis	How long
Account: email, name (if you give it), language, time zone (your computer's, to tell you dates in your time), sign-up and last access dates, and account status	Identify you, provide the service and send you service notices	Contract (art. 6(1)(b) GDPR)	While the account exists; if you ask us to delete it, we delete it within one month at the latest, except what must be kept by law
Sign-in codes: email, an encrypted fingerprint of the code (never the code), expiry, attempts and the IP that requested it	Make sure only you get in and stop abuse	Contract and legitimate interest in security (art. 6(1)(f))	2 days; successful sign-ins (email and IP), 31 days, to recognise where you usually sign in from
Links to sign in without a code (those in some emails and those the pilot asks for): a fingerprint of the link, where it leads and its expiry	Let you sign in once without asking for a code	Contract	Up to 1 day after expiry
Computers: computer name, system, fingerprint of the machine identifier (never the identifier), fingerprint of its credential, pilot version, and dates of registration, last use and removal	Apply the computer limit, security and support	Contract and legitimate interest	While it is in your account; removed ones, 12 more months
Connecting a computer with a code: fingerprints of the codes, the computer's name, system and version, language and the IP it was requested from	Connect your computer to your account securely, and warn you if it was requested from another connection	Contract and legitimate interest	1 day
Web sessions: fingerprint of the credential, how you signed in (with a code or a link), IP and browser at sign-in, and dates	Keep you signed in and security	Contract and legitimate interest	Up to 30 days after expiry or sign-out
Connected Instagram accounts: the name and identifier of each account, the permissions you gave and the access key Instagram gives to publish on it, stored encrypted (Your Instagram data)	Publish on it the reels you approve	Contract	While it stays connected; when you disconnect it, remove the permission in Instagram, ask Meta to delete your data or delete your account, it is all deleted immediately
Reels to publish: the video and text your pilot uploads, with the account and the time they are published at	Publish them on your accounts	Contract	The video, until it is published; if it doesn't go out, 24 hours after its time at most (an upload that isn't finished, 24 hours after it started). When you disconnect the account, immediately
Publications: when each reel was published, on which account, its text, its link and its numbers on Instagram (views, likes and comments)	Apply your plan's limits, measure results and resolve incidents	Contract and legitimate interest	While that Instagram account stays connected; when you disconnect it, they are deleted immediately and all that remains, with nothing from Instagram, is that a reel was published from your account that day (for your plan's daily allowance), while your account exists
Deletion requests that reach us from Meta: the confirmation code, the identifier Meta gives us, how it is going and when	Tell you how your request is going and be able to prove we handled it	Legal obligation and legitimate interest	12 months
Payments: Stripe customer and subscription ids, plan and its price, status, period dates, code used, charges, refunds and disputes; the Stripe customer of each purchase (an account can have more than one if you buy without signing in)	Charge, invoice and handle cancellations, failed payments, refunds and disputes	Contract and legal obligation (art. 6(1)(c))	6 years from payment (the period the law sets for invoices)
Acceptances: version of the terms accepted, at sign-in and at payment; the request to start the service straight away, with its text, date, time, IP, browser and checkout session; withdrawals	Prove what you accepted and comply with consumer law	Legal obligation and legitimate interest	As long as the contract lasts plus the period to bring claims
Activity log: sign-ups, sign-ins and computers (with the IP), plan changes, payments and actions in our admin panel	Security, fraud prevention and resolving incidents and complaints	Legitimate interest	The IP, 12 months; the rest, same as payments
Web server logs: IP, date, address requested, response and browser	Security and operation	Legitimate interest	14 days
Website measurement (the sales page, the payment page and the welcome page): a random number for each visit, your truncated IP (without its last number; for IPv6, only its first 48 bits), your approximate location (country, region and city, worked out from your IP at that moment, without storing the full IP), your browser, your system and your device (with its brand and model if it says them), the size of your screen and window, your languages, your time zone, whether the screen is a touch screen, the connection type, where you came from and what you do on those pages (section 8)	Know how people reach the sales page and what they do on it and in the payment, to improve them	Legitimate interest (art. 6(1)(f))	90 days
Emails sent: recipient, subject, date and delivery result; if we ever cannot send them and keep them to hand them to you manually (like your sign-in code), also their text	Make sure they reach you and fix delivery problems	Contract	As long as our mail server's log keeps them, which renews itself as it fills up; the stored text, 7 days
Support: what you write to us	Help you	Contract and legitimate interest	2 years from the last reply
News (only if you ask for it): email	Send you news and offers	Consent (art. 6(1)(a))	Until you withdraw it

Other people's data. The reels you publish may show other people or their data: you are responsible for having their permission (see the Terms, §14). If you manage clients' accounts as a business, tell us if you need a data processing agreement.

