Privacy Policy
Information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
AudioReel website and platform · Last updated: 12 October 2026
This policy covers the AudioReel website and the platform where you upload your content and manage your subscription.
1. Who processes your data
Audio Bottega S.r.l.
Registered office: Via Stresa 6, Milan (Italy)
VAT and tax code: 13617280964
Email for privacy matters: hello@audioreel.app
We have not appointed a Data Protection Officer: the conditions of Art. 37 GDPR do not apply.
2. What data we process
Account data
First name, last name, company name if any, email address. We do not store the password in plain text: it is kept by our authentication provider as an irreversible cryptographic hash.
Content you upload
Video and audio files, isolated tracks and written indications (briefs, revision requests, messages). They may contain personal data of third parties — voices, faces, names — for which you are the controller: by uploading them you appoint us as processor for the audio processing only, and you warrant that you have the right to use them.
How it is processed
Processing is automatic, with no person working on the individual piece of content. To carry it out we transcribe the voice on our systems, extract some frames from the video, send the voice to Cleanvoice to clean it, and send frames, transcription and your indications to Anthropic, whose Claude model decides the music cuts and sound design according to our rules. None of these providers may use your content to train their models. Processing does not produce decisions with legal effects on you or on the people filmed (Art. 22 GDPR).
Our team may look at delivered work to check its quality and note how to improve it: those notes become general rules of the service, which contain no images, voices, names or text from your content.
Billing and payment data
Company name, address, tax code, VAT number, SDI code, PEC, and the history of credits, transactions and invoices. Card details never pass through our systems: Stripe collects and stores them directly on its own payment pages. We only see the outcome, the amount and the last four digits.
Usage data
Date and time of access, technical error logs generated by our hosting providers, the processing status of your content. They are needed to run the service and to work out what happened when something goes wrong.
We do not process special categories of data (Art. 9 GDPR) and do not ask you for them.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, providing audio post-production, delivering the files | Performance of the contract (Art. 6(1)(b)) |
| Managing subscriptions, credits, payments and refunds | Performance of the contract (Art. 6(1)(b)) |
| Issuing and keeping invoices and accounting records | Legal obligation (Art. 6(1)(c)) — Art. 2220 of the Italian Civil Code and tax law |
| Sending service emails: delivery, revision, receipts, password recovery | Performance of the contract (Art. 6(1)(b)) |
| System security, preventing abuse of the free trial | Legitimate interest (Art. 6(1)(f)) in protecting the service |
| News and offers | Consent (Art. 6(1)(a)), which you can withdraw from your profile, Notifications section |
| Measuring the effectiveness of advertising | Consent (Art. 6(1)(a)), which you can withdraw from the banner |
| Defending a right in court | Legitimate interest (Art. 6(1)(f)) |
4. How long we keep it
| Data | Period |
|---|---|
| Uploaded and delivered files | 30 days after delivery, then deleted automatically from storage |
| Working copies, frames and voice transcriptions | 30 days after delivery, together with the files. Only the technical mix plan remains, without transcriptions or images |
| Data sent to Anthropic and Cleanvoice for processing | According to the providers' terms: normally deleted within 30 days, except in cases of abuse or legal obligations under their policies. Never used to train their models |
| Account and personal details | As long as the account remains active |
| Transactions, invoices and accounting records | 10 years, as required by law — they remain after the account is closed |
| Support requests and messages | 24 months after closure |
| Technical and access logs | Up to 12 months |
5. What happens if you delete your account
You can delete your account yourself from your profile. When you do: access is closed immediately and permanently, any subscription is cancelled at once, and all uploaded and delivered files are deleted from storage.
Only transactions and invoices remain, which the law requires us to keep for ten years and which we cannot delete on request: this is the exception provided by Art. 17(3)(b) GDPR. They remain linked to a profile that no longer has access to anything.
6. Who processes data on our behalf
They are processors (Art. 28 GDPR), contractually bound to process data only according to our instructions.
| Provider | What it does | Where the data is |
|---|---|---|
| Supabase Inc. | Database and authentication | Database in Ireland (EU); possible remote access from the United States for technical support, covered by Standard Contractual Clauses |
| Cloudflare Inc. | Storage of uploaded and delivered files | Storage in the European Union; Cloudflare Inc. is based in the United States and the transfer is covered by Standard Contractual Clauses |
| Vercel Inc. | Application hosting, logs and visit statistics (Vercel Web Analytics: no cookies, no persistent identifiers, aggregated data) | United States / global network |
| Hetzner Online GmbH | Servers running the automatic processing (working copies of the files) | Germany (EU) |
| Anthropic, PBC | Claude model: receives frames, voice transcription and indications to plan the mix | United States |
| Sigmoid Creativity SRL (Cleanvoice) | Voice cleaning | Romania (EU) |
| Stripe Payments Europe Ltd. | Payments, subscriptions and receipts | Ireland / United States |
| Resend Inc. | Sending service emails | United States |
| Meta Platforms Ireland Ltd. | Ad measurement, only with your consent | Ireland / United States |
Within our team, your files are accessed only by the people who check their quality or provide you with support. We do not use them for purposes other than processing, except for the promotional publication described below, which happens only with your consent. We do not transfer them to third parties and we do not use them, nor let our providers use them, to train artificial intelligence models.
Publishing content for promotional purposes. Some processed content may be published on our website, our social pages or dedicated demonstration pages, together with the client's name or brand. This happens only if you have given us written consent specific to that content, and only after you have confirmed that you hold a release from the people filmed or recorded. You can withdraw consent at any time by writing to hello@audioreel.app: we remove the content from our pages within five working days. Legal basis: your consent (Art. 6(1)(a) GDPR).
7. Transfers outside the European Union
The database holding your account data is in Ireland. Some providers, however, are based in or have infrastructure in the United States: in those cases the transfer is based on the EU–US adequacy decision (EU-U.S. Data Privacy Framework) where the provider participates, or on the Standard Contractual Clauses adopted by the European Commission. You can ask us for a copy of the safeguards adopted.
8. Security
Traffic is encrypted in transit (HTTPS). Files are accessed through temporary signed, unguessable links that expire after 15 minutes at most. Passwords are stored as cryptographic hashes. Administrative access to data is limited to the people who need it for their work. The processing server communicates with storage and providers only over encrypted connections.
9. Your rights
At any time you can ask us to:
- access the data concerning you and receive a copy (Art. 15);
- correct it if it is inaccurate or incomplete (Art. 16);
- erase it, within the limits of tax retention obligations (Art. 17);
- restrict its processing (Art. 18);
- receive it in a machine-readable format or have it transferred to another controller (Art. 20);
- object to processing based on our legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before.
Many things you can do yourself from your profile: correct your data, turn off non-essential emails, delete your account. For anything else write to hello@audioreel.app: we reply within one month, extendable by two months in complex cases.
10. Complaints to the authority
If you believe the processing infringes the GDPR you can lodge a complaint with the Italian Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or with the authority of the country where you live, without prejudice to judicial remedies.
11. Providing data
Account and billing data are necessary to activate the service: without them we cannot provide it or issue invoices. Optional data (company name, marketing consents) do not affect access to the service.
12. Minors
The service is aimed at professionals and businesses and is not intended for people under 18. We do not knowingly collect data from minors.
13. Changes
If we change tools or purposes we update this page and the date at the top, and we let you know by email when the changes are significant.