OutfitReelPrivacy Policy – OutfitReel
Last updated: 19 October 2026 · Version 1.0
Web version: https://outfitreel.pro/privacy · Deutsch: https://outfitreel.pro/de/privacy
This policy explains how Expertive OÜ processes personal data when you use the OutfitReel iOS app (the "App") and the website outfitreel.pro (the "Website").
1. Controller and contact
Expertive OÜ, Ruunaoja tn 3, 11415 Tallinn, Estonia · Registry code 16734170 · Management board member: Ömer Faruk Bayram · [email protected]
We have not appointed a data protection officer because we are not legally required to do so. You can contact us about all data protection questions at the address above or in the App under Settings → Help & contact.
2. Summary
- No tracking, no analytics, no advertising SDKs in the App. No tracking or analytics cookies on the Website.
- We use your data to run your account and to show the content you publish.
- Your profile, your posts and your follower lists are public. Anyone using OutfitReel can see them.
- Photo and video metadata (such as GPS location and device information) is removed on your device before upload.
- Face and body detection used for placing tags runs only on your device. It is not facial recognition, and no face or body data leaves your device.
- You can delete your account in the App at any time.
3. Data we process in the App
| Purpose | Data | Legal basis (GDPR) | Storage period |
|---|---|---|---|
| Registration and sign-in with email | Email address, password (stored only as a hash), user ID | Art. 6(1)(b) (contract) | Until you delete your account |
| Sign in with Apple | Apple user identifier; name and email address only if you choose to share them (Apple may provide a relay address) | Art. 6(1)(b) | Until you delete your account; Apple tokens are revoked when you delete it |
| Age check (18+) | When you register, we ask for your date of birth only to check that you are 18 or older. Your date of birth is not stored; we only store the confirmation that you are 18 or older and its time. | Art. 6(1)(b) and (f) (legitimate interest: protecting minors, enforcing our minimum age) | Until you delete your account |
| Public profile | Username, display name, profile picture, bio, follower and following lists | Art. 6(1)(b) | Until you change it or delete your account |
| Publishing posts | Videos, captions and product tags (including tag position and any affiliate link you add) | Art. 6(1)(b) | Until you delete the post or your account |
| Blocking | List of accounts you have blocked | Art. 6(1)(b) and (f) (protecting users) | Until you unblock or delete your account |
| Reports and moderation | See section 6 | Art. 6(1)(c) (Art. 16–18 Regulation (EU) 2022/2065, "DSA") and Art. 6(1)(f) | See section 6 |
| Transactional emails (e.g. confirming your email address, resetting your password) | Email address, content of the email, delivery status | Art. 6(1)(b) | Sending logs at our email provider: see section 9 |
| Security logs and rate limiting | IP address in hashed form (HMAC-SHA256; the hashing keys change every month), time, action performed | Art. 6(1)(f) (legitimate interest: security and preventing misuse) | Media-server audit logs: 30 days; rate-limiting data: 24 hours |
| Support requests | Your message, email address and any details you provide | Art. 6(1)(b) or (f) | 12 months after your request is closed |
| Requests from authorities, legal claims | The data concerned | Art. 6(1)(c) or (f) | For the duration of the proceedings |
On-device image analysis. When you create a post, the App uses Apple's on-device Vision framework to detect objects, body posture and faces, only to suggest where product tags should be placed. This analysis happens entirely on your device. Only the final tag positions are uploaded. We do not use facial recognition, we do not create biometric templates, and no face or body data is sent to us or stored by us.
Permissions. The App does not use your camera or microphone. You choose photos and videos with the system photo picker, which gives the App access only to the items you select. If you save a video to your photo library, the App asks for permission to add it (add-only access).
Metadata removal. Before a photo or video is uploaded, the App removes embedded metadata such as GPS location, device model and capture details on your device.
Watermark. If a video is saved or shared outside the App, it carries an OutfitReel watermark.
Media files are stored under random 128-bit file names. We do not create thumbnails.
Affiliate links. Creators can add their own affiliate links to approved shops. These links are automatically labelled "Anzeige · Affiliate-Link" (advertisement · affiliate link) and open unchanged in your external browser. When you open one, you leave OutfitReel and the shop or affiliate network processes your data under its own privacy policy, for example by using cookies. We do not log whether you tap a link, and we receive no commission for any link. Our own AI-generated demo posts (official account @outfitreel) contain no affiliate links.
What we do not do. The App contains no analytics, advertising or tracking SDKs. We do not track you across apps or websites, we do not sell data, and we do not use your data for personalised advertising.
4. Public visibility
OutfitReel is a public platform. Your username, display name, profile picture, bio, posts and follower and following lists are visible to everyone who uses OutfitReel. There are no private profiles. Videos saved outside the App can be passed on by others. We cannot recall copies that other people have already saved. Please think about this before you post, especially when other people appear in your videos.
5. Account deletion
You can delete your account in the App under Profile → Settings (gear icon) → Account → "Delete account" and confirm. Deletion removes your profile, posts, tags, blocks, follows and reports, revokes your Sign in with Apple tokens, deletes your media files from our server and removes them from the Cloudflare cache. Data in backups is overwritten as the backups rotate (see section 8). Minimal moderation records are kept for a limited period (section 6).
6. Reports, moderation and moderation records
You can report content or accounts in the App, including by stating "This is me" if you appear in a video. To process a report, we use the reported content, the information in your report and, if you provide them, your name and email address (only until the report has been decided). Under the DSA, we must confirm receipt, decide carefully and explain our decisions (Art. 16 and 17 DSA).
How we moderate. Before text is saved, an automatic word filter checks captions, tag labels, usernames, display names and bios; if a blocked term is found, the text cannot be saved and you can change it. Links can only point to approved shops and affiliate networks; shortened links are rejected. We do not scan images or videos automatically. Reports are reviewed by a human, who decides on measures such as removing content or suspending or banning an account. When we inform you of a decision, we state whether automated means were used (Art. 17(3)(c) DSA).
Moderation records. When a report has been decided, we keep a minimal record: report ID, reference to and hash of the content, reason, decision, statement of reasons, timestamps and the pseudonymous account IDs involved. The record contains no names or email addresses. We keep this record for 6 months after the decision. If a complaint, legal dispute or authority request is pending, we keep it until that matter is concluded. This also applies if the account concerned has been deleted. Legal basis: Art. 6(1)(c) GDPR together with Art. 16–18 DSA, and Art. 6(1)(f) GDPR (handling complaints, establishing, exercising or defending legal claims). We keep a copy of the content itself only where the law requires us to (e.g. Art. 6 Regulation (EU) 2021/784 on terrorist content) or where it is necessary to report a suspected criminal offence to the authorities.
7. Recipients and processors
We only share data with the service providers that we need to run OutfitReel. They act as processors on our behalf under data processing agreements (Art. 28 GDPR):
- Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513: authentication and database. The database is hosted in an Amazon Web Services data centre in Europe.
Supabase uses sub-processors, including Amazon Web Services.
- OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: hosting of our server, on which media files are stored, in France.
- Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: content delivery network (CDN) and protection against attacks for media files and the Website (this involves processing IP addresses), and forwarding emails sent to [email protected] (Email Routing).
- Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA: sending transactional emails (e.g. email confirmation, password reset) on our behalf under a data processing agreement. Emails are sent from Resend's EU sending region (Ireland); Resend stores email metadata, logs and content in the USA. We do not use open or click tracking.
Apple. If you use Sign in with Apple, Apple processes your data as an independent controller under its own privacy policy (https://www.apple.com/legal/privacy/). The App Store, downloads and app updates are also handled by Apple.
Other users and the public see your public profile and posts (section 4).
