When a business uses reelport.io for its own or its clients’ social media, it decides what is posted and whose data is in it; we process that data on its behalf. Article 28 GDPR requires a contract for that. This page summarises its terms; the signed agreement is available on request.
Who is who
- Controller: the customer, meaning the team that holds the subscription, represented by its owner.
- Processor: Pixel & Process UG (haftungsbeschränkt), Marliring 74, 23566 Lübeck, Germany.
- For account, billing and website data we are a controller ourselves; that is covered by the privacy policy.
Subject matter
Storing videos, photos, captions and schedules for the customer’s team, keeping the access tokens of the channels it connects, and publishing posts to Instagram, Facebook Pages, TikTok and YouTube at the times the customer chooses, as described in the terms of service.
Data and people concerned
- Data: names and email addresses of team members; connected channel names, ids and access tokens; uploaded media and anything visible or audible in it; captions, hashtags, schedule times and publishing results.
- People: the customer’s team members, and anyone who appears in or is named in the customer’s content.
Duration
The agreement runs as long as the team uses reelport.io and ends with the subscription or the deletion of the team, whichever is later.
Instructions
We process the data only to provide the service and on the customer’s documented instructions, which are given through the settings and actions in the app (for example scheduling, editing or deleting a post). Everyone at Pixel & Process with access to production systems is bound to confidentiality.
Technical and organisational measures
- All traffic encrypted with TLS.
- Channel access tokens and two-factor secrets encrypted in the database; API tokens stored only as SHA-256 hashes.
- Media in a private bucket in the EU, never public; platforms receive the file or a signed link that expires after one hour.
- Every team’s data separated by access policies; roles owner, admin and member inside a team.
- Two-factor authentication and passkeys for every user.
- Production access limited to staff who need it.
More detail is on the security page.
Subprocessors
The customer authorises the subprocessors listed on the subprocessors page. We tell customers before adding or replacing one, so they can object. Each subprocessor is bound by the same data protection obligations.
Support and audits
We help the customer answer data subject requests, report personal data breaches to the customer without undue delay, assist with data protection impact assessments where needed, and provide the information necessary to demonstrate compliance with Article 28.
Deletion and return
Media files are deleted automatically 30 days after their last post. When the customer deletes a channel, its tokens are deleted at once; when it deletes its team or account, the team’s data is deleted, except where the law requires us to keep it (for example invoices). How to delete each part yourself is on the data deletion page.
A signed copy
For a signed data processing agreement, write to privacy@reelport.io with your company name and address and the reelport.io team it covers.