Privacy Policy

This Privacy Policy explains how DriveReachAds LLC (“DriveReachAds,” “we,” “us”) collects, uses, shares, and protects information in connection with the CatalogReel service (the “Service”), including our API, console, and website.

CatalogReel is a business-to-business service. We provide it to companies and developers and do not direct it to consumers.

By using the Service, you agree to this Policy. It should be read together with our Terms of Service.

For data about your account and billing (for example, your name, email, and payment records), DriveReachAds acts as the controller.

For the content you submit through the API to generate videos (“Customer Content”) — including photos, catalog data, and any personal data they may contain — you are the controller and DriveReachAds acts as your processor, handling that content on your instructions to provide the Service.

If you serve your own customers through the Service, you are responsible for providing any required notices to, and obtaining any required consents from, your end users.

• Account & profile. Your name, email address, a hashed password (for password sign-in), organization name, and role.
• Authentication identifiers. If you sign in with Google, the identifiers Google returns, such as your Google account ID and email.
• API credentials & usage. A hashed form of each API key (we never store the full key after it is shown to you once), and usage records such as the operations performed, video duration, render tier, and billable amounts.
• Customer Content. The photos and images you upload or direct us to retrieve, catalog, listing, and subject data, narration scripts, and the generated videos and thumbnails.
• Billing data. We use Stripe to process payments. We store your Stripe customer identifier and records of purchases and credit transactions. We do not collect or store full payment-card numbers; Stripe handles card data under its own terms.
• Cookies. We use a single, strictly necessary authentication cookie to keep you signed in to the console. We do not use advertising cookies or third-party analytics trackers.
• Technical logs. Our infrastructure and security providers may automatically record standard technical information — for example, IP address and request metadata — to operate, secure, and troubleshoot the Service. We do not store IP addresses in our own application database.

We use the information described above to:

• Provide, operate, and deliver the Service, including generating and delivering your videos;
• Process payments and manage your prepaid balance;
• Authenticate you and secure the Service, including detecting and preventing fraud, abuse, and violations of our Terms;
• Provide support and respond to your requests;
• Comply with legal obligations and enforce our agreements; and
• Maintain and improve the Service using aggregated or anonymized data that does not identify you or your customers.

We do not use Customer Content — your inputs or the videos we generate — to train artificial-intelligence or machine-learning models.

The AI providers we use to render and narrate videos process Customer Content on a paid, enterprise basis and do not use it to train their models.

We share information only as needed to run the Service, with providers that process it on our behalf (“subprocessors”):

• Google Cloud (Vertex AI — Veo, Gemini, and text-to-speech). Rendering videos, analyzing and selecting photos, and generating narration scripts and voiceover. Customer Content, including photos, is processed here.
• Stripe. Payment processing and billing.
• Mailgun. Sending transactional email such as sign-in and password messages.
• Vercel. Hosting the Service and storing generated videos, audio, and thumbnails, which are delivered to you via storage URLs.
• Amazon Web Services and Anthropic. Fallback generation of narration scripts.
• Our database hosting provider. Storing account, job, and usage records.
• Shopify and WooCommerce. Only if you connect a store, to read product data and publish finished videos back to it.

We may also disclose information to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, financing, or sale of assets.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We store account and billing records for as long as your account is active and as needed to provide the Service, resolve disputes, and meet legal obligations.

Customer Content — including uploaded photos and generated videos — is retained to provide the Service and remains available through its storage URLs until you or we delete it. We do not currently impose a fixed automatic deletion schedule.

You may request deletion of your account or specific content by contacting us at support@catalogreel.com, and we will delete it except where we are required to retain it by law.

DriveReachAds operates in the United States, and our providers (including Google) process data in the United States and potentially other locations.

If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for international transfers.

Depending on where you or your end users are located, you may have rights to access, correct, delete, port, or restrict the processing of personal data, or to object to certain processing, under laws such as the EU and UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

Because we do not sell personal information, there is no sale to opt out of. We will not discriminate against you for exercising your rights.

To exercise rights over your account data, contact us at support@catalogreel.com. For personal data contained in Customer Content about your own end users, please direct requests to the customer who submitted that content (the controller); we will assist that customer as their processor.

We use technical and organizational measures to protect information, including encryption in transit (TLS), hashing of account passwords and API keys, signed webhook payloads, and encryption of connected-store credentials at rest.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If you submit Customer Content that contains personal data about other people — for example, individuals visible in photos, or data about your own customers — you are responsible for having a lawful basis and for providing any required notices and obtaining any required consents.

You are responsible for ensuring you have the rights to images that depict people, vehicles and license plates, and private property. While the Service offers features such as license-plate blurring, these are conveniences and not a guarantee of compliance.

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this Policy from time to time. If we make material changes, we will update the “Last updated” date above and may provide additional notice. Your continued use of the Service after the changes take effect constitutes acceptance.

Questions or requests regarding this Policy can be sent to support@catalogreel.com.

This Policy is provided by DriveReachAds LLC.