Privacy policy

Last updated: 29 October 2026

1. Who is responsible

Empor Rocket Private Limited, 302, Lotus Siddhi, Anna Purna Housing Society Road, Aundh, Pune, Maharashtra 411007, India, sells and operates HyperReel (hyperreel.ai) in India and decides why and how your personal data is processed. Under the Digital Personal Data Protection Act, 2023 we are the data fiduciary. The platform is run technically by HyperReel UG (haftungsbeschränkt), Germany, which processes data on our behalf.

Questions about your data and requests to use your rights go to grievance (at) hyperreel.ai (Komal Mishra, Grievance Officer).

2. What we collect and why

• Account: your name, your e-mail address and your password (stored only in hashed form). If you sign in with Google, we receive your name and e-mail address from Google. Purpose: to create and secure your account and to write to you about it.
• Sessions and security: IP address, browser type, and the time of sign-ins and requests. Purpose: to keep you signed in, to limit abuse and to find faults.
• Your product information: the link to your product page, texts you type in, product photos, your logo, and the choices you make while creating an ad. We also load the product page you name in order to read its public content. Purpose: to generate your videos. If you paste that link on our home page before you have an account, it travels in the address of the sign-up, log-in and welcome pages (and the first page of the ad wizard) and in the link of the confirmation e-mail, so the Meta and Google tags (advertising measurement, below) receive it as part of the page address there, unless you declined them.
• Generated content: scripts, scene images and videos made for you. Purpose: to deliver them to you and to keep them available in your account.
• Payments: the plan or top-up you bought, amount, date, payment reference, receipts and your credit history. Your card, UPI and bank details are entered with Razorpay. We never see or store your full card number, UPI PIN or bank password. Purpose: to bill you, to add credits, and to keep the records that tax and company law require.
• Advertising measurement: when you visit our website, Meta (Facebook, Instagram) and Google set advertising cookies and receive the pages you view, your IP address and browser data, and the click identifier of an ad that brought you here. When you create an account, open a checkout, pay or get your first video, we tell them that this happened (for a checkout or a payment: the amount), for an account and a payment together with your e-mail address in hashed form, so they can measure which ads work. We keep the ad, campaign and placement or search keyword that brought you, the page you landed on, the language your browser is set to and, if an app's built-in browser opened the page (for example Facebook or Instagram), which app it was, on your account, and your IP address, browser data and the Meta cookie identifier, to report your purchases to Meta. Purpose: to measure and improve our advertising. You can decline this in the bar at the bottom of the site; the service works the same either way.
• Messages: what you write in the contact form or by e-mail, including requests for a copy or the deletion of your data. Purpose: to answer you.

We only ask for data we need for these purposes. Please do not upload personal data of other people, for example photos of real persons, unless you have their permission.

3. Legal basis

We process your data on the basis of the consent you give when you create your account, and for the uses the law allows without consent, such as meeting legal obligations. You can withdraw your consent at any time (see section 8). Without the data marked above we cannot provide the service. Advertising measurement (section 2) also covers visitors without an account and runs unless you decline it in the cookie bar at the bottom of the site.

4. How AI is used

• To generate your videos, we send your product information, texts and images, and the spoken lines of your video, to the AI providers named in section 5: Anthropic (language model), fal (image models, and the video model that renders some clips on paid plans), RunPod (graphics servers that run the video models) and ElevenLabs (speech recognition that times captions and cuts, and the voice-over when the standard voice path is not available). We share only what is needed to make your video.
• We do not use your content to train our own AI models. How each provider handles the data it receives is set out in its own privacy policy, linked in section 5.
• Your account is not subject to decisions made only by automated means that have legal effects for you.
• Every video and image we deliver also carries a reference code in its metadata that lets us, and only us, find the account it was made in, for example to act on a complaint. It contains no name or e-mail address. A voice-over file we deliver carries our machine-readable mark and reference code too, and the voice-over in the scenes ZIP starts with a spoken notice that it is synthetically generated.

