Privacy Policy

Last updated: March 25, 2026

1. Overview

Reelware ("we", "us", "our") is a shoppable video commerce platform for Shopware merchants. We are committed to protecting your personal data and complying with the EU General Data Protection Regulation (GDPR). This policy explains what data we collect, why, and how we process it.

2. Data Controller

Reelware
Operated by Marvel GmbH
Germany
Email: privacy@reelware.io

3. Data We Collect

3.1 Merchant Data (when you install Reelware)

• Shop URL and shop ID — provided by Shopware during app installation
• API credentials — issued by Shopware for communication, stored encrypted
• Email address — for account communication and support

3.2 Video Data

• Videos you upload or embed (stored on EU-based servers)
• Video metadata (title, duration, thumbnails)
• Product tags you create within videos

3.3 Analytics Data

• Video view counts, play/pause events, watch percentage
• Product hotspot click counts
• Add-to-cart and conversion events (aggregate counts only)

Important: Analytics data is anonymised by default. We do not collect IP addresses, user agent fingerprints, or any personally identifiable information about your store's visitors unless you explicitly opt in to enhanced analytics with verified cookie consent.

3.4 Data We Do NOT Collect

• End customer personal data (names, emails, addresses)
• Payment information
• Browsing history of your store's visitors
• Cookies on your storefront (unless analytics opt-in is enabled)

4. How We Use Your Data

Purpose	Legal Basis
Providing the Reelware service	Contract performance (Art. 6(1)(b) GDPR)
Video storage and delivery	Contract performance (Art. 6(1)(b) GDPR)
Analytics dashboards	Legitimate interest (Art. 6(1)(f) GDPR)
Service emails (outages, updates)	Legitimate interest (Art. 6(1)(f) GDPR)
Support requests	Contract performance (Art. 6(1)(b) GDPR)

5. Data Storage & Security

• Location: All data is stored on Hetzner Cloud servers in Germany (EU).
• Encryption: Data at rest is encrypted. All traffic uses TLS 1.3.
• API credentials: Stored encrypted, never logged in plaintext.
• Access: Strict role-based access control for our team.

6. Data Retention

• Analytics events: Retained for 365 days, then automatically purged.
• Server logs: 30 days maximum.
• Deleted videos: Soft-deleted for 30 days, then permanently removed.
• Account deletion: All data permanently removed within 30 days of request.

7. Third-Party Processors

Service	Purpose	Location
Hetzner Cloud	Server hosting	Germany (EU)
Cloudflare	CDN and video delivery	EU endpoints
Wasabi	S3-compatible storage	EU region
Sentry	Error monitoring	EU data center

8. Your Rights

Under GDPR, you have the right to:

• Access your data — request a full export via Settings or the API
• Rectification — correct inaccurate data
• Erasure — delete your account and all associated data
• Data portability — export your data in JSON format
• Restriction — limit processing of your data
• Objection — object to processing based on legitimate interest

To exercise any of these rights, email privacy@reelware.io or use the GDPR section in your Reelware admin settings.

9. Cookies

The Reelware admin panel uses a session cookie for authentication. This is strictly necessary and does not require consent.

Storefront widgets do not set cookies by default. If you enable enhanced analytics, a first-party analytics cookie is set only after the visitor grants consent through your store's cookie consent manager.

10. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via email and displayed in the Reelware admin panel. The "last updated" date at the top reflects the most recent revision.

11. Contact

For privacy-related questions or concerns:
Email: privacy@reelware.io
Or use our contact form.