FlowShorts Privacy Policy
Last updated: 27 October 2026
This policy explains how FlowShorts collects, uses and shares your personal data when you use flowshorts.com and the FlowShorts app (the Service). By creating an account you confirm you have read it.
1. Who we are
FlowShorts is operated by Mercury International Ltd., registration number 205797744, Spas Sokolov 3, Sofia, Bulgaria (we, us). We are the data controller for the personal data described in this policy.
Contact for privacy questions or complaints: support@reelshow.com. Postal: the address above, marked “FlowShorts – Privacy”.
FlowShorts is a separate service from ReelShow. ReelShow’s privacy policy does not apply to FlowShorts, and FlowShorts accounts are not shared with ReelShow.
The Service is only for people aged 18 or older.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password hash or sign-in provider ID, age confirmation | You |
| Content you create | Topics, prompts, scripts, series settings, uploaded images of fictional characters, captions, generated videos, schedules | You and the Service |
| Token and payment data | Packs bought, token balance and usage, refunds, billing country and address (for tax), card brand and last four digits | You and Stripe |
| Connected account data | Platform account ID, username, profile picture, access and refresh tokens, post IDs and status, and post analytics (views, likes, comments count, shares, followers) | YouTube, TikTok, Instagram, Facebook — only with your permission |
| Usage and device data | Pages and features used, clicks, errors, IP address, browser, device, approximate location from IP | Collected automatically, including via PostHog |
| Communications | Support messages, feedback, abuse reports | You |
We never receive your full card number; Stripe processes it. We do not ask for, and you must not upload, sensitive data such as health information or government IDs. We do not collect biometric data: the Service does not allow uploads of real people’s faces or voices.
3. How we use it and our legal bases
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Create and run your account; generate scripts, voiceovers, visuals, music and videos | Contract |
| Sell token packs, keep your balance, process refunds and chargebacks, calculate tax | Contract; legal obligation (tax and accounting) |
| Post and schedule videos you approve to your connected accounts, and show you their analytics | Contract; your consent when you connect each account |
| Prevent fraud, payment abuse, multiple-account bonus abuse and misuse of the Service | Legitimate interests (keeping the Service and users safe) |
| Enforce our Terms and Acceptable Use Policy, respond to legal requests | Legitimate interests; legal obligation |
| Product analytics to fix bugs and improve features | Consent where required for cookies; otherwise legitimate interests |
| Service emails (receipts, security, policy changes) | Contract |
| Marketing emails | Consent; unsubscribe any time |
We do not sell your personal data, share it for cross-context behavioural advertising, or use it for automated decisions that have legal or similarly significant effects on you. We do not use your prompts, uploads or videos to train AI models (see section 5).
4. Connected social accounts
You can connect YouTube, TikTok, Instagram and Facebook accounts. We only access them through each platform’s official API, with the permissions you approve on the platform’s own sign-in screen. We use that access only to:
- show which account is connected (account ID, name, profile picture);
- upload and publish videos you have reviewed and approved, with the caption and settings you chose;
- read analytics for videos posted through FlowShorts and your account, to show them to you in FlowShorts.
We never post anything you have not approved, never read or send direct messages, never sell platform data, never use it for advertising, and never use it to train AI models. We do not share it with anyone except the service providers in section 6 who help us run the Service.
You can disconnect an account at any time in Settings → Connected accounts. When you do, we delete its access tokens immediately and delete the other data we got from that platform within 7 days, except post records we must keep for billing or legal reasons.
YouTube
FlowShorts uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy. You can revoke FlowShorts’ access at any time through the Google security settings page. If you revoke there, we delete the related data within 30 days; if you disconnect inside FlowShorts or ask us to delete it, we delete it within 7 days. Stored YouTube data is refreshed or deleted at least every 30 days.
FlowShorts’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
TikTok
We use TikTok’s Login Kit and Content Posting API. Before each post you see the video, caption and privacy setting, and you confirm it. TikTok’s handling of your data is covered by TikTok’s Privacy Policy. You can also remove FlowShorts in your TikTok app under Settings and privacy → Security → Apps and services permissions.
Instagram and Facebook
We use Meta’s APIs, which require an Instagram professional (Business or Creator) account linked to a Facebook Page. Meta’s handling of your data is covered by Meta’s Privacy Policy. You can remove FlowShorts in your Facebook Settings → Business integrations. To ask us to delete data we received from Meta, follow our Data Deletion Instructions.
