Privacy policy

Last updated 30 October 2026

Highreel holds data about two kinds of people: the businesses that use it, and their customers who get a Highreel, a personal highlight reel of their year. This page says what we collect from each, why, who else sees it and what you can ask of us.

1. The short version

2. Who we are

Highreel (highreel.app) is run by Redon Emini Tech, a business registered in Kosovo. For the data of businesses that use Highreel, we are the controller. For the customer data a business uploads, the business is the controller and we are its processor (see data processing terms). Questions about privacy go to hello@highreel.app.

We follow Kosovo's Law on Protection of Personal Data (No. 06/L-082), which is based on the EU's GDPR, and the GDPR itself wherever it applies to you.

3. If you use Highreel for your business

What we collect

• Your account: your email address (you sign in with a link we email you, or with Google), and if you sign in with Google, the name and email address Google shares with us. We ask Google for nothing else: not your contacts, files or email.
• Where you came from: if the link that brought you to Highreel had tags saying where it came from (such as "Made with Highreel" on someone's Highreel, an ad or a newsletter), or you came from another site, we keep those tags and that site's name (not the page you were on) with your account or demo when it starts. That's all we keep about how you found us.
• Sign-in records: for each session, when it started and was last used, and the IP address and browser it came from, to keep accounts secure. They're deleted when the session ends. Sign-in attempts are also counted per IP address to stop abuse, and those counts are deleted within a day.
• Your Highreels: the business each one is from (its name, logo and website), and what you put in it: sheets, wording, design, photos, settings.
• Your brands: the businesses you keep on Settings › Brands, or that join them from your Highreels: each one's name, logo and website.
• Feedback you send us: your note and the address to answer you at (your account's, or one you give in a demo). It's emailed to our own inbox too.
• The email account you connect to send Highreels: its server, login, sending address and name. The password is stored encrypted and only used to send your Highreels and the tests you ask for. It's never shown back, not even to you.
• Payments: Whop handles them. You pay in Whop's checkout, shown on our page, and give your email, card and billing address to Whop, not to us (we fill in your account's email address there; you can change it). We tell Whop which business and campaign a payment is for; Whop tells us what was bought, the amount and currency, when it was paid and whether it was refunded. We never see your card details.
• Sending records: when each email was sent and whether it went through, to keep to your email account's daily limit. This log holds no recipient addresses.

Why, and on what basis

• To run Highreel for you and take payment: necessary for our contract with you.
• To keep the service secure, prevent abuse and fix problems: our legitimate interest in a safe, working service.
• To see how many people visit our public pages and how they find them: our legitimate interest in improving those pages. The counts are cookie-free and build no profile of you (see cookies and storage).
• To see how people use our pages and the workspace, and where they get stuck, with PostHog: our legitimate interest in improving Highreel. It stores nothing in your browser, never records what you type, and in the workspace hides every word and picture (see cookies and storage).
• To see which ways of finding Highreel bring accounts (the tags and site above): our legitimate interest in reaching businesses that want it.
• To keep accounting records and answer lawful requests: legal obligations.
• To email you about your account, your Highreels and important changes. We don't send marketing emails unless you've agreed to them.

Who at Highreel sees it

To run the service, help you when you ask and stop abuse, our admin pages show us each account's email address, the names of the businesses its Highreels are from, when it signed up and was last signed in, where it came from (the tags and site above), and counts: how many Highreels it made and published, how many customers got one and opened, saved or shared it, how many emails it sent and what it paid. They don't show your sheets, your customers' names or contact details, or your email account's login.

We can also watch recordings of how the workspace is used (PostHog, see cookies and storage): the pages and tabs, clicks and scrolling, with every word, picture and Highreel preview hidden, so they don't show your sheets or your customers either.

If an account abuses Highreel or breaks our terms, an admin can block it: it's signed out, its email address can't sign in again, and its Highreels stop opening until we lift the block. We can also remove such an account and everything in it straight away.

The demo

You can try Highreel without an account. A demo session is anonymous and lives in your browser. If you never add your email to keep it, we delete it, and everything in it, after 30 days. If you keep it, its work moves into your account, and the Highreels it published become drafts again: their links stop working, and what was recorded about those links (visits, saves, shares, taps) is deleted.

4. Your customers' data

When a business uploads its customers, we process that data on the business's behalf and only on its instructions:

• What: what the sheet holds, usually a customer ID, a first name and numbers about the year (visits, orders, streaks and the like), sometimes an email address or phone number to send the Highreel, and any photos and wording the business adds.
• What for: making each customer's Highreel, publishing it at a private link, sending it if the business asks, and showing the business how each customer watched theirs (see section 5). Nothing else: we don't use it for our own purposes, combine it with other data, sell it or use it to train AI.
• What a Highreel shows: only the columns its slides use. Email addresses, phone numbers and customer IDs never leave our servers in one.
• Separate from other businesses: each business sees only its own data. Every request for it is checked against the signed-in account. Our own admin pages count a business's rows, opens and shares, never what's in them.

