Privacy Policy – Reel2Plan
Last updated: 4 August 2026 · Applies to the Reel2Plan mobile app and website https://reel2plan.com
1. Controller
The controller under the GDPR is:
Wilken Technologies
Owner: Jim Wilken
Ringstraße 26
25924 Klanxbüll
Germany
Email: info@wilken-technologies.com
Phone: +49-176-46056062
No data protection officer is currently appointed. Please send privacy requests to the email above.
2. Overview
- We process personal data to provide Reel2Plan: account, converting videos into plans, subscriptions/coins, support and security.
- Product analytics only with your consent (opt-in) and is stored first-party with our hosting provider — not via external ad/analytics SDKs.
- We currently do not send marketing newsletters.
- We do not sell personal data.
- In-app account deletion is usually immediate and irreversible. Email/support deletion requests are usually handled within 30 days.
3. Purposes and legal bases
Legal bases under Art. 6(1) GDPR (and where applicable § 25 TDDDG for device access):
| Purpose | Data (examples) | Legal basis |
|---|---|---|
| Registration, login, account, MFA | Email, display name, auth IDs (Apple/Google), session tokens, MFA status | Art. 6(1)(b) |
| Profile photo (optional) | Uploaded avatar in object storage | Art. 6(1)(b) |
| Converting video URLs into plans | URL, metadata, transcript/captions, plans, progress, safety notes | Art. 6(1)(b) |
| Quotas, subscriptions, coin purchases | Entitlement status, coin balances, purchase receipts via Apple/RevenueCat | Art. 6(1)(b) |
| Support and troubleshooting | Contact content, technical logs, job/error codes | Art. 6(1)(b) or (f) |
| Security, abuse prevention, quotas | IP (short-term), device/app metadata, rate limits | Art. 6(1)(f) |
| Product analytics (opt-in) | Events (e.g. screen views), app version, platform — first-party | Art. 6(1)(a) |
| Push / Live Activities (optional) | Push token, device group, activity state | Art. 6(1)(a) or (b) |
| Maps / Explore (optional) | Location (device), geocoding/search requests to map services | Art. 6(1)(a) or (b); § 25 TDDDG |
| Health/workout export (optional, iOS) | Workout metadata written to Apple Health | Art. 6(1)(a); § 25 TDDDG |
| Website operation and security | Server logs (IP, time, URL, user agent) | Art. 6(1)(f) |
| Legal obligations | Billing/retention data where required by law | Art. 6(1)(c) |
Legitimate interests (f): operating and securing the service, preventing abuse, stability. You may object under Art. 21 GDPR where applicable.
4. Data sources
- Directly from you (inputs, settings, shared/pasted URLs, uploads)
- From authentication providers (Apple, Google) when you sign in with them
- From processors (hosting, transcription, AI, maps) used to deliver the contract
- From app stores / RevenueCat for subscription and purchase status
5. Core processing
5.1 Account and authentication
Core features require an account. Sessions are stored securely on device (Secure Store) and server-side. With Sign in with Apple / Google OAuth we only receive profile data the provider releases. Optional MFA (authenticator) is available.
5.2 Video content, transcripts and plans
To create plans we process the video URL you submit and derived metadata/transcripts. These may include personal data of third parties. You must only submit URLs you are entitled to use.
For cost and quality we store canonical transcript and plan caches for the same public video URL. Cache entries may be reused across users who submit the same URL. We do not build advertising profiles from cache content. Preview snippets are only shown when you already have your own job/plan link to that URL.
5.3 AI processing and safety
We use AI services (currently OpenAI) for plan structuring and conservative safety classification. Inputs may include transcript/metadata excerpts. Where contractually available we instruct the provider not to use data for its own model training. AI output is suggestive only — see our Terms.
5.4 Device features and permissions
- Clipboard (URL detection)
- Share extension
- Calendar and reminders (export/mirroring)
- Widgets and Live Activities
- Optional app lock (e.g. Face ID — biometric raw data stays on device)
- Location (Explore map), only with permission
- Camera / photo library (avatar)
- Apple Health (write workouts), only with permission
- Push notifications (APNs)
5.5 Analytics (opt-in)
Product analytics is off by default. With consent we store events in our own database (Supabase, EU/Frankfurt preferred). No external advertising/analytics SDK. You can withdraw consent at any time.
5.6 Marketing communications
We currently do not send marketing emails or newsletters. An in-app opt-in may exist for future use; without active sending and a fresh consent, no marketing is sent. If activated later we will update this policy and name the mail provider.
6. Recipients and processors
| Recipient | Role | Location / transfer |
|---|---|---|
| Supabase | Auth, DB, storage, edge functions, realtime, first-party analytics, auth email | EU (Frankfurt) preferred |
| Vercel | Website / auth web hosting | EU/US possible; safeguards |
| OpenAI | AI plan structuring and safety classification | US — SCCs / safeguards |
| Supadata | Video metadata and transcripts | Per provider; safeguards as needed |
| RevenueCat | Subscription/entitlement and coin purchase sync | US — SCCs / safeguards |
| Apple | Sign in with Apple, IAP, APNs, optional HealthKit, Apple Maps Server API | Platform terms; map queries to Apple |
| Google OAuth; optional map deep links on device | Platform terms |
For transfers outside the EEA we use appropriate safeguards such as EU Standard Contractual Clauses. Information on safeguards is available on request where trade secrets do not prevent disclosure.
7. Retention
- Account and plans: until account or content deletion
- In-app account deletion: usually immediate (unless legal retention applies)
- Email/support deletion requests: usually within 30 days
- Usage/quota events: up to 365 days
- Analytics events (opt-in only): up to 90 days
- Canonical transcript cache: up to 180 days
- Canonical plan cache: up to 90 days
- Website server logs: short-term for security
- Billing records: commercial/tax retention (up to 10 years)
8. Required data
An account and the video URLs you submit are required to provide the service. Optional permissions (location, health, camera, push) are not required for core conversion.
9. No automated decisions
We do not make solely automated decisions with legal effects under Art. 22 GDPR. AI produces plan suggestions and safety notes; you decide whether to use or execute them.
10. Security
We apply appropriate technical and organisational measures (Art. 32 GDPR), including TLS, access controls (including RLS), rate limits, separated environments and limited staff access. No online service can guarantee absolute security.
11. Cookies (website)
The marketing site currently uses only technically necessary storage for operation and security. We do not set tracking or marketing cookies. Details: Cookie notice.
12. Minors
Reel2Plan is intended for users aged 16+. We do not knowingly collect data from children under 16. Contact us to request deletion if you become aware of such processing.
13. Your rights
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction (Art. 18)
- Portability (Art. 20)
- Objection to Art. 6(1)(f) processing (Art. 21)
- Withdraw consent for the future (Art. 7(3))
- Lodge a complaint with a supervisory authority (Art. 77), e.g. ULD Schleswig-Holstein or your local authority
Delete account: App → Settings → Account → Delete account (usually immediate). Or email info@wilken-technologies.com with subject “Delete Reel2Plan” (usually within 30 days). Also see Support.
14. Changes
We update this policy when law, services or processing change. The current version is always at https://reel2plan.com/en/privacy. For material changes we inform you in the app or by email where required.
Privacy requests: info@wilken-technologies.com