Privacy Policy

This policy explains which personal data we process when you visit ListingReels and use the video generator, why we do it and which rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Tutto Digital, Dario Tuttobene, Auf'm Kamp 3, 51381 Leverkusen, Germany
Email: b2b@tutto-digital.com · Phone: +49 2171 378 6178
See also our imprint.

2. Hosting and server log files

The website and the video generator run on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. When you open the website, the server processes technical data (IP address, date and time, requested page, browser and operating system) to deliver the website and keep it secure (Art. 6 (1) (f) GDPR). Log files are deleted after 14 days.

3. Creating videos

To create a video, you give us listing data: a link to a listing page, photos, an exposé, a description, price and key facts. We use this data only to create your video (Art. 6 (1) (b) GDPR). Photos, voiceover and finished videos are stored on our server so you can watch and download them.

We use the following providers to create the video. They receive only the data needed for their step:

• OpenAI (OpenAI, L.L.C., USA / OpenAI Ireland Ltd.) writes the script, captions and translations from the listing data.
• ElevenLabs (Eleven Labs Inc., USA) turns the script into the voiceover.
• HeyGen (HeyGen Inc., USA) animates the presenter to the voiceover.
• Replicate (Replicate Inc., USA) sharpens low-resolution listing photos.

Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses (Art. 46 GDPR). Listing data should not contain personal data of third parties, such as the names of sellers or people recognisable in photos.

4. Your own avatar

If you create your own presenter, you upload a photo of yourself or of a person who has agreed to it. We send the photo to HeyGen (HeyGen Inc., USA), which creates a talking avatar from it; the photo and the avatar are stored at HeyGen and the avatar is used only for your videos. We store the name of the avatar and a record of the declarations you confirmed when creating it (which text, when), to be able to prove the consent.

Legal basis is your consent (Art. 6 (1) (a) GDPR) and, for photos of other people, their consent obtained by you. The photo is not used to identify anyone. You can delete the avatar at any time on the "My avatar" page; this deletes the photo and the avatar at HeyGen and on our server. Withdrawing consent does not affect videos already created. If your plan ends, we delete the avatar within 30 days.

5. Protection against abuse

Creating videos costs us money with every provider. To protect the service from abuse, we count the videos and voice previews created per IP address (for IPv6 per network) and day, and check that requests come from our own website (Art. 6 (1) (f) GDPR). These counters are reset daily. We also keep a daily total of our costs that contains no personal data.

6. Account and login

If you create an account, we process your email address and a securely hashed version of your password (Art. 6 (1) (b) GDPR). The account, your list of videos and your branding settings are stored on our own server (see section 2). We use your email address for messages about your account: a welcome message, links to reset your password, when a video is ready, when your credits run low or are used up, and confirmations of plans and purchases. These emails are sent from hello@getlistingreels.com via our email provider ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. We do not send newsletters.

7. Payments

Plans and extra videos are paid via Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). For payment you are taken to a page run by Stripe, which processes your payment details directly and under its own privacy policy; Stripe also manages invoices, payment methods and cancellation in its customer portal. We receive only the information needed to manage your plan and credits and to issue invoices, such as your name, billing address and VAT ID (Art. 6 (1) (b) and (c) GDPR). Invoices are kept for the periods required by tax law (up to ten years).

8. Cookies and local storage

We do not use analytics cookies, and without your consent no third-party scripts run on our pages; fonts are served from our own server. Without your consent we only store what is technically necessary (§ 25 (2) TDDDG): a session cookie that keeps you signed in ("lr_session", up to 30 days) and, in your browser's local storage, your last settings in the video generator and, without an account, your list of created videos and branding. Photos or an exposé you add on the home page are kept on our server for at most two hours so the video generator can pick them up. You can delete the browser data at any time, for example on the "Account" page.

Meta Pixel, only with your consent. If you click "Accept" in the cookie banner, we load the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, to measure the success of our ads on Facebook and Instagram and to show them to people likely to be interested (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). The pixel sets cookies and sends Meta information such as the pages visited, that you signed up or bought a plan (with the amount), your IP address and browser details. Meta may combine this with your Meta account and process it in the USA (EU-U.S. Data Privacy Framework); Meta and we are jointly responsible for the collection and transfer. Without your consent the pixel is not loaded. You can withdraw your consent at any time under "Cookie settings" at the bottom of every page; your choice is stored for one year in the cookie "lr_consent".

9. How long we keep data

Free previews and the material uploaded for them are deleted automatically after 30 days. Full videos are kept so you can download them again, until you delete them, ask us to delete them or close your account; after the end of a contract, we delete them after 30 days. Avatars are kept until you delete them (see section 4).

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw a consent at any time with effect for the future (Art. 7 (3) GDPR). To exercise your rights, email b2b@tutto-digital.com. You also have the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.