DemoReel.mov · Privacy Policy · version 2026-10-20

Privacy Policy

This is what DemoReel.mov keeps about you, why, who sees it, and how to get it, change it or delete it. DemoReel.mov is run by YRDZ LLC, 11400 West Olympic Blvd, Suite 200 PMB 2003, Los Angeles, CA 90064, USA, which is responsible for your data (the “controller” under EU and UK law). Questions: hello@demoreel.mov.

What we keep

• Account: your name, email, mobile number (private), password (stored scrambled by our login provider — we never see it), when you agreed to these terms, your notification and email choices, and — if you turn on two-step login — which ways you use, your remembered browsers and backup codes (codes are stored only scrambled).
• Profile: photo, headline, bio, where you're based (country and city), positions, tools, specialties, union status, rates and who may see them, demo reel link, films and credits, awards and memberships, and your availability calendar. Optionally, the countries you're legally able to work in — used only by the crew search filter, never shown on your profile.
• Company pages: name, logo, city, website, phone, about, reel, films, awards, team members and their roles.
• Hiring and calendar: projects, holds, booking requests, answers and bookings. Private notes you add are visible only to you.
• Activity: posts, likes, comments, follows, dream team, applications, messages and the files you attach, and notifications.
• Shared credits and awards: when someone adds you to a film or an award and you accept (or you ask to be added and they accept), your name shows on it for everyone who can see it. You can remove your name.
• Profile views: when you open someone's profile while signed in, they may see that you viewed it (“Who viewed”). We keep one entry per day and delete it after 90 days.
• Share & present links: the films, title and note you choose, the optional passphrase and expiry date, and how many times the link was opened.
• Work records: booking records, deal memos, onboarding packets and your typed signatures (name, date and time, IP address, and the exact document); invoices (days, rates, totals, your client's name, address and email) and the payment reminders and answers about them.
• Paid plans: your plan, its status and dates, and the customer and subscription references from Stripe. Stripe keeps your card; we never see it. When you subscribe we also keep a record of the subscription terms you agreed to: the exact words shown, the price, the date and time, your IP address and browser.
• Technical: login cookies, a few display settings saved in your browser (for example whether the side menu is collapsed), and server logs (IP address, browser, time, page) that our providers keep for a short time to run the service and keep it secure.
• Visitor statistics: Vercel Web Analytics counts page visits — page, referring site, country, device and browser — without cookies. Visitors are told apart by a short-lived code that is thrown away after 24 hours; we only see totals, never a person.

What we never keep

No Social Security numbers, ITINs or other tax IDs, no bank or card numbers, and no filled-in personal forms. Invoices have blank boxes for your tax ID and bank account (routing and account number) that you fill in on your own computer; the app refuses numbers that look like them. We don't ask for sensitive information such as health, religion, ethnicity, sexuality or political views. DemoReel.mov never handles payments between users.

Why we use it

• To run the service you signed up for — your profile, search, holds, bookings, messages, paperwork, invoices, reminders and paid plans (for EU/UK law: performance of our contract with you).
• To keep it safe and working — preventing abuse and fraud, fixing problems, enforcing our Terms, and counting visits in aggregate to improve the site (our legitimate interests; you can object — see “Your rights”).
• Because the law requires it — keeping billing records for tax, answering valid legal requests, and reporting child sexual abuse material to the authorities.
• Emails: we email you about things that need you (requests, bookings, packets, messages — without their text — and payment reminders). You can turn most of them off in your email settings. The only offers we email are about your own plan (for example a trial special near the end of your trial); turn off “Offers” in your email settings and they stop. We don't send other marketing emails without asking first.

We don't sell your personal information, don't share it for advertising, don't show ads, and don't make decisions about you by automated means alone. If we ever add a feature that sends your content to an outside AI service, we'll update this policy before it goes live.

Who sees what

• Signed-in members see profiles, company pages, films, awards and posts. Companies see your calendar as colours only — never your private notes.
• Your rates follow the visibility you choose. Messages are stored encrypted (AES-256; the key is kept apart from the database), and messages, bookings, invoices and packets are seen only by you and the other side involved (invoices are shown to the company with the tax ID and bank boxes blank).
• Nothing is public on the open web except what you share yourself: Share & present links, and invoice or payment links you send to a client.
• DemoReel.mov staff can see what's needed to run the service and answer reports; our admin page shows counts and statuses, not your messages or documents. If someone reports a message, a copy of that one message and the reason go to our team so we can review it. Message notifications by email and in the bell never include the message text.

