Legal · Privacy
Privacy Policy
GetReelCom is a business tool: we collect little, we don't run ad tracking, and we never train AI models on your data. This policy explains what we do process, why, and what your rights are under the GDPR.
1. Who is responsible
Samba Intelligence Holding B.V. (trading as GetReelCom), registered with the Dutch Chamber of Commerce under number 96702761, Pelsakker 23, 4834 AG Breda, the Netherlands, is the party responsible for the processing described in this policy. Contact: [email protected].
2. Two roles: controller and processor
We process personal data in two distinct roles:
- As controller — for data about visitors to this website, account holders, and business contacts: everything in sections 3–8 below.
- As processor — for personal data inside the content our customers upload to the app (for example photos of their team members used to create a cast). There, the customer is the controller and we process only on their instructions. That processing is governed by our Data Processing Agreement, not by this policy. If you appear in a customer's content, contact that customer first; we will assist them in honouring your rights.
3. What we process as controller, and why
| Data | Purpose | Legal basis (art. 6 GDPR) |
|---|---|---|
| Account data: name, email address, and your Google or Microsoft account identifier depending on how you sign in; organisation name; the role, industry and company size you pick when you first sign in | Creating and securing your account, providing the Service, communicating about it; understanding which kinds of teams use GetReelCom and how, so we can improve it for them | Performance of a contract (6(1)(b)); legitimate interest (6(1)(f)) for understanding our users |
| Intake data: the website URL and email address you submit in the start form | Preparing your company profile (brand, products, audiences, venues, characters) and setting up your workspace, contacting you about it | Performance of a contract / pre-contractual steps (6(1)(b)) |
| Agency deck request: the name and email address you leave on the pricing page to download the agency deck | Giving you the deck and following up about the Agency plan; kept as a prospect in our CRM (Attio) | Legitimate interest (6(1)(f)): business-to-business sales follow-up on a deck you asked for; object at any time by replying or emailing us |
| Usage and billing data: plan, credit usage, generation counts, invoices and payment status | Billing, credit accounting, abuse prevention | Performance of a contract (6(1)(b)); legal obligation for invoices (6(1)(c)) |
| Technical data: IP address, browser type, timestamps, error and security logs | Keeping the Service available and secure, debugging, preventing abuse | Legitimate interest (6(1)(f)): running a secure service |
Usage statistics: the pages you visit on the website and in the app, the channel or campaign that brought you, a random visitor ID (reelco_anonymous_id), and, if you allow statistics cookies, the same in Google Analytics (Google Ireland Ltd, as our processor, advertising features off) | Understanding which channels bring visitors, where the start form loses people and which kinds of teams go on to use GetReelCom | Consent (6(1)(a)), asked in the cookie dialog; withdraw it at any time via Cookie settings |
| Correspondence: emails you send us, support requests | Answering you, improving the Service | Legitimate interest (6(1)(f)): responding to enquiries |
| Onboarding and product emails to account holders | Helping you get set up and informing you about the Service you use; every message beyond essential service notices includes an opt-out | Performance of a contract (6(1)(b)) for onboarding and service messages; legitimate interest (6(1)(f)) for product updates; consent where required |
| Marketing emails: product news and offers, only if you ticked the box when you signed in or in your settings | Telling you about new features, plans and offers | Consent (6(1)(a)); withdraw it at any time in the app's settings or with the unsubscribe link in every message — we record when you gave it |
We do not use personal data for automated decision-making with legal effect, and we do not sell personal data.
4. AI models and your data
Generations run on third-party AI models, engaged under paid API terms that prohibit the provider from using submitted content to train its models. We do not train AI models on your personal data or content, and we do not permit our providers to do so. The providers that may process personal data are listed on the subprocessor page.
5. Who receives data
We share personal data only with the service providers needed to run GetReelCom — hosting and content delivery, database and authentication, AI generation, web analytics (with your consent), customer relationship management for sales prospects, and (once billing launches) payment processing. The current list, including locations and safeguards, is maintained on the subprocessor page. We may further disclose data where the law requires it or to protect our rights.
6. International transfers
All hosting and storage — the application, database, authentication and file storage — runs in the European Union (Frankfurt, Germany and Paris, France). No personal data is stored outside the EEA. Two situations can still involve processing outside the EEA: some of our providers are established in the United States (so limited access, for example for support, may occur from there), and AI generation requests are processed through our AI provider's API. In those situations, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework, where the provider is certified) and/or the European Commission's Standard Contractual Clauses, with additional measures where needed.
7. Retention
We keep personal data no longer than needed for the purposes above. Deletion runs through periodic clean-ups against the following maximum periods:
- Account and content data: for as long as your account exists. When you close your account or ask us to delete your data (email [email protected]), we delete it within 30 days.
- Records of your acceptance of our Terms of Service (email address, version, time, IP address): up to 24 months after account deletion, so we can evidence the agreement (legitimate interest).
- Intake data without a resulting account: up to 12 months.
- Agency prospects (the deck form): up to 24 months after our last contact.
- Invoices and payment records: 7 years (Dutch tax law).
- Security and technical logs: up to 12 months.
- Correspondence: up to 24 months after the matter is closed.
Data in encrypted backups is overwritten in the normal backup cycle after deletion.
8. Security
We apply appropriate technical and organisational measures: encryption in transit, hosting with certified providers, access on a need-to-know basis, separated environments, and authentication via a dedicated identity provider. No system is perfectly secure; report vulnerabilities to [email protected].
9. Cookies
This website and the app use no advertising cookies. What we store in your browser falls into one of four categories, which the cookie dialog lists item by item under Details:
- Necessary — what the site and the app cannot run without: your cookie choice itself (
reelco_consent, kept 12 months), the storage that keeps you signed in, and the page you arrived on for the duration of your visit. These need no consent. - Preferences — small settings the app remembers for you, such as a folded side menu or a closed setup guide.
- Statistics — an anonymous visitor ID (
reelco_anonymous_id, 12 months) so we can tell which channels bring visitors and how they use GetReelCom, and Google Analytics (_gaand_ga_…, 2 years), which we use for the same questions. Google Ireland Ltd processes that data on our instructions; we have switched off its advertising features and Google Signals, keep reports for 14 months, and never send it the website address you enter or your email. Google may process data in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. Nothing under Statistics is shared with advertising networks. - Marketing — listed for completeness; we use none.
We ask before setting anything beyond the necessary category. If you deny, we set only the consent cookie itself so we do not ask again. One choice covers both getreelcom.com and app.getreelcom.com. You can change it at any time via Cookie settings in the footer of this website or in the account menu of the app; withdrawing statistics consent deletes the visitor ID and Google's cookies.
Separately from cookies, Cloudflare, which delivers the website, counts visits without cookies or any identifier stored in your browser: the count uses only the request itself and cannot be traced back to you.
10. Your rights
Under the GDPR you can ask us for access to, correction, deletion or restriction of your personal data, object to processing based on legitimate interest, and request data portability. Email [email protected]; we respond within one month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
11. Changes
We may update this policy, for example when we add providers or features. The date above shows the current version; material changes are announced by email or in the app.