Privacy Policy

Last updated: 6 October 2026.

  1. Who we are

Reframr is run by Reframr Ltd, a company registered in England and Wales (company number 17491973), with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom.

For anything about your personal data, contact us at privacy@reframr.io.

This policy explains what personal data we collect when you use reframr.io and the Reframr app, why we use it, who we share it with, how long we keep it, and your rights.

  1. What we collect

Your account: your name, email address, password (stored securely by our sign-in provider, never visible to us), and whether you signed in with Google. At sign-up we also record whether you use Reframr mainly for work or for personal projects, your confirmation that you are 18 or over, and which version of our terms you accepted.

Your work: everything you create or upload: projects, storyboards, scripts, notes, prompts, pictures, video, audio, voice recordings, cloned voices, chats with Reframr’s AI assistants, and the results the AI generates for you.

Real people’s faces and voices: when you use a photo, video or recording of a real person, we record your confirmation: whether it is you, someone else (with their permission), not a real person, or a reference for pose, clothing or style only. See section 7.

Clients who review your work: when a client comments on or approves a project through a share link, we record their name, email address, comments, reactions, approvals and when they read comments. These are visible to the project owner and to the people the owner has invited to work on the project. We keep the client’s name and email in their browser so they do not need to type it again.

People you work with: if you invite someone to a project, we use their email address to send the invitation. People on a project can see each other’s names and email addresses, and the comments left on the project.

Payments: payments are handled by Stripe. We never see or store your full card details. We keep a record of your plan, what you paid and when.

Marketing preferences: whether you have chosen not to receive Reframr news, tips and offers, and when you unsubscribed.

Reports and messages: if you contact us or report content, we keep your message, your email address and what we did about it.

Technical information: when you use Reframr, our providers receive your IP address and basic browser information, as any website does. If something goes wrong in the app, an error report is sent to Sentry (see section 5). We record your IP address and device when you confirm permission to use a real person’s face or voice.

We do not use advertising trackers, analytics tools or tracking pixels.

  1. Why we use it, and our legal basis
  • To provide Reframr to you (our contract with you): running your account, storing your work, generating what you ask for, sharing projects with the people you choose, and sending you service emails.
  • To keep Reframr safe and lawful (our legitimate interests, and legal obligations): checking generated content for nudity and sexual content, recording consent for real people’s faces and voices, dealing with reports, preventing fraud and abuse, and reporting child sexual abuse material to the authorities as the law requires.
  • To run the business (legal obligations): keeping payment and tax records.
  • To send you news, tips and offers about Reframr (our legitimate interests, and the rules for emailing people who sign up for our service): when you create an account, we tell you we will send these emails, and you can say no straight away by ticking the box. If you join our waitlist, we first ask you to confirm your email address by clicking a link we send you. Once confirmed, we only email you about Reframr’s launch and early access. You will get other news only if you create an account. You can also unsubscribe at any time using the link in every email, or in Settings. We only email you about Reframr.
  • To improve Reframr (our legitimate interests): finding and fixing errors, including through automatic error reports, and understanding which features are used. We do not use your work to train AI models.

We do not sell your personal data, and we do not use it for advertising.

  1. Automated checks

Reframr automatically checks generated pictures and video for nudity and sexual content, and refuses some requests, for example ones that combine children with sexual or revealing words. If your content is blocked, you get your credits back. If you think a block was wrong, contact support@reframr.io and we will review it.

  1. Who we share it with

We use the following companies to run Reframr. They only receive what they need to do their job. None of them receives your payment details, and the AI providers do not receive your name or email address.

Google (hosting, sign-in and safety checks)

Google Cloud EMEA Limited (Ireland) hosts Reframr’s database, files and server code, runs sign-in, and runs the image safety check (Cloud Vision). Data is stored in the United States. Google does not use the content sent to Cloud Vision to train its models. Transfers are protected by Google’s data processing terms, using the EU Standard Contractual Clauses with the UK Addendum, and the UK Extension to the EU-US Data Privacy Framework.

WaveSpeed (most AI image, video and voice generation, Gemini text models, and a backup for AI chat)

WaveSpeedAI PTE. LTD. (Singapore), together with WaveSpeedAI LIMITED (Hong Kong), runs most of the AI image, video and voice models in Reframr, including models made by ByteDance, Kling, Alibaba, Google, MiniMax and others. It also runs Google’s Gemini text models, and handles AI chat requests if our main text providers (Anthropic and OpenAI) are unavailable. When you generate something, WaveSpeed receives your prompt and settings, and any pictures, video, audio or voice recordings you include. WaveSpeed processes data in Singapore, the European Union and the United States.

