Privacy Policy
Effective 1 November 2026
MB Piruz Afruz (trading as Actuba, company code 306655229), Laisvės pr. 60, LT-05120 Vilnius, Lithuania (“we”), runs MascotReel and is the data controller for the personal data described here. This policy covers the MascotReel app and applies under the EU and UK GDPR, and for people in Türkiye under the Personal Data Protection Law No. 6698 (KVKK). See also our Terms of Service.
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Email address and password (stored only as a secure hash) | To create and secure your account, match your purchases to it and send service and billing notices | Contract |
| Clips you upload, and the shorts, scripts and post text we make from them | To make and deliver your shorts | Contract |
| Plan, credits, orders, subscription status and AppSumo code | To give you what you paid for and keep accurate records | Contract; legal obligation for tax and accounting records |
| Technical logs: IP address, browser, pages requested, errors | To keep the service secure and working and to stop abuse | Legitimate interest |
| Emails you send us | To answer you and handle refunds and complaints | Contract; legitimate interest |
We never see your card details: Stripe handles payment and sends us only your email, customer and order numbers, product, amount and status. We do not sell your data, use it for advertising, or use your clips to train AI models.
Who we share it with
We only share what each provider needs to do its job, under contracts that require them to protect it.
- Hetzner Online GmbH (servers in Helsinki, Finland, EU): hosts the app, database, your clips and shorts.
- Stripe (Ireland and USA): processes payments, invoices and refunds. For fraud prevention and its legal duties it acts as an independent controller under its own privacy policy.
- Postmark (USA): delivers account emails such as password resets. It receives your email address and the message.
- OpenAI (USA): receives still frames from your clip to choose the moment and write the joke and post text. Under OpenAI’s API terms, this data is not used to train its models.
- Hedra (USA): receives the joke text to generate the mascot’s voice.
- Vivix: receives the mascot image and the generated voice to animate the mascot. Your own clip is not sent to Vivix.
- AppSumo: if you bought through AppSumo, it shares your code with us.
- Authorities, if the law requires it.
International transfers
Our servers are in the EU. Some providers above process data in the USA. Where that happens we rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, and for data subjects in Türkiye on the transfer safeguards required by KVKK. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Uploaded clips: may be deleted once your short is made, and in any case within 30 days.
- Finished shorts: kept for at least 30 days so you can download them; we may delete them after that.
- Account data: until you close your account, then deleted within 30 days.
- Orders and invoices: kept as long as tax and accounting law requires (up to 10 years).
- Database backups: kept for 7 days, then overwritten.
- Technical logs: kept for up to 30 days.
Cookies
The app only uses cookies needed to keep you signed in. We use no analytics, advertising or tracking cookies, so there is no cookie banner.
Your rights
You can ask to see, correct, delete or export your data, to restrict or object to how we use it, and to withdraw any consent you gave. Under KVKK Article 11 you also have the right to learn whether your data is processed, its purpose, and who it is shared with. Email mascotreel@actuba.com from your account email; we reply within 30 days. If you are unhappy with our answer, you can complain to your local data protection authority or to Lithuania’s State Data Protection Inspectorate (VDAI), or in Türkiye to the Personal Data Protection Authority (KVKK).
Security
Data is sent over HTTPS, passwords are hashed, database access is restricted per account, and only our team can reach the servers. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
Children
MascotReel is for adults (18+). We don’t knowingly collect data from children.
Changes
If we make important changes to this policy, we will email you before they apply. The effective date at the top shows the latest version.
Contact
Privacy questions: mascotreel@actuba.com, or by post to MB Piruz Afruz (trading as Actuba, company code 306655229), Laisvės pr. 60, LT-05120 Vilnius, Lithuania.