Privacy Policy

Effective September 23, 2026 · Last updated September 29, 2026

The short version: we collect what we need to host and stream your videos, bill you, and show you how your videos are watched. We don't sell personal information, we don't use ad trackers, and we don't train AI on your content.

1. Who this covers

This policy explains how Box Out Marketing Inc. (“VidReef,” “we”) handles personal information for two groups:

Customers: people who create an account, upload or import videos, and use the dashboard. For this information we're the controller.
Viewers: people who watch videos our customers host with us, in an embedded player or on a share page. For viewing information we act as the customer's processor (service provider): the customer who owns the video decides how it's used, and their own privacy notice applies. If you're a viewer with a question, please contact the website where you watched; we'll help them respond.

2. What we collect

From customers

Account details: name, email address, and password (stored only as a secure hash), plus your workspace name and settings.
Billing details: your plan, billing history, and billing contact details. Card numbers are entered on and held by our payment processor, Stripe; we never see or store them.
Your content: videos you upload or import, audio extracted for captions, thumbnails, captions, transcripts, titles, descriptions, tags, and folders.
Import connections: API keys or tokens you give us to import from other services, stored encrypted and used only for your imports.
Referrals and promo codes: your share-link code, who signed up through it, credit earned, and any promo code you used.
Team invitations: the email address and role of people you invite, who invited them, and whether they accepted. We email each invitee once per invitation (and again only if you resend it), and use their address for nothing else.
Support and messages: anything you send us.

From viewers (on behalf of our customers)

When someone plays a video, the player reports:

which parts of the video were watched and for how long, tied to a random session ID;
an anonymous visitor ID kept in the browser's local storage, used only to count unique viewers;
the website the video was embedded on;
approximate country, derived from the IP address by our content delivery network (we don't store the IP address with analytics);
device type (desktop, mobile, tablet, TV), derived from the browser's user agent;
an identifier such as an email address, only if the website owner deliberately provides one: in the player link, or through the VidReef WordPress plugin, which (when the owner leaves it on) passes along the email address or an anonymous member ID of the person logged in to their site. Website owners who do this are responsible for telling their members.

From everyone who uses our site

Our hosting and delivery providers process IP addresses, browser details, and request logs to deliver pages and video and to protect the Service from abuse. We don't use third-party advertising or analytics trackers on VidReef.

3. Cookies and local storage

Name	Where	Purpose	How long
Sign-in session cookie	vidreef.com	Keeps you signed in. Essential.	Until you sign out or it expires
vr_ref (cookie)	vidreef.com	Remembers which share link brought you here, so the referral is credited. Set only when you open a share link.	30 days
vr_visitor (local storage)	Video player	Anonymous ID used to count unique viewers.	Until cleared
vr_expanded_folders (local storage)	Dashboard	Remembers which folders you expanded.	Until cleared

Stripe sets its own cookies on its checkout and billing pages to process payments and prevent fraud.

4. How we use information

To provide the Service: storing, processing, and streaming videos; generating thumbnails, previews, and captions; and enforcing the privacy and domain settings you choose.
To show customers analytics about how their videos are watched.
To run billing, plans, and the referral program.
To keep the Service secure, prevent fraud and abuse, and enforce our Terms.
To provide support and send service messages (such as receipts, security notices, and changes to our terms).
To send product news, which you can unsubscribe from at any time.
To understand and improve the Service using aggregated statistics that don't identify anyone.
To comply with the law.

AI and your content. Captions and transcripts are generated by speech-recognition models that run on our own cloud infrastructure. We don't use your videos, audio, or transcripts to train AI models, and we don't send them to third-party AI companies.

If you're in the European Economic Area or the UK, our legal bases are: performing our contract with you (providing the Service), our legitimate interests (security, improving the Service, and limited direct marketing to customers), your consent where we ask for it, and legal obligations.

5. How we share information

We don't sell personal information, and we don't share it for cross-site advertising. We share it only:

with the customer who owns a video, in the form of that video's viewing analytics;
with service providers that process it for us under contracts requiring them to protect it (listed below);
when the law requires it, or to protect the rights, property, or safety of our users, the public, or VidReef;
as part of a merger, acquisition, or sale of assets, subject to this policy.

Provider	What they do for us	Location
Amazon Web Services	Hosting, storage, video processing, speech recognition, video delivery, and sending account emails	United States
Neon	Database hosting	United States
Stripe	Payments and billing	United States
HighLevel	Customer relationship management: account owners' and team members' names, email addresses, phone numbers, companies, and plan, for onboarding and account emails	United States
Cloudflare	Domain name (DNS) service	United States

We'll update this list when we add a provider that handles personal information.

6. Where information is stored

We store and process information in the United States. If you use the Service from elsewhere, your information is transferred to the U.S., where privacy laws may differ from yours. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. How long we keep it

Account information: while your account is open, then as needed for legal, tax, and accounting purposes.
Your content: until you delete it. A deleted video stays in Recently deleted for 30 days, so you can restore it, and is then deleted for good. When an account is closed, we delete its content 30 days later. Copies in backups are removed on their normal schedule: previous versions of stored files after 30 days, database backups after 35 days, and offsite copies of original uploads 90 days after deletion.
Viewing analytics: while the video they relate to exists; deleting a video for good deletes its analytics.
Billing records: as long as tax and accounting law requires.

8. Security

We protect information with encryption in transit (HTTPS) and at rest, signed and expiring links for video streams, domain restrictions you control, hashed passwords, encrypted import credentials, and access limited to people and systems that need it. No system is perfectly secure; if a breach affects your personal information, we'll notify you and the authorities as the law requires.

9. Your choices and rights

You can view and update your account details in the dashboard, and delete videos at any time. Depending on where you live, you may also have the right to access, correct, download, or delete your personal information, to object to or restrict some uses, and to withdraw consent. To make a request, email legal@vidreef.com. We'll verify your identity and respond within the time the law requires (usually 30 days, or 45 for California). You may use an authorized agent, and we won't treat you differently for exercising your rights.

California residents: in the past 12 months we collected the categories described in What we collect (identifiers, commercial information, internet or network activity, approximate location, and customer content) for the purposes in How we use information. We don't sell or share personal information as those terms are defined in California law, and we don't use sensitive personal information to infer characteristics about you.

EEA and UK residents can also complain to their local data protection authority.

10. Children

VidReef isn't intended for anyone under 16, and we don't knowingly collect their personal information for accounts. If you believe a child has given us personal information, contact legal@vidreef.com and we'll delete it.

11. Changes to this policy

We'll update this policy as the Service changes. If we make material changes, we'll notify customers by email or in the Service before they take effect. The date at the top shows the latest version.

12. Contact

Box Out Marketing Inc., 2712 Loker Ave W #1091, Carlsbad, CA 92010. Privacy questions and requests: legal@vidreef.com.