5. AI processing
FlowShorts generates scripts, voiceovers, images, video clips and music using third-party AI models accessed through fal (Features and Labels, Inc., USA). When you generate content, we send the prompt, script, settings and any character images you uploaded to fal and the model provider fal routes the request to. The models available change over time.
- We do not use your prompts, uploads or generated videos to train or fine-tune AI models, and we do not allow our providers to do so for their own purposes, to the extent our contracts with them allow us to control this.
- AI outputs can be inaccurate. Do not put personal data about other people into prompts.
- We may run automated safety checks (ours or the model provider’s) on prompts and outputs to block prohibited content. Blocked requests are logged for abuse prevention.
6. Sharing and service providers
We share personal data only as described here. Our service providers process it on our instructions under written contracts.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage, email delivery | USA |
| fal (Features and Labels, Inc.) and the AI model providers it routes to | Generating scripts, voice, images, video, music | USA; some model providers elsewhere |
| Stripe | Payments, fraud checks, tax calculation | USA / EU |
| PostHog | Product analytics | USA |
| YouTube (Google), TikTok, Meta | Publishing the videos you approve to your accounts | Per each platform |
We also disclose data when the law requires it, to protect the rights, safety or property of users, the public or us, or as part of a merger, acquisition or sale of assets (you will be told before your data becomes subject to a different policy). Videos you publish are public on the platform according to the privacy setting you choose.
7. International transfers
We are based in the EU, but our hosting and several providers are in the USA. When we transfer personal data outside the European Economic Area or the UK, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (and the UK Addendum), plus additional safeguards where needed. You can ask us for a copy of the relevant safeguards at support@reelshow.com.
8. How long we keep data
| Data | Kept for |
|---|---|
| Account data, prompts, uploads, generated videos | While your account is active; deleted within 30 days after you delete the item or your account |
| Platform access tokens | Deleted immediately when you disconnect the account or delete your FlowShorts account |
| Other data from YouTube, TikTok, Meta (incl. analytics) | Refreshed or deleted at least every 30 days; deleted within 7 days of disconnecting (30 days if you revoke via Google) |
| Payment, token purchase and refund records | Up to 10 years, as required by Bulgarian accounting and tax law |
| Server and security logs | 90 days, longer only while investigating abuse or a security incident |
| Records of policy violations and bans | As long as needed to prevent repeat abuse, up to 3 years after the account is closed |
| Backups | Overwritten within 30 days |
We may keep data longer where needed to establish, exercise or defend legal claims.
9. Your rights
Everyone. You can view and edit most data in your account settings, delete videos, disconnect platforms and delete your account in Settings → Account. You can email support@reelshow.com for anything else. We answer within 30 days (45 days where US state law applies) and may need to verify your identity. We will not treat you differently for using your rights.
EU, EEA and UK. You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. You can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg), your local data protection authority, or in the UK the Information Commissioner’s Office (ico.org.uk).
United States. Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas), you may have the right to know what personal data we hold, to access, correct and delete it, and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal data for targeted advertising. You can appeal a refusal by replying to our decision; if we deny the appeal you may contact your state Attorney General. An authorized agent may make a request for you with your signed permission.
Philippines. Under the Data Privacy Act of 2012 you have the right to be informed, to access, object, erase or block, correct, port your data and claim damages, and to complain to the National Privacy Commission (privacy.gov.ph).
Other countries. We honour the rights your local law gives you.
10. Cookies and analytics
We use strictly necessary cookies to keep you signed in, secure your session and remember your cookie choices. These cannot be turned off.
We use PostHog for product analytics (which pages and features are used, errors, performance). In the EU, EEA and UK, PostHog cookies and similar storage are only set after you accept analytics in our cookie banner; you can change your choice at any time via Cookie settings in the site footer. Elsewhere you can opt out through the same link.
We do not use advertising pixels or cross-site tracking. If that changes, we will update this policy and ask for consent where required. See our Cookie Policy for the full list.
11. Security
We use encryption in transit (TLS), encrypt platform access tokens at rest, limit staff access to what their job needs, and review our providers’ security. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
12. Children
FlowShorts is only for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn an account belongs to someone under 18, we will close it and delete its data. Contact support@reelshow.com if you believe this has happened.
13. Changes to this policy
We will post any change here and update the date at the top. If a change materially affects how we use your data, we will tell you by email or in the app at least 30 days before it takes effect, and ask for your consent where the law requires it.
14. Contact
Mercury International Ltd. (FlowShorts), Spas Sokolov 3, Sofia, Bulgaria · support@reelshow.com