5. Who receives your data

We do not sell personal data. We use the following service providers. They receive only what they need for their task. Where a provider publishes its own privacy policy, its name links to it.

We also disclose data when a law, a court or an authority requires it, and to professional advisers bound to confidentiality.

6. Transfer outside India

Our servers are in the European Union, and some providers are in the United States. Your data is therefore processed outside India. We transfer data only to countries to which Indian law permits the transfer, and we require our providers to protect it.

7. Cookies

The service needs these cookies to work: one cookie that keeps you signed in (up to 30 days), one short-lived cookie that records your consent during sign-up (10 minutes), and one cookie that remembers whether you chose the light or the dark design (one year). For advertising measurement (section 2), Meta sets its cookies _fbp and _fbc (the ad click) and Google its _gcl cookies (up to 90 days each), our own cookie hr_attr keeps the ad click, campaign and placement or search keyword that brought you, the ad's id, the page you landed on, your browser's language and the app whose browser opened it (90 days), and hr_consent keeps your choice in the cookie bar (one year). If you choose Decline in the bar, the Meta and Google tags stop measuring for you and hr_attr is deleted; to change your mind later, clear this site's cookies (for your account, write to us). Besides the Meta and Google tags, the only script we load from a third party is the feedback and chat widget of Starko (see section 5). It loads only while you are signed in, in your account area and in the video wizard, and receives what you type into it and the technical data your browser sends with every request, such as your IP address. It also records a session replay of what you do on those pages (clicks, scrolling, what is on screen), which we use to improve the site. To know how often our public pages are visited and where visitors come from, we keep visit statistics without a cookie, also when you choose Decline. For each visit of a public page they record the page and the time, the website that linked to it, the campaign tags of an ad link, including which ad and campaign it was (and which kind of ad click it was, not the click identifier), the type of device (phone, tablet or computer) and the approximate location (country, region and city), which our own server looks up from your IP address in an offline database (IP geolocation by DB-IP), the language your browser is set to and, if an app's built-in browser opened the page, which app it was. They also record how long the page was visible, how far it was scrolled (in quarters) and which of our buttons and links were clicked, by a fixed name for each. These statistics are no recording of your screen: they hold no pointer positions and no text you type, with one exception: when you press the button next to the link field on our home page, we keep what the field held (at most 300 characters; an e-mail address or a phone number is replaced by a placeholder) and whether it was accepted, with that visit, and the same for a link the video wizard could not accept (not linked to your account). Not after you choose Decline. Our server also counts the arrivals from ad links per hour, by ad and kind of ad click, without any IP address, code or other detail about the visitor. The visit statistics contain no IP address. To count unique visitors, they keep a pseudonymous code that changes every day, so within the statistics your visits cannot be linked across days. Technical server logs are described in section 9.

When you are signed in we also keep, linked to your account, which pages of your account area and the video wizard you open, for how long they are visible, how far they are scrolled and which of our buttons are clicked (fixed names, never what you type), and when and how often you play and download a finished video. When you open a link in one of our e-mails, the link carries a reference to that e-mail, so we record when and how often it was opened from the e-mail; we do not track opens of the e-mail itself. If you choose Decline in the cookie bar while signed in, nothing more is linked to your account on any device; write to us to undo it. If you choose Decline in a browser where you have not signed in yet, that browser is never linked, and the choice reaches your account the first time you sign in there. We still record that we sent you a “your ad is ready” e-mail and whether it was delivered.

If you have not confirmed your e-mail address, we send you up to two reminders; on the free plan we also send you one e-mail a few hours after you first play a finished video (recorded as described above), asking how you liked it (with a link to rate your video with stars and an optional comment, which we keep with your account until you close it), and up to two e-mails offering bonus credits; each of these three carries a link where you can stop these e-mails, and turn them on again, without signing in.

