Privacy Policy

02What data we process

From whoever opens the account and their team: email, account name, sign-in and two-factor data, acceptance of the terms, billing data (card details are processed by Stripe, not by us), and the messages you send us in support, with the technical data you choose to attach (screen, browser, panel errors and, if you want, a screenshot). From each profile: name, country, language, Instagram username and photo, and, if you connect it, the Instagram authorization to publish and the results of each post (reach and views at 24 and 72 hours). From your videos: the videos you upload, the variants generated, the text that goes with them and their calendar. From the viral radar: the public accounts you follow and the public videos we read from them. From use of the platform: technical logs, IP address and device data, for security and to detect abuse. From the affiliate program: the code of the affiliate who referred you and an anonymous device mark against fraud.

03What for

To provide the service: create the variants of your videos, schedule them and publish them on your Instagram, measure their results, show you virals, write the text with AI, charge the subscription and notify you by email. Also to keep the platform secure (detect fraud and abuse), handle support and meet legal obligations. We do not sell data or use it for advertising.

Improving the service with aggregated data: we use AGGREGATED performance data from all accounts (which editing recipes are used and the publishing metrics of the variants, such as reach and views) to improve the service and the editing for every user. That aggregated data does not identify you or your content. We never use one user's content (their videos, variants, texts or specific results) for another user, and we never show it to anyone.

04Legal basis

Account data: the contract with the customer (Article 6.1.b GDPR), legal billing obligations (6.1.c) and our legitimate interest in security and fraud prevention (6.1.f). The connection to your Instagram and non-service emails, your consent (6.1.a), which you can withdraw. Data of third parties who appear in your videos: we process it on your behalf, and you need your own legal basis, as set out in the Data Processing Agreement (DPA).

05How long

Your videos, variants and results are kept while the account is active (you can delete them earlier) and technical logs are deleted after about 90 days. When you delete the account, everything is deleted after a 14-day grace period, except invoices, which are kept for the period tax law requires. Originl also keeps anonymous, aggregated statistics that do not identify anyone. Videos from a profile you stop using are kept while the account is active and deleted if you delete that profile; backups are deleted after 30 days.

06Your rights

You can ask for access, rectification, erasure, restriction, objection and portability. From Settings, under Account, you can download your data and delete the account; for anything else, write to legal@getoriginl.com. If a person who appears in a video wants to exercise their rights, they can contact whoever uploaded it or us, and we will help get it to them. You can also complain to a data protection authority (in Spain, the AEPD).

07International transfers

The owner and several providers are outside the European Economic Area, mainly in the United States, so your data may be processed there. Transfers rely on the EU-US Data Privacy Framework when the provider is certified, or on the European Commission's standard contractual clauses. With customers in the European Economic Area, the standard clauses incorporated in the Data Processing Agreement (DPA) apply. Originl works with each provider under its data processing agreement.

08Security

Encrypted connections, HttpOnly and Secure session cookies, optional two-factor authentication and encrypted recovery codes. Support screenshots are kept in private storage and are only seen through a temporary link. No system is infallible.

09Social networks and platforms where you publish

Originl connects to your Instagram account through Meta, with your authorization, to publish your trial reels and measure their results; you can disconnect it whenever you want from Originl or from your Instagram account settings. The platforms where you publish what you create with Originl (Instagram, TikTok, YouTube, X, Facebook and Threads) process the data of your posts as controllers in their own right, under their own privacy policies: Originl does not control them. Today Originl posts directly to Instagram, TikTok and YouTube Shorts, and receives from each only what it needs to post and measure: the account ID, your posts and their statistics.

10Minors

Originl is not for people under 18. If we detect that an account belongs to a minor, we suspend it and delete its data.

11Who we share data with

Only with the providers we need to deliver the service, each with just the data its function needs, and with authorities when the law requires it. The list is below.

12Providers (processors)

These are the providers we use today and what for:

• SupabaseDatabase, sign-in and storage of your videos and variants(United States)
• RailwayHosting of the application and its processes(United States)
• StripeBilling of subscriptions and top-ups, invoices and payment portal(United States (Stripe, Inc.))
• ResendSending of account emails(United States)
• ApifyReading of public Instagram and TikTok accounts for the viral radar(Czechia (EU))
• Meta (Instagram)Connection of your Instagram account to publish and measure results(Ireland (EU) and United States)
• Video engineProcesses your videos and creates the variants(United States (Originl's servers and AI video providers))
• Anthropic (Claude)Writes the text that goes with each variant(United States)
• GoogleSign-in with Google(United States)
• Cloudflare (Turnstile)Anti-bot check when you sign up and sign in(United States)
• SentryTechnical error logging, if enabled(United States)

13Contact

You can write to us at legal@getoriginl.com (legal and privacy matters), at soporte@getoriginl.com (help with your account) or from the panel, under Support. We will reply within the period set by the GDPR (one month, extendable in complex cases).