  • WaveSpeed keeps pictures, video and audio for 7 days, then deletes them automatically. Your own copy stays in your Reframr library until you delete it.
  • WaveSpeed keeps a record of each request, including your prompt, for at least 3 months, unless we delete it sooner.
  • WaveSpeed has told us it does not use the data we send, or the results, to train or improve its models. Some models are run by other companies (such as Google, OpenAI and MiniMax), and their own policies apply to those models.
  • WaveSpeed does not currently offer a UK data transfer agreement. To limit the risk, we never send WaveSpeed your name, email address or payment details.

MiniMax (voice cloning, through WaveSpeed)

When you clone a voice, the voice is created and stored by MiniMax (Nanonoble Pte Ltd, Singapore, which stores data in the United States), reached through WaveSpeed. A saved voice stays with MiniMax so that it can be used again. If you delete a voice in Reframr, it can never be used from Reframr again and we delete the recordings we hold, but MiniMax does not currently allow saved voices to be deleted, so it may remain stored there. MiniMax’s terms allow it to use inputs to improve its services.

Anthropic (AI assistant, writing and analysis)

Anthropic Ireland, Limited (Ireland) runs most of Reframr’s text AI: the assistant Hugo, Plan, the storyboard prompt chat and the UGC script writer, and the AI that analyses scripts and writes shot descriptions. It receives the text and pictures needed for each request, under a data processing agreement included in its commercial terms. It receives the text and pictures needed for each request. Data is stored in the United States and deleted within 30 days. Anthropic does not train its models on this content. Transfers are protected by the EU Standard Contractual Clauses with the UK Addendum.

OpenAI (AI text models)

OpenAI OpCo, LLC (United States) runs Reframr’s GPT text models, used in the same features as Anthropic. It receives the text and pictures needed for each request, under OpenAI’s data processing agreement. Data is processed in the United States and kept for up to 30 days to provide the service and prevent abuse, then deleted. OpenAI does not train its models on this content. Transfers are protected by the EU Standard Contractual Clauses with the UK Addendum.

fal (some AI image generation)

Features & Labels, Inc. (fal, United States) runs some image models. It receives your prompt and any reference pictures. fal stores inputs and results for a period it does not publish. Transfers are protected by the UK International Data Transfer Agreement.

HeyGen (talking avatars)

HeyGen Technology Inc. (United States) creates talking avatar videos. It receives the face photo and audio you choose. Data is stored in the United States. HeyGen has confirmed that it does not use our content to train or improve its models. Transfers are protected by the UK Extension to the EU-US Data Privacy Framework.

Sentry (error reports)

Functional Software, Inc. (Sentry, United States) helps us find and fix problems in the app. Only when an error happens, it receives a technical description of the error (what failed, on which page, and in which browser and device) and your Reframr account ID, so we can see how many people are affected. It does not receive your name, email address or your work, and we remove download links and access keys from reports before they are sent. We do not use Sentry’s screen recording, logging or performance tracking. Error reports are stored in the European Union (Germany) and kept for 30 days. Sentry processes data under its data processing agreement, and any transfer to the United States is protected by the UK Extension to the EU-US Data Privacy Framework and the EU Standard Contractual Clauses with the UK Addendum.

Resend (email)

Plus Five Five, Inc. (Resend, United States) sends Reframr’s emails, such as approval notices and account emails. It receives the recipient’s email address and name and the message. It keeps emails for 30 days and does not use them to train models. Transfers are protected by the EU Standard Contractual Clauses with the UK Addendum, and the UK Extension to the EU-US Data Privacy Framework.

Email marketing provider (marketing emails)

If you receive our marketing emails, your name and email address are held by the email marketing service we use to send them, and used only for that. We will name the service here before we send our first marketing email.

Stripe (payments)

Stripe Payments Europe, Limited handles payments and fraud prevention. Stripe keeps payment records as financial law requires and uses them to prevent fraud. Transfers are protected by the EU Standard Contractual Clauses with the UK Addendum, and the UK Extension to the EU-US Data Privacy Framework.

