Privacy Policy

1. What we collect

Reely is installed by a merchant on their own store, and everything below is store data rather than personal browsing data.

• Store identity: the myshopify.com domain and the access token Shopify issues when the app is installed.
• Product data, read through the Shopify Admin API when a merchant opens the product list or generates a video: product title, description, price, and image URLs.
• Usage records held in our database: generation history (product title, chosen format, length, status, error message on failure), the credit ledger, and one-time purchase records.
• Feedback a merchant chooses to send us from inside the app.
• Basic server logs, including request times and errors, used to diagnose failures.

No consumer data. Reely holds a single Shopify access scope — read_products — and it does not request any other. The app cannot read orders, customers, checkouts, or any shopper's personal information, and it never asks a store's customers for anything.

2. Why we use it

• To generate video ads from the product photos and descriptions a merchant selects.
• To settle credits: charging for a render, refunding one that fails, and recording a purchase.
• To answer support requests and to investigate a generation that failed.

We do not sell data, we do not share it with advertising networks, and we do not use a merchant's products or generated videos to train models of our own.

3. Who we send it to

Producing a video means sending part of a merchant's product data to the services that render it. These are the only third parties involved, and each receives only what the task needs.

• fal.ai (United States) — runs the AI models that write the ad copy and render the video. Receives: the selected product images, the product title and description, and the prompts derived from them.
• Cloudflare R2 — object storage. Holds the rendered videos and their thumbnails until they expire.
• Shopify — processes payment for credit packs and issues the charge records the app reads back. Reely never sees a card number.

The application servers and the database that hold the records described in section 1 are operated by Apledot and are not shared with anyone else.

Data sent to fal.ai and Cloudflare is processed outside the merchant's own country, including in the United States. Installing the app and generating a video is what sends it there.

4. How long we keep it

• Rendered videos and thumbnails: deleted 60 days after the video is made. The app shows the remaining days on each video and warns before a file expires — download anything worth keeping before then.
• Account and usage records (store row, credit balance and ledger, purchase history, generation history, feedback): kept while the app is installed, and deleted when Shopify sends its shop/redact webhook — 48 hours after the app is uninstalled. A merchant who reinstalls inside that window still has their balance and their history.
• Sessions, which hold the access token Shopify issued: deleted the moment the app is uninstalled.
• Server logs: kept for a short operational period and then discarded.

One thing outlives that deletion, and it is deliberate: a one-way hash of the store domain, and the flag recording that the free signup credits were already granted. It carries no store name, no products, no history and nothing that can be turned back into a domain. It exists because the free credits are granted once per store ever, and without it a store could uninstall, be erased, reinstall and collect them again.

5. Your rights (GDPR, CCPA and equivalents)

A merchant may ask for a copy of everything Reely holds about their store, ask for it to be corrected, or ask for it to be deleted before the retention periods above run out. Write from the store's contact address to the email at the end of this policy and we will answer within 30 days. There is no charge, and asking does not affect a merchant's use of the app beyond the deletion itself.

Californian merchants have the same rights of access and deletion, and a right not to be discriminated against for exercising them. Reely does not sell or share personal information as those terms are used in the CCPA.

Shopify's mandatory privacy webhooks are handled as follows:

• customers/data_request — a store customer has asked what data an app holds about them. Reely holds no consumer data, so there is nothing to return; the request is recorded and answered accordingly.
• customers/redact — a store customer has asked to be erased. Reely holds no consumer data, so there is nothing to erase.
• shop/redact — sent 48 hours after a store uninstalls the app. Everything held for that store is deleted: the videos and the files behind them, the credit ledger, purchase and generation history, feedback, and the sessions holding our access token. The deletion is queued the moment the request arrives and normally finishes within minutes. What survives it is the hash described at the end of section 4.

6. Security

• Every request between a merchant's browser, Shopify, and Reely travels over HTTPS, as does every call to the services in section 3.
• Shopify access tokens are stored server-side and are never sent to the browser.
• A generated video is private to the store that made it. A public link exists only if the merchant creates one, is an unguessable address, and can be revoked at any time.
• Access to the production database is limited to the operators who need it to run the service.

No system is perfect. If a breach affects a merchant's data we will notify the affected stores and the relevant authority as the law requires.

7. Children

Reely is a tool for businesses. It is not directed at children and we do not knowingly collect anything from them.

8. Changes

If this policy changes in a way that affects what we collect or who we send it to, the date at the top of this page changes with it and merchants with the app installed are told inside the app.

9. Contact

Apledot, operator of Reely. Questions about this policy, or a request under section 5:

apledot.support@gmail.com