RRefilmer
Sign in

Privacy policy

This policy explains which personal data we process when operating Refilmer (the "service"), for which purposes and on which legal basis. It applies to the website refilmer.com and the application available under it.

1. Controller

Gutruhn Hesener
Kreuzbergstraße 81e
57399 Kirchhundem
Deutschland
E-mail: [email protected]

2. What we process

2.1 Visiting the website

When you open the website, our server and the upstream service Cloudflare (see section 5) automatically process your IP address, date and time, requested page, referrer, browser type and operating system. These data are kept in server logs for at most 14 days to keep the service running and to fend off attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

2.2 Cookies

We only use strictly necessary cookies: a sign-in cookie (session), an anti-forgery cookie and a cookie for your chosen language (one year). There are no tracking or advertising cookies and no analytics services. Legal basis: § 25(2) no. 2 TDDDG together with Art. 6(1)(b) and (f) GDPR.

2.3 User account

Accounts are created by us or by the administrator of a customer workspace. We store username, display name, password (hash only), an optional e-mail address for notifications, sign-in times, role and workspace assignment. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.4 Content you upload and generate

The service processes the reference photos you upload (face and body shots) to build a digital character, the links you paste or videos you upload, your text input (prompts, wishes) and the videos, images, captions and hashtags generated from them. Photos of people are biometric data within the meaning of Art. 9 GDPR insofar as they are used to create a recognisable figure. Processing is based on your explicit consent (Art. 9(2)(a) GDPR), which you give by uploading. You confirm that you are entitled to upload the photos and, where other people are shown, that their consent has been obtained. Content is stored until you delete it or the account ends; working files of failed or discarded jobs are deleted immediately.

2.5 Processing by AI providers

To generate videos and images we transmit your reference photos, the reference video and the prompt to a specialised provider of AI video generation. To write prompts, captions and hashtags automatically we transmit frame extracts (still images) of the reference video and text to a provider of large language models. Both providers process the data on our behalf and solely to deliver the requested result; they may be located outside the European Economic Area (in particular in the USA). Transfers rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) or on an adequacy decision where one exists. We name the providers currently in use on request at the e-mail address above.

2.6 Public social media data

For the statistics and viral features we fetch and store publicly available profile and post data (followers, views, likes, comments, captions, thumbnails) of the Instagram, TikTok and YouTube accounts you enter. This may involve personal data of third parties (account holders). Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the evaluation of public reach metrics for our customers. Only data the platforms make available without signing in is processed. Data of accounts you remove from the service is deleted.

2.7 E-mail notifications

If an e-mail address is stored for your account, we send you notices about finished or failed jobs and clips that were found. You can stop these at any time by having the address removed. Legal basis: Art. 6(1)(b) GDPR.

2.8 Contact

When you contact us by e-mail or Telegram we process the data you provide to handle your request (Art. 6(1)(b) and (f) GDPR). For Telegram, the privacy policy of Telegram FZ-LLC additionally applies.

3. Recipients and processors

  • Hosting: our hosting provider, server location Deutschland.
  • Cloudflare, Inc. (network security, DNS and delivery), see section 5.
  • AI providers for video and image generation and for language models, see section 2.5.
  • An e-mail delivery service for notifications, where enabled.

Contracts under Art. 28 GDPR are in place with all processors. Data is only passed to other third parties where we are legally obliged to do so.

4. Retention

Account data is kept for the duration of the contract and deleted no later than 30 days after it ends, unless statutory retention duties apply. Uploaded and generated content is deleted when you remove it, at the latest with the account. Server logs are deleted after 14 days. Statistics data of removed social media accounts is deleted immediately.

5. Cloudflare

We use the content delivery and security network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. All requests pass through Cloudflare's servers, which process IP address and request data to block attacks and deliver content quickly. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Legal basis: Art. 6(1)(f) GDPR.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future. Contact [email protected] for any of these. You also have the right to lodge a complaint with a data protection supervisory authority, for instance the one responsible for our registered office.

7. Security

All transfers are encrypted (TLS). Passwords are stored only as salted hashes. Access to content is limited to the members of the respective workspace. Uploaded files are stored outside the publicly reachable part of the server and served only after sign-in.

8. No automated decision-making

The service makes no automated decisions with legal effect on you. Suggestions from the viral feature are recommendations without legal consequences.

9. Changes

We update this policy when the service or the law changes. The version published here applies.

Last updated: 2026-09-29