The business is responsible for having the right to use its customers' data this way, and for answering their requests (see our terms).

5. If you received a Highreel

A business you're a customer of made your Highreel (your personal highlight reel) with our service, from data it holds about you. That business decides what goes into it; we host and deliver it for them.

• Your Highreel shows your first name, the numbers on its slides and the business's brand. Anyone with the link can open it, so share it only with people you want to. It's kept out of search engines.
• What we record when you open it: each visit (each time the page is opened and stays on screen for at least two seconds, or sooner if you save, share or tap something on it): when it was, how far you got and how long each slide was on screen, whether you watched to the end, went back, skipped ahead or watched it again, and whether you saved images, shared it or tapped the business's button. With it, how the link reached you (the business's email, or another way), whether you opened it on a phone, tablet or computer, the app it opened in if it opened inside one (such as Instagram or Facebook), and your country. The business that sent your Highreel sees these, for you and in total; nobody else does. Beyond these, we don't keep your IP address or anything else your browser sends, its page sets no cookies of ours and stores nothing on your device, and nothing is combined across Highreels or businesses, used for advertising or sold. The same is recorded for everyone who opens a Highreel, children included: nothing more. Opens by the business itself, while it's signed in to Highreel on that browser, aren't counted.
• Its links: unless the business turned this off, its button's link carries tags with the Highreel's name, so the business's own website can count the visits its Highreels bring. "Made with Highreel" tells us which business's Highreel it was on. Neither says who you are.
• Music: if the business added a song, your Highreel opens on a Play button and plays the song through YouTube's own player, loaded from youtube-nocookie.com and hidden while it plays. Loading it sends Google your IP address and details about your browser, and YouTube may store its settings in your browser, under Google's privacy policy. A Highreel without a song loads nothing from Google or YouTube.
• Link previews: when your link is shared in a chat or a post, the preview image shows your first name, the business and two of your numbers.
• Emails: if the business emailed you your Highreel, it came from their own email account. Its logo loads from our servers, the same image in everyone's email, so loading it doesn't tell anyone you opened yours. Every one has an unsubscribe link: one click and that business emails you no more Highreels. If an email to you bounced, we remember the address for that business so it isn't tried again.
• Your rights: to see, correct or delete your data, ask the business that sent your Highreel. You can also write to us at hello@highreel.app, and we'll pass your request on and help them answer it.

6. Cookies and storage

• Signing in sets a cookie that keeps you signed in to the workspace for 30 days after your last visit. It's needed for the workspace to work and isn't used for anything else.
• The sign-in page, and the box for keeping a demo's work, load Cloudflare Turnstile, which checks that a person, not a bot, is signing in. It looks at signals from your browser for that check only.
• Your browser may keep a light or dark display setting in its local storage.
• Paying for a campaign loads Whop's checkout, on that step only. It runs in Whop's own frames, with Whop's fraud checks and payment partners, which may set their own cookies or read signals from your browser to prevent fraud, under Whop's privacy policy.
• Our home page, the examples, these terms and privacy pages and the sign-in page load Cloudflare Web Analytics to count visits: the page, the site you came from, your country, the kind of browser and device, and how fast the page loaded. It sets no cookies, stores nothing in your browser and doesn't track you across sites. Highreels and unsubscribe pages don't load it.
• The same pages and the workspace also load PostHog, to see how they're used: the pages you open and the site you came from, the buttons you press, steps such as starting a demo, creating or publishing a Highreel and paying, and a recording of the page as you use it (scrolling, clicks, what's on screen), with your country, browser and device. What you type is never recorded. In the workspace the recording hides every word and picture and the Highreel preview, clicks there are recorded without their words, and so your sheets and your customers never reach PostHog. Once you're signed in, your visit is linked to your account's ID, never to its email address, and for a new account, to where it came from (the tags and site in section 3). It sets no cookies and stores nothing in your browser, so it doesn't recognize you on a later visit or on other sites. Highreels, unsubscribe pages and the page a sign-in link opens don't load it, and neither do our admin pages.
• A Highreel with a song loads YouTube's player, from youtube-nocookie.com (YouTube's privacy-enhanced mode), to play it. YouTube may store data in your browser for the player, under Google's privacy policy. Highreels without a song don't load it.
• We don't set cookies for people viewing a Highreel or our home page, and we use no advertising, analytics or social media cookies.

7. Who we share data with

We use a few providers to run Highreel. They process data only for us, under data processing agreements:

• Cloudflare: hosting and delivering the site, our database (accounts and sign-in included) and the logos and photos businesses upload, stored in the EU; the bot check on signing in (Turnstile); and counting visits to our public pages (Web Analytics). Like any host, it handles visitors' IP addresses to deliver pages and block attacks.
• PostHog: seeing how our pages and the workspace are used (see cookies and storage), stored in the United States. It gets the pages visited, the steps taken, recordings with the workspace's words and pictures hidden, a signed-in account's ID (with a new account's tags and referring site), and the visitor's IP address, from which it works out the country. It never gets a business's sheets or its customers' data.
• Resend: sending our sign-in emails, and your feedback to our own inbox. It gets the address the email goes to and the email itself: its sign-in link, or your note and the address to answer you at.
• Whop: payments, for businesses that buy a campaign. Whop is the seller of record for those payments: it takes them, collects sales tax or VAT where it applies, and looks after the payment details you give it under its own privacy policy. Whop also keeps a customer account for the email address you pay with, which you can claim on Whop to see your receipts. We share with it which business and campaign a payment is for, and fill in your account's email address in its checkout.

