Last updated: October 28, 2026
This Privacy Policy explains how HoverReel LLC ("HoverReel," "we," "us," or "our") collects, uses and shares information. It covers three groups of people:
- Merchants: the businesses that use HoverReel, and the people on their team who log in to the dashboard at app.hoverreel.com.
- Visitors: people who see a HoverReel video Player on a Merchant's website. Visitors don't have a HoverReel account.
- Website visitors: people who visit our own website, hoverreel.com, including people who apply for our beta.
The short version.
- We collect what we need to run HoverReel, and nothing for advertising. We don't sell or share personal information for advertising.
- The Player on a Merchant's website counts anonymous views and clicks. It doesn't know who a visitor is, and it doesn't track visitors across websites.
- Merchants can export or delete their account's data in Settings at any time.
- Our website, hoverreel.com, uses Google Analytics only after you click Accept in our cookie banner. You can say no with the Deny button.
- Questions? Email [email protected].
1. Our Role
- For Merchant accounts and for our website, HoverReel decides how information is used. It's the "controller" (under the GDPR) or "business" (under US state laws).
- For Visitor data collected by a Player on a Merchant's website, we process the data on the Merchant's behalf, as their "processor" or "service provider". The Merchant decides to use HoverReel on their website and is responsible for their own privacy notice. If you're a Visitor with a question about a specific website, contact that website first. We'll help them answer you.
2. Information About Merchants
2.1 Information you give us
- Account details: your business name, and the email address and password of each person who logs in. We never store passwords themselves, only a salted, one-way scrypt hash.
- Team: the people you invite, their roles, and who invited them.
- Your content: videos (uploaded or linked), thumbnails and images, product and action details (titles, prices, descriptions, links), playlists, Player designs, brand colors and settings.
- Website settings: your website platform, the website addresses where your Players are allowed to run, and pages you link videos to.
- Search engines (on by default): for videos with a title, the Player adds a short description to your page for search engines: the video's title, a thumbnail and a link to a small copy of the video, which search engines can fetch. You can turn this off per website in Settings.
- Store and app connections, if you choose them:
- Shopify: through our app, we receive the store's name, contact email and domains, and access to read and update products and to save files in the store's Files. Each video you upload is also saved in your store's Files, so Shopify can play it on your store. We also receive your store's paid and cancelled orders from Shopify, so Insights can show video sales. We keep only orders that included an item added from one of your videos: the order number, date, currency, total, and the video items (product title, quantity, amount). Shopify's order messages include customer details, but we don't keep your customers' names, emails, addresses or payment details.
- BigCommerce: the read-only API details you enter. If your API account can read orders, we also read your store's paid orders that included an item added from one of your videos, and keep the same details as for Shopify. We never keep your customers' names, emails, addresses or payment details.
- WooCommerce: your store's address. If you install the HoverReel plugin for video sales, it sends us the same details for paid orders that included an item added from one of your videos, and later changes to those orders (cancellations and refunds). It never sends your customers' names, emails, addresses or payment details.
- TikTok: access to list your videos.
- Instagram: your account's username, ID and account type, and your own posts' videos, captions, thumbnails, links and dates. We copy only the videos you choose into your Library. We never post to Instagram or read your messages, comments or anyone else's content.
Access details are stored encrypted.
- Billing: when you subscribe, our payment provider Stripe collects:
- your card;
- your billing address;
- a tax ID, if you add one.
We receive your plan, subscription status and billing dates, never your full card number.
- Messages: what you send us by email, and your choice about occasional HoverReel news when you sign up.
2.2 Information collected automatically
- Login and security:
- the time of your latest login;
- a record of browsers you've signed in from, so we can email you about a sign-in from a new one. We store your browser's user-agent string (which names the browser, its version and the operating system) and when it was first and last seen.
- counts of failed logins, to block password guessing;
- two-factor login data: your authenticator secret is stored encrypted, and recovery codes are stored only as hashes.
- Password check: when you choose a password, we check it against a list of passwords exposed in known data breaches. Only the first 5 characters of a one-way hash of the password leave our servers (see Section 6).
- Activity in your account: a log of actions such as adding a video or publishing a Player, and which team member took them. Depending on your plan, your team can see this log.
- Sign-up details: when you sign up through our sign-up page, we record:
- the link that brought you there (its campaign tags), the referring page and the page you first landed on;
- the IP address the request came from, to prevent abuse;
- when you accepted our Terms, and which version.
- Preferences and usage: your time zone (so emails and Insights use your local time), your plan usage, and notices you've dismissed.
3. Information About Visitors (the Player on a Merchant's Website)
The HoverReel Player runs on the Merchant's own website. It doesn't ask for, and we don't receive, a Visitor's name, email address, payment details or account details. To give the Merchant Insights about their videos and to protect the Service, it records:
- Viewing events:
- a video was shown, viewed (on screen for at least 2 seconds), expanded, or unmuted;
- how much of it was watched (25%, 50%, 75%, 90%), and seconds watched;
- likes;
- button clicks;
- add-to-cart attempts and whether they worked, with the product and size/color involved;
- which version of a Player was shown, if the Merchant is running an A/B test.
- A random visitor ID, created in the Visitor's browser and kept there (see our Cookies Policy). Where the website asks for consent (its own banner, Shopify's, or HoverReel's consent bar for visitors in Europe), it's stored only after the Visitor agrees. It isn't based on anything that identifies the person. We use it to:
- count unique viewers;
- avoid counting the same view twice;
- remember a like;
- protect the Service, for example by limiting how much one browser can play in a day and by spotting unusual viewing;
- show the same version of a Player to the same browser when the Merchant runs an A/B test (for this, the ID is also sent when the Player loads).
- Page details: the address of the page the Player is on, without its query string (our Player removes it), and the referring page, reduced to its domain and path.
- Device type: desktop, tablet or phone, worked out in the browser.
IP addresses. We don't store Visitors' IP addresses with viewing data. They're used briefly, in memory, to limit abuse. Like any website, our hosting provider may keep standard request logs for a short period.
Shared images. If a Visitor uses a Player's share feature to create a preview image, that image is uploaded to us so it can be shared by link. It's deleted after 7 days (copies can stay in our encrypted backups for up to 14 more days).
Things that happen directly in the Visitor's browser, without passing through our servers:
- Video playback comes from our video provider (see Section 6); on a Merchant's Shopify store, from Shopify, for videos saved in that store's own Files; or from wherever the Merchant's linked video is hosted.
- Add to Cart and the size and color picker talk directly to the Merchant's own store (Shopify, WooCommerce or BigCommerce). Carts, orders and payments are handled by that store, and its own cookies and policies apply. On Shopify, and on WooCommerce stores with the HoverReel plugin, an item added from a video carries a hidden note of which video it came from, so the Merchant can see which orders their videos helped sell; it identifies the video, never the shopper. On BigCommerce, the Player sends us the ID of the store's own cart with the add-to-cart; we keep only a one-way scrambled version of it (a hash), for up to 60 days, to match the order to the video.
- Two small open-source code libraries may be loaded from public code servers (jsDelivr and Cloudflare's cdnjs): one for streaming in some browsers, one for the share feature. Those servers see the request, like any website request.
- The Merchant's own analytics, if they turn it on. A Merchant can choose to send video events (video started, watched, finished, button clicked, added to cart) to analytics tools already on their own website, such as Google Analytics, Google Tag Manager, Meta Pixel, Klaviyo or Shopify's customer events. The Player passes the video, Player and product names to those tools in the Visitor's browser. It never loads those tools itself and never sends them the visitor ID. Those tools follow their own consent settings and their owners' privacy policies.
4. Information on Our Website, hoverreel.com
- Google Analytics 4: which pages are viewed, how visitors arrived (a search engine, another website, or a tagged link from our posts or emails), approximate location (city or country), device and browser type, and actions such as clicking "Get early access". We've turned off Google's advertising features.
- Wherever you are, analytics waits for your choice. Until you click Accept in our cookie banner, and if you click Deny, Google Analytics runs with analytics storage turned off: no analytics cookies are set, and Google receives only limited, cookieless measurements. You can change your choice at any time under "Manage consent".
- Google Search Console: totals of which Google searches showed our pages, with no information about individual visitors.
- Where you came from: a small script remembers, for your current tab only, the campaign tags on the link you arrived by, your first page and the referring website's domain. If you apply, they're added to your application.
- Our own video Players: some of our pages show HoverReel video Players, the same ones Merchants use. They count views and clicks the way Section 3 describes. They remember a random visitor ID in your browser only after you click Accept in our cookie banner; until then, or if you choose Deny, they count without remembering you. The videos play from our video provider.
- Beta applications: our application form, hosted by Tally, collects what you enter (such as your name, business, email and website) plus the "where you came from" details. We use it only to review and respond to your application.
- Hosting and delivery: our website is hosted by Hostinger and delivered through Cloudflare, which protects it from attacks. Fonts are loaded from Google Fonts. Like any website request, these services receive your IP address and browser details.
