reelsdk privacy policy: what the video rendering API stores, where it lives and for how long. Files deleted after 7 days, keys kept as hashes

What reelsdk stores, where it is stored and how long it is kept
What	Where	Kept for
Files you upload, inputs we fetch and the videos we render	Where: Cloudflare R2, Western Europe	Kept for: 7 days, then deleted
Job records: your request, timings, usage, errors, country, network and user agent	Where: Postgres on OVHcloud, Frankfurt	Kept for: Until you ask us to delete them
Voiceover text, captions prompts and the text of finished shorts	Where: Cloudflare Durable Objects	Kept for: Until you ask us to delete them
Your account: name, email address, balance and top-ups	Where: Postgres on OVHcloud, Frankfurt	Kept for: Until you ask us to delete it
API key hash and the first 12 characters of the key	Where: Postgres on OVHcloud, Frankfurt	Kept for: Until the key is deleted
Service logs	Where: Cloudflare Workers Logs	Kept for: Up to 7 days
Email with us	Where: Google Workspace	Kept for: As long as we need it for support and our records

01Who we are

reelsdk is run by Bitgate, Inc. ("Bitgate", "we"), Ericssonstraat 2, 5121 ML Rijen, the Netherlands. We are the controller for the personal data in this policy, and because we're based in the Netherlands, the GDPR applies to what we do.

Questions about your data or how the API handles it go to kevin@bitgate.com.

02What this policy covers

This policy covers the reelsdk API at api.reelsdk.com and this website. For Bitgate's other products, see the Bitgate privacy policy.

If your app sends your own users' photos, videos, audio or text to reelsdk, you decide what to send. We process that content only to run your jobs and give you the results.

03What we collect

You sign in to the dashboard with Google and call the API with an API key, so almost everything we hold is tied to your account, your keys and your jobs.

Your account

When you sign in with Google, Google's sign-in service (Firebase Authentication) tells us your name and email address. We keep them with your account, together with your credit balance and top-ups. We never see your Google password.

Payments

Top-ups are paid on Stripe, which sells the credit to you as merchant of record and adds any tax. Your card details go to Stripe and never reach us. We keep the amount and status of each top-up.

Your API key

We generate your key and show it to you once. We never store the full key: we keep a SHA-256 hash of it and its first 12 characters (rk_live_ plus 4), so we can tell keys apart.

Next to the hash we store the label you give the key, your webhook signing secret (kept readable, because we need it to sign your webhooks), when the key was created and last used, whether it is disabled, and any limits set on it.

Jobs you run

Every job gets a record in our database with:

the request you sent, such as input URLs, render settings, ffmpeg arguments and, for shorts, the topic or script
its status, timestamps and how long each step took
file sizes, usage and the output links
error codes and details, which can include part of the ffmpeg log when a job fails
your webhook URL and how each delivery went
request details Cloudflare gives us: country, network (ASN), the Cloudflare data centers that received and ran the job, and your User-Agent header, cut to 300 characters

Some job content is kept only in the job's own storage on Cloudflare Durable Objects, not in the database: the voiceover text you send, the captions prompt, and the text of a finished short (title, post caption and narration).

Your files

Files you upload, inputs we fetch or make while running a job (such as a voiceover track or the images for a short), and the videos and subtitle files we render are stored in Cloudflare R2. They are deleted automatically 7 days after they are created.

Until then, their links are public but unguessable: anyone who has a link can open the file. Treat links like passwords and share them only where the video may be seen.

Fetching your inputs

Our render machines download the input URLs you give us with the User-Agent reelapi-engine, and refuse addresses on private and internal networks.

AI models

Voiceovers, transcripts and shorts are processed by AI models on Cloudflare Workers AI: Whisper for transcription, Deepgram Aura-2 and MeloTTS for voices, Gemma 4 and Qwen3 for writing shorts scripts, and FLUX.2 klein for the images in shorts.

Email and logs

Our email runs on Google Workspace, so Google stores the messages you send us.

Our services write logs to Cloudflare Workers Logs, which keeps them for up to 7 days. Besides what our code writes, such as job IDs, job types, timings and error details, these logs hold request details that Cloudflare records, which can include your IP address. Logs are also passed to an internal log service of ours that runs on Cloudflare.

04This website

This site loads no analytics or ad scripts, and its fonts and videos are served from our own domain. Its only cookie is reelapi_session, which the dashboard sets when you sign in to keep you signed in. Scripts can't read it, and signing out ends the session. The sign-in page loads Google's sign-in scripts to open the Google window. Cloudflare delivers the pages, so it processes your request to send them to your browser.

05What we don't collect

No passwords, and no tracking or advertising cookies.
No IP addresses stored with your jobs. Your IP address is used to slow down repeated failed key checks (30 a minute), and it can appear in our logs for up to 7 days.
No selling your data, no sharing it for advertising, and no training AI models on your content.

06Why we use it

We use this data to run your account and the jobs you ask for, which is needed to perform our agreement with you. We also use it to keep reelsdk secure, stop abuse and fix problems, which is our legitimate interest in running a reliable service.

07Who processes it for us

Cloudflare, Inc. runs the API and this site: Workers, Durable Objects, R2, Containers, Workers AI, Hyperdrive, rate limiting and Workers Logs.
OVHcloud hosts our Postgres database in Frankfurt, Germany.
Google provides our email through Google Workspace and dashboard sign-in through Firebase Authentication.
Stripe sells top-ups as merchant of record and handles the payment.

08Where it's stored

Files are stored in Cloudflare R2 in Western Europe, and job records and key hashes on our Postgres server in Frankfurt, Germany. Cloudflare handles each request in a data center near the caller and runs jobs and AI models on its own network, so your data can pass through Cloudflare data centers in other countries.

09How we protect it

The API and this site are served over HTTPS. Always call https://api.reelsdk.com.
Keys are stored only as SHA-256 hashes.
Webhooks are signed with HMAC-SHA256 using your key's signing secret, so you can check they came from us.
Every job runs on a fresh machine of its own, and raw ffmpeg commands can only read and write inside the job's folder.

10Your rights

Under the GDPR you can ask to see, correct or delete your personal data, to restrict or object to how we use it, and to get a copy in a portable format. Email kevin@bitgate.com, for example to have your job records deleted, and we'll reply within one month.

You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

11Changes to this policy

When we change how reelsdk handles data, we update this page and the date at the top.

12Contact

Bitgate, Inc.
Ericssonstraat 2, 5121 ML Rijen, the Netherlands
kevin@bitgate.com

How reelsdk handles your data