Privacy Policy

This Privacy Policy explains what information CookieReel collects, how we use it, and the choices you have. We aim to collect only what we need to operate the Service.

1. Information we collect

• Account information: name, email, business name, social links, and edible-printer details you provide on the baker application form.
• Event and host data: event names, dates, host name and email, and any notes bakers add about clients.
• Guest video uploads: the video file, the guest's display name, and the time of upload. We do not require guests to register.
• Payment data: processed by Stripe. We store transaction identifiers but not full card numbers.
• Technical data: standard server logs (IP, user agent) for security and debugging.

2. How we use information

• To operate the Service (run events, deliver videos, send portal links).
• To process payments and prevent fraud.
• To send transactional emails (e.g., portal magic links, application decisions).
• To investigate and prevent abuse, and to comply with legal obligations.

3. Sharing

We share data with service providers strictly to operate the Service: Stripe (payments), Resend (email), Cloudflare R2 (video storage), and Supabase (database/auth). We do not sell personal information. We may disclose information when required by law or to protect rights, safety, or property — including reporting illegal content to law enforcement.

4. Retention

We retain account and event data while your account is active and for a reasonable period afterward to comply with legal and operational needs. Guest videos are retained for the duration of the host's event tier and may be deleted thereafter. We may retain records of policy violations indefinitely.

5. Security

We use industry-standard safeguards including encryption in transit, access controls, and row-level security on our database. No system is perfectly secure; we cannot guarantee against all unauthorized access.

6. Your choices

You may request access to or deletion of your account data by emailing us. Bakers can edit their profile and clients in the console. Hosts can request deletion of their event data through the baker who created the event.

7. Children

The Service is not directed to children under 13. We do not knowingly collect data from children. If you believe a child has uploaded a video, contact us and we will remove it.

8. International users

Our infrastructure is operated in the United States and other countries where our service providers operate. By using the Service you consent to the transfer of your data to these jurisdictions.

9. Contact

Privacy questions or requests: noreply@cookiereel.com.