If you sign in with Google, Google tells us your name and email address under its own privacy policy; we use them only to sign you in.

If a business adds a song to a Highreel, it plays through YouTube's own player, which loads straight from YouTube into the viewer's browser: Google receives the viewer's IP address and browser details under its own privacy policy, as a separate company, not as our provider. When a business searches for a song in Highreel, our server sends YouTube the words searched, and nothing about the business or its customers.

Emails with Highreels go through the business's own email provider, which the business chooses and has its own agreement with. WhatsApp messages are sent by the business from its own device.

Some of these providers may process data outside Kosovo and the European Economic Area. Where they do, we rely on safeguards such as the EU's Standard Contractual Clauses. We'll also share data if the law requires it, and if Redon Emini Tech or Highreel is ever sold or merged, the new owner takes on these commitments and we'll tell you first.

8. Security

• Everything travels over HTTPS. Email account passwords are encrypted before they're stored.
• Every request for a business's data is checked against the signed-in account, so no business can see or change another's.
• Highreel links use long random codes that can't be guessed or listed, and their pages tell search engines not to index them.
• Only the people who need it to run Highreel can reach the production systems, and only accounts we've made admins can open the admin pages.

If a breach affects your data, we'll tell you without undue delay, and the authorities where the law requires it.

9. How long we keep data

• Highreels and customer data: until the business deletes the campaign or its account. Deleting a campaign deletes its rows, Highreels and photos straight away, and what was recorded when its Highreels were opened (section 5) with them.
• Unsubscribes and bounced addresses: kept per business for as long as its account exists, so a later campaign doesn't email those people again.
• Accounts: until you ask us to delete yours, then within 30 days. We keep a note of the request (your email address and its dates) for 30 days after that, to confirm it to you. Demo sessions that are never kept: 30 days.
• Where an account came from: as long as the account (or the demo, if it's never kept) and deleted with it.
• Your brands and your feedback: as long as the account (or the demo, if it's never kept) and deleted with it. Deleting a brand deletes it and its logo straight away; the Highreels that picked it keep their own copy until they're deleted. Feedback also stays in our inbox, where we keep it to answer and improve Highreel.
• Blocked addresses: if we block an account for abuse, we keep its email address, when it was blocked and a short note on why until we lift the block, also after the account is removed, so it can't sign up again.
• How our pages are used (PostHog): recordings for 30 days, page views and steps for a year.
• Backups made by our database provider expire within 30 days. Payment and accounting records are kept as long as tax law requires.

10. Your rights

You can ask to see the data we hold about you, correct it, delete it, limit or object to how we use it, or get a copy to take elsewhere. Where we rely on your consent, you can withdraw it at any time. Write to hello@highreel.app; we answer within 30 days. If your data came to us from a business (you received a Highreel), we'll involve that business, since it decides about your data.

If you're not happy with our answer, you can complain to Kosovo's Information and Privacy Agency, or to the data protection authority where you live.

11. Children

Highreel is for businesses, not for children to use. When a business such as a camp or a school makes Highreels about children, it's responsible for having the right to, as with all its customer data. Opening a child's Highreel records only what opening any Highreel does (section 5). A parent can ask the business, or us, to take a child's Highreel down.

12. Data processing terms

For businesses: this section and our terms are the data processing agreement between you (controller) and Redon Emini Tech (processor) for the customer data you upload, as Article 28 of the GDPR and Kosovo's law require. We will:

• process it only to provide Highreel to you, following your instructions (what you do in the app counts as instructions), unless the law requires otherwise, and tell you if we think an instruction breaks the law;
• make sure anyone who can access it is bound to keep it confidential;
• protect it with the measures in section 8;
• use only the providers in section 7, under terms that protect the data as well as these do, and tell you before adding or replacing one, so you can object;
• help you answer your customers' requests and meet your own obligations, including security, breach notices and impact assessments;
• tell you without undue delay after we become aware of a breach affecting your data;
• delete it when you delete it in the app, or when our service to you ends, except where the law requires us to keep it;
• give you the information you need to show this agreement is kept, and answer reasonable questions about it.

The data is about your customers (the people in your sheets): their identifiers, first names, the numbers and details in your columns, contact details if you add them, and how they watched their Highreels (section 5). We process it for as long as you use Highreel.

13. Changes and contact

When we change this policy, we update the date at the top, and for changes that matter we email account holders before they apply. Questions, requests or complaints: Redon Emini Tech, hello@highreel.app.