8. Your rights

• Access: you can ask what personal data we hold about you, what we do with it and who received it, and ask for a copy.
• Correction: you can have wrong or incomplete data corrected or updated.
• Erasure: you can have your data and your account deleted. Data we must keep by law, such as payment records, is kept until the legal period ends.
• Withdrawing consent: you can withdraw your consent at any time. It is as easy as giving it: write to us or use the settings of your account. We then stop processing and delete your data, except for what we must keep by law. We can no longer provide the service after that.
• Nomination: you can name a person who may use your rights for you in case of your death or incapacity.
• Complaint: you can complain to our grievance officer (section 12). If our answer does not settle your complaint, you can then complain to the Data Protection Board of India, the authority set up under the Digital Personal Data Protection Act, 2023.

To use your rights, open the settings of your account (“Request my data”, “Delete my account”) or write to grievance (at) hyperreel.ai from the e-mail address of your account. We answer within one month.

9. How long we keep data

• Account data: for as long as your account exists.
• The ad and campaign that brought you, and the IP address, browser data and Meta cookie identifier kept for advertising measurement: for as long as your account exists; deleted when you close it.
• Registration data (your name, your e-mail address and the date you signed up): for 180 days after your account is closed, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require. This held copy is then deleted. What remains: your account record stripped of your name and e-mail address (it keeps the sign-up date and a one-way code of your e-mail address, kept only so that a new account under the same address gets no second free credits), your name and e-mail address on the receipts of your payments (kept as payment records, see below), and the requests and messages you sent us through our website, including the contact form, or by e-mail, such as the request to delete your account, in our support records.
• Product information and videos: until you delete them or your account. Deleted items stay in a recycle bin for 30 days and are then removed.
• Content we remove after a complaint, because it breaks the law, or on the order of a court or an authority: kept, no longer visible to anyone, for 180 days for investigation, or longer when a court or an authority requires it.
• Payment records and receipts: for as long as tax and company law requires, at present eight financial years after the financial year of the payment (Companies Act, 2013).
• Visit statistics (page, time, referring site, campaign, device type, browser language, in-app browser, time on page, scroll depth, button clicks, approximate location, what the home page's link field held), the links the video wizard could not accept, and the hourly counts of arrivals from ads: 13 months.
• The pages of your account area and the video wizard you opened while signed in (with time visible, scroll depth and button clicks), and when you played and downloaded a finished video and opened our e-mail links: 13 months, or until you close your account.
• The record of each e-mail we sent you (subject, when it was sent, whether it was delivered) with its click data (how often and when its links were opened): 180 days; the click data is removed from it when you close your account.
• Records of processing, with the related traffic data and technical logs: for one year from the date of the processing, for security and to investigate misuse, also after you close your account. They are then deleted, unless another law requires us to keep them longer.

10. Security

We protect your data with encrypted connections, hashed passwords, access limited to the people who need it, and separation of every customer’s files. These measures are part of a documented information security programme that we review at least once a year. No system is perfectly secure. If a breach affects your personal data, we inform you and the Data Protection Board of India as the law requires.

11. Children

The service is for adults. You must be at least 18 years old to create an account. We do not knowingly collect data of children. If you believe a child has given us data, write to us and we delete it.

12. Complaints and contact

Grievance officer: Komal Mishra, Empor Rocket Private Limited, 302, Lotus Siddhi, Anna Purna Housing Society Road, Aundh, Pune, Maharashtra 411007, India. E-mail: grievance (at) hyperreel.ai. Phone: +91 95661 55916. We acknowledge a complaint, including a complaint about your personal data, within 24 hours and resolve it within 7 days. Requests to use your rights (section 8) are answered within one month. Complaints about content also have removal times, set out on the legal disclosures page.

13. Users outside India

If you use the service from the European Economic Area or the United Kingdom, you also have the rights that the data protection law there gives you, including the right to object, the right to data portability and the right to complain to your local data protection authority.

14. Changes

When we change this policy, we publish the new version here and change the date at the top. We tell you about important changes by e-mail or in your account before they apply.

Questions? Contact us · Back to the start page