Stock photos (Pexels and Unsplash)

When you search for stock photos, your search words are sent to Pexels (Canva Germany GmbH) or Unsplash (Unsplash Inc., Canada), and the pictures load from their servers, which see your IP address. They handle this under their own privacy policies.

Our website host

The reframr.io website is hosted by Hostinger UK Limited, which receives visitors’ IP addresses and browser information.

Others

We may share personal data if the law requires it (for example with the police or a court), to report child sexual abuse material to the National Crime Agency or the Internet Watch Foundation, or with a buyer if Reframr is ever sold, who would have to follow this policy.

  1. How long we keep it
  • Your account and work: until you delete them, or delete your account.
  • Marketing emails: until you unsubscribe. After that, we keep only your email address on a do-not-email list, so we never email you again by mistake.
  • Error reports (Sentry): 30 days.
  • Invitations not accepted: deleted after 30 days.
  • Waitlist sign-ups not confirmed: deleted after 30 days.
  • What you added to other people’s projects: stays in those projects after you delete your account, as part of their work.
  • Deleted items: copies in our backups are removed automatically within 30 days.
  • Consent records for real people’s faces and voices, and agreements to feature conditions: 6 years after the file or account is deleted, with only the minimum details (see section 7).
  • Payment records: 6 years, as UK tax law requires.
  • Deletion receipt: a short record that your account was deleted, with no content, so a restored backup cannot bring it back.
  • Reports and messages: as long as needed to deal with them, and up to 6 years where they relate to a legal claim.
  • Free accounts not used for 24 months may be closed after we email you.
  • Our providers keep data for the periods set out in section 5.
  1. Real people’s faces and voices

Before you use a photo, video or recording of a real person in Reframr, we ask you to confirm who it is and that you have permission. We keep a record of each confirmation: your user ID, your email address at the time, when you confirmed, a digital fingerprint of the file (never the file itself), what it was used for, your answer, and the wording you agreed to. We also record your IP address and device, and delete them when your account is deleted.

We keep the rest of the record for 6 years after the file or your account is deleted. It is our evidence if someone later says their face or voice was used without permission, and most legal claims in the UK can be brought for up to 6 years. It is never used for anything else, and it can never be used to authorise anything new.

If you use a real person’s face or voice in a project owned by someone else, your record also notes which project it was and links to the project owner’s own confirmation, so it shows whose permission you relied on.

Before you first use talking avatars, we also ask you to agree to the extra conditions that apply to them. We keep a record of this agreement (your user ID, your email address at the time, when you agreed and the wording you agreed to) in the same way and for the same period.

If your face or voice has been used in Reframr without your permission, report it using the report form at app.reframr.io/report and we will remove it.

  1. Where your data goes

Reframr’s own data is stored in the United States, and our providers process data in the countries listed in section 5. Where the law requires it, we rely on the safeguards named in section 5 when your data leaves the UK.

  1. Your rights

You have the right to:

  • Get a copy of your data. Use Download my data in Settings, which emails you a link to all your work and account details. You can also email us.
  • Correct your data. Most details can be changed in Settings.
  • Delete your data. Delete individual items at any time, or delete your whole account in Settings. Your account is locked for 14 days first, and signing in again during that time cancels the deletion.
  • Stop marketing emails at any time, using the unsubscribe link in every email or in Settings.
  • Object to or restrict how we use your data, and ask us to move it to another service.
  • Complain to us if you are unhappy with how we handle your data. Email privacy@reframr.io. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
  • Complain to the ICO at ico.org.uk. We would appreciate the chance to put things right first, but you can go to the ICO at any time.

To use any right, email privacy@reframr.io. We will reply within one month. If you do not have a Reframr account (for example, you commented on a share link, or you appear in someone’s upload), email us and we will deal with your request.

  1. Children

Reframr is only for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.

  1. Security

Your data is encrypted in transit and stored with Google Cloud. Access to user content inside Reframr is limited, and any access by our team for support, reports, safety or legal reasons is recorded. If a data breach puts your rights at risk, we will tell you without undue delay, and we will tell the ICO within 72 hours where the law requires.

  1. Cookies and browser storage

Reframr does not use advertising or analytics cookies. We use only what the app needs to work: keeping you signed in, remembering your settings, and remembering a client’s name and email on share links. Google may set its own cookies during Google sign-in.

  1. Changes to this policy

If we make an important change, we will email you before it takes effect. The date at the top shows when this policy was last updated.