3. What we do not collect

Your Instagram password: you connect your accounts with Instagram's official login.
The videos of your reels once published (or when they can no longer go out): they are deleted from our server (the published ones stay on Instagram).
Your card: Stripe has it.
Your Claude login details or what your Claude Code says to Anthropic.
No third-party analytics tools or advertising, in the pilot or on the website: what we measure on the website we measure ourselves, without cookies and without storing your full IP (section 8). We do not build profiles or sell data.

4. Where your data comes from

From you (your email and what you write to us), from the pilot (your computers, their version, their time zone and the reels it uploads), from Instagram when you connect an account (its name, its identifier, the key to publish and, later, your reels' numbers), from your browser when you visit the sales page and the payment page (what it says about itself and the approximate location we work out from your IP: section 8) and from Stripe (the status of your payments, refunds and disputes, and your card's fingerprint).

4a. Your Instagram data

When you connect an Instagram account with its official login (from Meta), this is what we keep and why:

What we keep: the access key Instagram gives us to publish on your behalf, encrypted; the account's identifier, its name and the permissions you gave us; the reels waiting to be published (their video and text, and their cover if your pilot uploads one) until they go out; and the reels we publish on it with their numbers (views, reach, likes, comments, saves, shares and watch time, which we read during the 7 days after publishing them). If your pilot asks for them, we also read the numbers of that account's latest reels that we didn't publish, so it can learn from them: we pass them to your pilot and don't keep them in our database (only for a few hours in the server's memory, so as not to ask Instagram all the time). We never see or keep your Instagram password.
How Instagram downloads your videos: we serve each video (and its cover) at an address that can't be guessed, which stops working as soon as the reel goes out (or, if it doesn't go out, 24 hours after its time); then we delete it.
What for: to publish on that account what you approve, up to what your plan allows, and to measure its results and show them to you. We don't use it for anything else, we don't build profiles and we don't sell it.
How to delete it: disconnect the account in your client area; or remove the permission in Instagram (Settings → Apps and websites); or ask us by email at hola@reelsvirales.com. If you remove it in Instagram, Meta lets us know through its two calls (/api/meta/desautorizar, when you remove the permission, and /api/meta/borrado, when you ask for your data to be deleted) and we delete it all the same. If you ask Meta for the deletion, we give you a code to see how your request is going on our page /borrado/<code>.
How long it takes: immediately when you disconnect the account or Meta's notice reaches us: the access key, the reels waiting to be published (with their videos) and the name, the identifier and the texts, links and numbers of its reels (from then on we publish nothing else on it). All that remains, with nothing from Instagram, is that a reel was published from your account that day, for your plan's daily allowance. If you ask us by email, we reply within a month at most (section 11). Reels already published stay on Instagram: to remove them, delete them in Instagram.

5. Who we share it with

Who	What for	Where	Role
OVHcloud	Hosts the server, the database, the daily backups, the reels waiting to be published and the email we send you	Canada (Beauharnois, Quebec)	Processor
Stripe (in the EU, Stripe Payments Europe, Limited, Ireland)	Payments, invoices, customer portal and fraud prevention	EU and USA	Processor for payments; separate controller for fraud and its legal obligations
Meta Platforms (Instagram; in the EU, Meta Platforms Ireland Limited)	Publish on your Instagram accounts the reels you prepare, with its official API	EU and USA	Separate controller: what is published stays on Instagram, under its terms and its privacy policy
Accountants and tax advisers	Invoices and tax obligations	Principality of Andorra	Processor
Authorities and courts	When the law requires it	—	—

No one else. We never sell or hand over your data for advertising. Anthropic is not a provider of ours: what your Claude Code says to Anthropic stays between you and Anthropic.

6. International transfers

Canada: our server is in an OVHcloud data centre in Beauharnois (Quebec). Canada has an adequacy decision from the European Commission (Decision 2002/2/EC, for organisations subject to the federal PIPEDA law), which the Commission confirmed in its review of 15 January 2024.
United States (Stripe and Meta): under the EU-US Data Privacy Framework or standard contractual clauses.

7. What does not go through us

The pilot works on your computer and talks directly, without going through our server, with:

Claude Code (Anthropic): what Claude reads and writes while it creates your reels reaches Anthropic through your Claude account and is handled according to your terms and privacy settings with Anthropic.
The video platforms where the pilot looks for what works in your niche: it looks at them from your computer, as your browser would.
Downloads of programs and components, when installing and updating.

They are responsible for that data.

8. Cookies and data on your device

Website: we use the __Host-sesion session cookie, which is technical and needed to keep you signed in (30 days; 1 day for admin accounts). When you subscribe from the sales page, the __Host-compra cookie (2 hours) links your browser to your payment so that, when you come back from Stripe, you go into your new account. Both are technical and necessary. We do not use analytics or advertising cookies, so we do not ask for cookie consent.
Affiliate links: if you arrive through the link of someone who recommends us (an affiliate), we store the __Host-ref cookie in your browser for 60 days: it only holds a signed reference to that click, so that we know who gets the commission if you subscribe. It is ours (no other website reads it), it is not used to follow you across other websites or for advertising, and we do not store your IP address for the click (only a code for that day which, from the next day, can no longer be linked to you). We consider it necessary for the affiliate programme requested by the person who recommended you, which is why we do not ask for your consent for it. Affiliates who sign in to their portal also use the __Host-afiliado session cookie (30 days).
Payment page: it is on our website, but the payment form is Stripe's: Stripe.js, loaded from js.stripe.com ONLY on that page (not on the rest of the website). To prevent fraud, Stripe sets its __stripe_mid (1 year) and __stripe_sid (30 minutes) cookies there, and others on its own domains, and collects data about your device and browser, under its privacy policy; if you pay with Link, Link's too. They are needed to pay safely, which is why we do not ask for your consent for them.
Visits to the sales page: we count them on our server without cookies or personal data: only how many visits there were each day on each page and language, and where they came from (the link's campaign or the site's name, without its page). In these counts we do not store your IP or anything that identifies you, and we use no third-party analytics tools.
Website measurement: to know how people reach the sales page, which sections they see and at which payment step they stop, we measure visits to the sales page, the payment page and the welcome page with a system of our own: without cookies and without storing anything in your browser. Each visit carries a random number that is only valid for that visit: it does not follow you from one visit to another. We keep your truncated IP (without its last number; for IPv6, only its first 48 bits: the network you come from, not your connection); your approximate location (country, region and city), which we work out from your IP at that moment with a database that is on our own server (your IP does not leave it and the full IP is not stored); your browser, your system and your device, with its brand and model if it says them (to refine them, the page asks your browser for its “Client Hints”); the size of your screen and window, your languages, your time zone, whether the screen is a touch screen and the connection type (if your browser says it); where you came from (the link's campaign or code, or the site's name); and which sections you see and how far into the payment you get. We do not use fingerprinting (no hidden drawings, no reading your fonts) or anything that recognises you from one visit to another. We do it on the basis of our legitimate interest in knowing how the sales page works and improving it, and it is deleted after 90 days. The location comes from IP Geolocation by DB-IP (CC BY 4.0 licence). If you create an account or subscribe, your account and your purchase also keep the campaign of the link you arrived through (in your account, only the first one).
Pilot: it stores that computer's credential on your computer so it does not ask you for a code every time.

9. Automated decisions

We do not make solely automated decisions that significantly affect you, with two exceptions that are part of the service: with a failed payment, the server does not publish new reels or let the pilot work; and if you open a dispute with your bank, your account is paused automatically while it is resolved and we stop charging you: your plan's cancellation is scheduled for the end of the month (or is immediate, if you had a pending payment). In both cases you can write to us and a person will review your case.

10. Security

Everything travels encrypted (HTTPS), including what the pilot uploads. To connect a new computer to your account you have to sign in with a code. Codes and credentials are only stored as encrypted fingerprints. The database is not open to the internet and only those who need it can access it. We make a daily copy of the database, which can only be read with administrator access. If there were a security breach affecting you, we would tell you as the law requires.

11. Your rights

You can ask to access your data, correct it, delete it, restrict its use, take it with you (portability) or object to its processing, and withdraw at any time any consent you have given us. Write to us at hola@reelsvirales.com for any of them, including to download your data or delete your account, and we will do it for you. We reply within one month at the latest.

When you delete the account, we cancel your plan on the spot, disconnect your Instagram accounts, remove your computers, delete the reels waiting to be published and your data, except what the law requires us to keep (invoices and payments), which we keep blocked until that period ends. What is left of the paid month is lost: before you confirm the deletion, we tell you.

If you think we have not handled your data properly, you can complain to the Andorran Data Protection Agency (www.apda.ad) or the data protection authority of your country or to the data protection authority of your country (in Spain, the Agencia Española de Protección de Datos).

12. Minors

Reels Virales en Automático is only for people aged 18 or over. If we learn that an account belongs to a minor, we delete it.

13. Changes to this policy

If we change something important, we will email you before it applies. The current version is always on this page, with its date.