5. How We Use Information, and Why We're Allowed To
| What we use it for | Legal basis (EU/UK) |
|---|---|
| Creating and running your account, hosting and showing your videos, Insights, team access, store connections | Contract with the Merchant |
| Billing, taxes, refunds and accounting records | Contract; legal obligation |
| Security: login protection, new sign-in alerts, two-factor login, password check, abuse and fraud prevention, rate limits, limits on unusual viewing | Legitimate interests (keeping accounts and the Service safe) |
| Service emails: a welcome email after sign-up, password resets, security alerts, team invites, plan usage, billing and renewal notices | Contract; legitimate interests |
| The weekly summary email (on by default; one-click unsubscribe in every email and in Settings) | Legitimate interests |
| Occasional HoverReel news, only if you opted in | Consent |
| Visitor Insights for Merchants | Processed for the Merchant, on their instructions |
| Understanding how people find hoverreel.com, and reviewing beta applications | Consent where required; otherwise legitimate interests |
| Support, and improving HoverReel | Legitimate interests |
| Complying with law and enforcing our Terms | Legal obligation; legitimate interests |
We don't sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.
6. Who We Share Information With
Service providers that help us run HoverReel. Our agreements with them limit their use of the data to providing their service to us.
| Provider | What they do for us | Where |
|---|---|---|
| Railway | Hosts the HoverReel app and its database | Netherlands (Amsterdam). Requests reach it through Railway's global edge network, which may pass through other countries, including the United States. Railway is a US company. |
| Bunny.net (BunnyWay d.o.o.) | Stores, processes and delivers hosted videos | Stored in Germany and the United States; delivered from servers near the viewer |
| GitHub | Stores encrypted backups of our database and uploaded images | United States |
| Backblaze | Stores a second, encrypted copy of our backups and of the videos Merchants upload | United States |
| Resend | Sends our emails | United States |
| Stripe | Payments, invoices, receipts and sales tax | United States |
| Have I Been Pwned (Pwned Passwords) | Breached-password check; receives only the first 5 characters of a password hash | Global (Cloudflare network) |
| jsDelivr, Cloudflare (cdnjs) | Serve two open-source code libraries to Visitors' browsers when needed | Global |
| Analytics, Search Console and fonts for hoverreel.com only | United States and global | |
| Hostinger, Cloudflare | Host and protect hoverreel.com | Global |
| Tally | Hosts our beta application form | Belgium (European Union) |
Others:
- Your connected stores and apps. When you connect Shopify, BigCommerce, WooCommerce, TikTok or Instagram, we exchange data with them as needed for the features you use. To check product pages and your Player setup, we may also load public pages of your own website and store; this includes "Check my website" and product and image import.
- Your team. People you invite can see the account's data according to their role.
- Our staff. Authorized HoverReel staff can access account information to provide support, keep the Service safe and handle billing. We keep private internal notes about accounts for the same reasons.
- Legal reasons. We share information if the law, a valid legal request, or protecting the rights, property or safety of HoverReel, our users or others requires it.
- Business transfers. If HoverReel is involved in a merger, acquisition or sale of assets, information may be transferred as part of it. This policy, or one with equal protections, will continue to apply.
7. How Long We Keep Information
| Information | How long |
|---|---|
| Account, content, settings and connections | Until the account is deleted. Deleting closes the account straight away; it's permanently erased 7 days later, unless an Owner signs in and keeps it. |
| Instagram connection (access details, username, account ID) | Until you disconnect it in HoverReel, remove HoverReel in Instagram's settings, or delete your account. Videos you imported stay in your Library, like your uploads, until you delete them. |
| Visitor viewing events | 13 months. After that we keep only daily and hourly totals per video and Player (counts, the number of different visitors that day, and watch time), which contain no visitor IDs, pages or devices; those are kept for as long as the account exists. Everything is deleted with the account. |
| Activity log | The latest 200 actions per account |
| Dashboard notifications | 30 days |
| Login sessions | Up to 30 days |
| Failed-login counts | 24 hours |
| Recognized-browser records | Until the account is deleted (the browser's cookie lasts up to 2 years) |
| Unconfirmed sign-up requests (email, business name, IP address) | The confirmation link expires after 24 hours; the request is deleted about a week later |
| Shared preview images | 7 days (copies can stay in our encrypted backups for up to 14 more days) |
| Encrypted backups (database and uploaded images), including a weekly second copy at Backblaze | 14 days, then deleted automatically |
| Second copy of uploaded videos (encrypted, at Backblaze) | While the video is in the account; deleted within 14 days after the video or the account is deleted |
| Billing records (at Stripe) | As long as tax and accounting law requires, including after an account is deleted |
| Our own daily revenue records (an internal account ID and its plan amount) | Kept after an account is deleted, for our accounting |
| Video sales from Shopify, WooCommerce and BigCommerce (orders that included a video item; no customer details) | Until the account is deleted |
| Copies of your videos in your Shopify store's Files (if you use our Shopify app) | They're in your own store. We delete one when you delete the video in HoverReel. If you uninstall our app, they stay in your store for you to keep or delete, and we delete our records of them within 30 days |
| BigCommerce cart matches (a one-way hash of the store cart's ID, with the video and product) | 60 days |
| Founding-member offer records (email and code) | Until the offer is used or ends, then kept as a record of the offer |
| Support emails | As long as needed to help you, and for our records |
| hoverreel.com analytics (Google Analytics) | 14 months |
| Beta applications | While we review applications and onboard testers; delete yours any time on request |
Shopify app: if you uninstall our Shopify app, Shopify asks us about 48 hours later to erase the store's data. We then delete the account that was created through the app, unless you chose in Settings to keep it. For Shopify stores, we act on Shopify's customer data-erasure and data-request messages automatically: we delete that customer's video-sales orders, or email the account's Owners what we hold about them.
8. Emails
- Service emails go to the people on an account. They're part of the Service, so they can't be turned off:
- a welcome email with getting-started steps, once, after you sign up;
- password resets and email-change notices;
- new sign-in and security alerts;
- team invites;
- plan usage notices;
- billing and renewal notices;
- notices when an account is scheduled for deletion or reactivated;
- notices about a customer data request from your store.
- The weekly summary goes to account Owners on Mondays. Every one has a one-click unsubscribe link, and you can turn it off in Settings.
- HoverReel news is sent only if you opted in, and every message has an unsubscribe link.
9. Security
We use reasonable technical and organizational measures designed to protect information, including:
- encrypted connections (HTTPS) everywhere;
- salted password hashing;
- sign-in sessions stored only in a one-way (hashed) form;
- optional two-factor login (required for our own staff, whose admin access is also limited to a fixed list of people);
- alerts for sign-ins from new browsers, and limits on login attempts;
- encryption of stored access details and two-factor secrets;
- encrypted backups;
- time-limited video playback links for hosted videos;
- default-deny embed protection, so Players run only on the websites a Merchant allows;
- a strict content security policy on the dashboard.
No system is perfectly secure, and we can't guarantee that information will never be accessed, used or disclosed without permission, including through an incident at one of our service providers. If a breach affects your personal information, we'll notify affected Merchants without undue delay, and as the law requires.
10. Your Rights and Choices
- Merchants: account Owners can export the account's data (Settings > Data & account) and delete the account at any time. The export includes the account's content, settings, websites, store connections, video sales, A/B tests, activity log, notifications and sign-in devices; visitor analytics download separately as a CSV file from the same place. You can correct your details in Settings. To ask for anything else we hold about you (such as failed sign-in records), email us. You can disconnect Instagram from your Library at any time; if you remove HoverReel in Instagram's "Apps and websites" settings instead, Meta tells us and we delete the connection automatically.
- Visitors: we can't identify you from viewing data alone, so please contact the website you visited first. You can also clear that website's stored data in your browser, which resets the random visitor ID. Blocking the Player's script stops it from collecting anything.
- Website visitors: you can:
- click Deny in our cookie banner, or change your choice at any time under "Manage consent";
- block cookies in your browser;
- use Google's opt-out browser add-on.
To delete a beta application, email us.
- Your legal rights. Depending on where you live (for example under the EU or UK GDPR, or the privacy laws of California and other US states), you may have these rights over your personal information:
- to access it, correct it, delete it, or get a portable copy;
- to restrict or object to how we use it;
- to withdraw consent.
We won't treat you differently for using these rights. Email [email protected]. To protect your account, we'll reply to the email address on the account, or ask you to confirm your identity. In the EU or UK you can also complain to your local data protection authority.
11. Children
HoverReel is a service for businesses and isn't directed to children. You must be 18 or older to have an account. We don't knowingly collect personal information from children under 13. If you think a child has given us personal information, contact us and we'll delete it.
12. International Transfers
We're based in the United States, and our providers process data in the countries listed in Section 6. When personal data from the EU, UK or Switzerland is transferred to other countries, we rely on safeguards such as the European Commission's Standard Contractual Clauses, or our providers' certifications under the EU-U.S. Data Privacy Framework.
13. Changes to This Policy
We'll post any update here with a new "Last updated" date. For material changes, we'll tell Merchants by email or in the dashboard before the changes take effect.
14. Contact Us
HoverReel LLC
5151 Monroe St, Ste 250F
Toledo, OH 43623
[email protected]