Authorities. We disclose data to authorities only where we are legally required to, for example when we receive an order or have to report a suspected criminal offence that threatens someone's life or safety (Art. 18 DSA).
8. Transfers outside the EU/EEA
Supabase Pte. Ltd. is based in Singapore, and its group companies and sub-processors may access data from outside the EU/EEA, for example for support and operations. For these transfers, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Commission Implementing Decision (EU) 2021/914), which are part of Supabase's data processing addendum. If our database is hosted in a European country outside the EU/EEA (the United Kingdom or Switzerland), the transfer to that country is based on the European Commission's adequacy decision (Art. 45 GDPR).
Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. The transfer is therefore based on the adequacy decision under Art. 45 GDPR, with Standard Contractual Clauses as a fallback (Art. 46(2)(c) GDPR).
Resend (Plus Five Five, Inc.) is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the adequacy decision under Art. 45 GDPR and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) contained in Resend's data processing addendum.
Where other service providers process data outside the EU/EEA, this only takes place if the European Commission has issued an adequacy decision (Art. 45 GDPR) or appropriate safeguards such as the EU Standard Contractual Clauses are in place (Art. 46(2)(c) GDPR).
Backups. The database plan we currently use does not include user-accessible backups or point-in-time recovery. To the extent our database provider keeps internal backups for operational reasons, deleted data may persist there until those backups are overwritten. Our hosting provider creates automatic backups of our server that are overwritten in a rolling cycle; deleted data is removed from these backups when they are overwritten.
9. Storage periods
| Data | Storage period |
|---|---|
| Account, profile, age confirmation | Until you delete your account; then removed from live systems without undue delay and from backups when they rotate |
| Posts and media | Until you delete the post or your account; media files are removed from our server and the Cloudflare cache |
| Follows, blocks | Until you remove them or delete your account |
| Moderation records (section 6) | 6 months after the decision; longer while a complaint, dispute or authority request is pending |
| Media-server audit logs (hashed IP) | 30 days |
| Rate-limiting data (hashed IP) | 24 hours |
| Support requests | 12 months after closure |
| Transactional emails and sending logs at Resend | 30 days |
| Logs of our infrastructure providers (Cloudflare, Supabase, Resend) | According to the respective provider's retention periods under its data processing agreement |
Longer statutory retention obligations remain unaffected.
10. Website outfitreel.pro
The Website sets no cookies of its own and uses no analytics or tracking tools. To deliver the Website and media files, our server and Cloudflare process technically necessary data: IP address, date and time, requested page or file, browser type and referrer. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure service). Our media server's audit logs store the IP address only in hashed form (HMAC-SHA256, hashing keys rotated monthly) and are deleted after 30 days; rate-limiting data is deleted after 24 hours. If Cloudflare's bot protection is active, Cloudflare may set a strictly necessary security cookie (__cf_bm) to distinguish people from bots; no consent is required for this under § 25(2) No. 2 of the German TDDDG (Art. 5(3) ePrivacy Directive).
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)), where we rely on consent. To exercise these rights, write to [email protected]. We respond within one month (Art. 12(3) GDPR).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation.
Right to lodge a complaint: You can lodge a complaint with a supervisory authority, in particular in your country of residence or with our lead authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia, https://www.aki.ee.
12. Minimum age
OutfitReel is only for adults aged 18 and over. When you register, we check your date of birth to confirm that you are 18 or older; your date of birth is not stored. If we find out that a user is under 18, we delete the account. If you believe a minor is using OutfitReel, please let us know at [email protected].
13. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The automatic word filter (section 6) only prevents text containing blocked terms from being saved; decisions on reports, content removal and account measures are always taken by a human.
14. Security
We protect data with encrypted transmission (TLS), access controls, random file names, metadata removal on your device, rate limiting and hashed security logs.
15. Changes
We update this policy when our processing changes. The current version is always available at https://outfitreel.pro/privacy.