Services we use

These companies process data only to run DemoReel.mov for us, under their data processing terms:

• Supabase — database, login and file storage (United States, West Coast; encrypted at rest).
• Vercel — website hosting, server logs and visitor statistics (United States).
• Resend — sending our emails (United States).
• Telnyx — sending text messages (one-time codes, and alerts people switched on) (United States). It receives only the mobile number and the message.
• Stripe — subscription payments (United States). Stripe is also responsible for the payment data it collects.
• YouTube (Google) and Vimeo — reels and films play from them. The player only loads when someone presses play; we use YouTube's privacy-enhanced mode and Vimeo's do-not-track setting, but once a video plays, their own privacy policies apply.

Text messages (SMS)

Every account has a mobile number, from any country. It's private: never shown on your profile or to other users. We use it to text you one-time codes to confirm the number or reset your password, and — only if you agree in Account → Email & text messages — the alerts you switch on (for example a booking request). We text numbers in the US, Canada, the UK, Japan and Brazil; elsewhere codes and alerts come by email. Up to 10 alerts a day; message and data rates may apply. In the US and Canada, reply STOP to any text to stop them, START to turn them back on, HELP for help; everywhere, you can stop all text alerts in Account. Your number is used only for these texts: we never sell it, share it or use it for marketing, and opt-in consent is never shared with third parties. Texts are sent through Telnyx, which receives only your number and the message. Change your number or stop all text alerts any time in Account; deleting your account deletes the number.

International transfers

Our servers and providers are in the United States. If you're in the EU, the UK, Canada, Brazil or elsewhere, your data is transferred to the US. We rely on our providers' data processing agreements, which use the European Commission's Standard Contractual Clauses (and the UK addendum) or the EU-US Data Privacy Framework where the provider is certified.

How long we keep it

• Account and profile data: while your account is open.
• When you delete your account, we remove your photo, bio, calendar, films, posts, likes, comments, follows and notifications and close your login straight away. Bookings, invoices you made and packets you signed stay, because they're the other side's business records; they keep your name as it was on those documents.
• Backups made by our database provider expire on their own and are not restored except to recover from a failure.
• Profile views: 90 days. Server logs: as long as our providers keep them (usually days to weeks). Visitor statistics: totals only.
• Billing records for paid plans: as long as tax law requires. Records of the subscription terms you agreed to: at least 3 years, or 1 year after the subscription ends if that's later (California law).

Your rights

Wherever you live, you can:

• See and download your data — Account → Download my data gives you one file with everything about you.
• Correct it — edit your profile, company and settings at any time.
• Delete it — Account → Delete my account (see above for what stays).
• Ask us anything else by writing to hello@demoreel.mov from the email on your account. We answer within 30 days (we may ask you to confirm it's you).

EU, UK and Switzerland: you also have the right to restrict or object to our use of your data (including for our legitimate interests), to data portability, and to withdraw consent at any time. You can complain to your local data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).

California: you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing — we don't sell or share it, and we don't use sensitive personal information. We won't treat you differently for using these rights. You can use an authorised agent. The categories we collect are listed under “What we keep”: identifiers, professional information, commercial information (plans), internet activity on our site, and approximate location (country and city you enter). We don't respond to browser “Do Not Track” signals differently, because we don't track you across other sites; we treat Global Privacy Control signals as a request to opt out of sale or sharing.

Canada and Brazil: you have the same rights under PIPEDA and the LGPD, including to know who we share data with and to have it corrected or deleted. Our contact for privacy questions is hello@demoreel.mov.

Cookies and browser storage

We only use cookies needed to keep you logged in and secure, plus a few settings saved in your browser (local storage) to remember how you like the screens. No advertising or tracking cookies, and our visitor statistics don't use cookies, so there's no cookie banner. YouTube or Vimeo may set their own cookies when you play a video.

Security

Access to data is locked down in the database itself, files are private and served through short-lived links, and all traffic is encrypted. No system is perfectly secure — that's why we don't collect the most sensitive information at all. If a breach affects your data, we'll tell you and the authorities as the law requires.

Children

DemoReel.mov is for adults (18+). We don't knowingly collect data from children; if we learn we have, we delete it.

Changes

If we change this policy in a way that matters, we'll show the new version and ask you to agree again when you next log in. The version date is at the top of this page.

Contact

Privacy questions or requests: hello@demoreel.mov. Post: YRDZ LLC, 11400 West Olympic Blvd, Suite 200 PMB 2003, Los Angeles, CA 90064, USA. See also the Terms of Service.