Privacy Policy

The data controller is PARK CIRCUS LIMITED, registered office 15 Woodside Crescent, Glasgow, Scotland, G3 7UL, United Kingdom. You can reach us about privacy at support@parkcircusuk.shop or +44 7426432369.

We serve customers worldwide. Our services are online-only digital software; there are no physical goods, shipping or in-person services.

We collect only what we need to run the service:

• Account data — email address and, if you set one, a display name and password (stored hashed).
• Taste inputs & content — the taste notes, prompts, watchlists, movie-night plans, ratings, log entries and any short review text you create.
• Generated results — the watchlists, cards, plans and recap data the tool produces for you.
• Subscription data — plan, billing status and Stripe customer/subscription identifiers (not card numbers).
• Support & lead data — messages you send us via the contact or household-profile forms.
• Technical data — IP address, device/browser type and basic usage events needed for security and reliability.

Our collection sources are limited and transparent:

• Directly from you — the account details, taste notes, prompts, ratings, log entries and support messages you enter when you use the Studio, subscribe or contact us.
• Automatically from your device — technical data such as IP address and basic usage events generated by your browser and our hosting provider.
• From our payment processor — subscription and billing status from Stripe when you subscribe (never your full card number).

We do not buy personal data, and we do not build profiles from third-party data brokers.

• To provide the service (generate and store your plans, run your account) — performance of a contract.
• To take payment for subscriptions — performance of a contract.
• To keep the service secure and working (fraud prevention, debugging) — our legitimate interests.
• To answer support requests — legitimate interests and, where relevant, contract.
• To send optional product updates — your consent, which you can withdraw at any time.
• To meet legal obligations (tax, accounting) — legal obligation.

User input.When you use the Studio, the user input you provide — your taste note, prompt, selected mode, ratings and log entries — is processed only to produce the plan you asked for. Where an AI provider is connected, your user input (the prompt) is sent to that provider solely to generate your result and is subject to that provider’s data terms; where no provider is connected, your plan is produced by our own built-in engine without any external call.

Generated output. The generated output — your watchlists, movie-night plans, shareable cards and year-in-review recap data — is created from your own input and is stored against your account so you can return to it. You can view, edit, download and delete any generated output at any time.

File uploads and sample data. If a feature lets you upload files or sample data, those are used only to produce your requested output, are stored against your account and can be deleted by you or on request.

No model training. We do not use your user input, generated output, uploads, ratings or log entries to train, fine-tune or improve any AI model. You can delete individual watchlists, logs and cards, and you can ask us to delete your account and all of its content entirely.

Subscriptions are processed by Stripe. Card details are entered on Stripe’s secure systems — Reelist never receives or stores your full card number, CVC or full PAN. We receive only limited billing metadata (such as your plan, the last four digits, card brand, billing country and Stripe identifiers) needed to manage your subscription and support you.

We share data only with service providers who process it on our behalf under contract:

• Hosting & delivery — Vercel Inc. (application hosting and content delivery).
• Payments — Stripe, Inc. (subscription billing).
• Database & authentication — Supabase (account, plan and content storage) where enabled.
• AI provider — the model provider connected by the operator, used only to generate your requested result.
• Email — our transactional email provider, for receipts and support replies.

We may also disclose data where required by law. We never sell your personal data.

We use a small number of strictly necessary cookies to keep you signed in and to secure the admin console. Any analytics we use are privacy-respecting and aggregate. See our Cookie Policy for the full list and your choices.

Because our providers operate globally, your data may be processed outside the UK/EEA, including in the United States. Where that happens we rely on appropriate safeguards such as the UK International Data Transfer Agreement/Addendum and the EU Standard Contractual Clauses, together with our providers’ certifications where applicable.

• Account and content: for as long as your account is active, then deleted or anonymised within 90 days of closure.
• Support and lead messages: up to 24 months.
• Billing and tax records: as required by law (typically up to 7 years).
• Security logs: a short rolling period, typically up to 12 months.

We use encryption in transit (HTTPS), access controls, hashed passwords and provider-side encryption at rest. Payment keys are stored only in our hosting environment’s encrypted configuration, never in a shared database or in client code. No system is perfectly secure, but we work to protect your data and will notify you and regulators of a reportable breach as required.

Depending on where you live, you have rights over your data. Under UK and EU GDPR you can:

• access a copy of your data;
• correct inaccurate data;
• delete your data (“right to be forgotten”);
• restrict or object to certain processing;
• port your data to another service;
• withdraw consent at any time.

Under the California Consumer Privacy Act (as amended by the CPRA), California residents can request access, deletion and correction, and can opt out of “sale” or “sharing” — see the next section. We will not discriminate against you for exercising your rights. To exercise any right, email support@parkcircusuk.shop.

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. Because we do not sell or share, there is nothing to opt out of — but if you have any concern, contact us and we will confirm your status in writing.

Our recommendations are AI-assisted suggestions only; they do not produce legal or similarly significant effects about you, and a human is always in control of what you do with them. Reelist is not intended for children under 13, and we do not knowingly collect their data. Users aged 13–17 should only use Reelist with a parent or guardian’s consent. Age ratings for films come from official ratings bodies; parents decide what is suitable.

We’ll update this policy when our practices change and revise the date above. If you have a concern, contact us first and we’ll try to resolve it. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk).