Reposit Privacy Policy

This policy covers the Reposit platform (the "Services" or "Reposit") at repositstore.com, operated by Repost Productions LLC ("Repost Productions"). It explains what we collect, why, who we share it with, and how long we keep it. It does not cover Repost Productions' production services, which are governed by your production agreement.

Information you provide to us.

Account information. Your name, email address, the organization you belong to, your role within it, and your sign-in method. If your organization designates a records officer, we store that person's name and email.

Authentication data. If you sign in with Google or Microsoft, we receive your name and email address from that provider. We never receive or store your password for those accounts. If you enable two-factor authentication, we store the secret needed to verify your codes.

Your footage and files. The video, audio, images, transcripts, and related files you or Repost Productions upload on your behalf, along with filenames, folder structure, file sizes, durations, and the preview proxies and thumbnails we generate from them.

Billing information. Your organization's billing address and a record of what you were charged and when. Card numbers are entered directly into Stripe and are never transmitted to or stored on our servers — we hold only a token, the card brand, and the last four digits.

Information collected automatically.

Usage and security data. Sign-in events, actions taken in the platform (uploads, downloads, retrieval requests, share-link creation and revocation), a log of emails we sent you, and standard server logs including IP address, device identifiers, and browser user agent.

Integrations and API interactions. Where you connect a third-party application to Reposit, or interact with our API, we log the requests made, the account or key used, and the files affected.

File metadata. When you upload files, we read and store technical metadata about them, including creation and modification timestamps, duration, resolution, frame rate, codec, container format, camera or device identifiers, and file size. Original files you upload may also contain metadata embedded by the camera, drone, or phone that recorded them — including GPS coordinates and other geolocation data, serial numbers, and operator names. We do not strip this embedded metadata: removing it would alter your master file and break the original-quality guarantee that the archive exists to provide. It is stored with your footage, is subject to the same access controls, and is returned to you unchanged when you download or export. Because embedded metadata travels inside the file itself, we cannot separate it from the footage on export, and exports are not offered with metadata removed. If a file must not carry that information, remove it before uploading.

We use the audio files, video files, and other media you provide (the "User Content") to power the Services. We will store your footage, permit authorized personnel such as Repost Productions employees, platform administrators, and third-party partners to access the information, generate previews, and deliver downloads. The User Content will also be used to communicate with you electronically to inform you of billing obligations, retrieval notices, lapse warnings, and records-officer notices before deletion. Repost Productions shall also secure the User Content housed on the platform, investigate abuse of access to the Services, troubleshoot platform performance problems, and comply with all Service-related applicable laws and in response to government subpoenas.

Nothing in this Privacy Policy grants Repost Productions the right to access, view, or use your User Content for advertising, marketing, or unrelated business purposes without your explicit consent. Repost Productions does not sell User Content or use it to train machine-learning models unless you separately opt in to such features. Where you choose to share User Content with others, you authorize Repost Productions to make that content available to the recipients you designate. Repost Productions is not responsible for how recipients use or further disclose shared content.

We share only what each provider needs to do its job. Each provider may use the data it receives only to deliver its service to us; none of them are permitted to use your footage or personal information for their own purposes.

• Amazon Web Services — receives your Archive-tier master files, preview proxies and thumbnails, and delivery and server logs. Provides storage, content delivery, and logging.
• Backblaze — receives your Active-tier master files. Provides storage for footage that must be available for immediate download.
• Stripe — receives your organization's billing contact and address, card details entered directly into Stripe, and the amounts charged. Processes payments. No footage is sent to Stripe.
• Supabase — receives your account, organization, project and file records, and authentication data. Hosts the application database and authentication. Footage itself is not stored there.
• Lovable — hosts the application and processes requests made to it.
• Resend — receives the recipient name, email address and message contents of the service email described above. Sends that email.
• Google and Microsoft — receive a sign-in request and return your name and email address, only where your organization chooses to use single sign-on.

We store your footage in United States regions with each of our storage providers.

We may also disclose information when required by law, subpoena, court order, or a valid public-records request, and to enforce our terms or protect our rights. If your organization is a government body subject to public-records law, remember that your own retention and disclosure obligations are yours to meet, not ours.

Anyone your organization's administrator invites can see that organization's footage. Share links you create are viewable by anyone who has the link until they expire or you revoke them — treat them as public. Repost Productions staff can access your account and footage as needed to operate the service, provide support, or comply with law; staff access to billing on your behalf is logged.

Footage is kept while your account is active and for the 90-day grace period after cancellation or billing lapse, after which it is permanently deleted, as described in Section 6 of the Terms of Service. Projects under an active legal hold are retained until the hold is released. Account records, billing history, retrieval requests, and audit logs are retained after deletion of footage as business and tax records.

Footage is encrypted at rest and in transit. Access is restricted by organization, enforced at the database level. Downloads are delivered through short-lived signed links rather than public URLs. Two-factor authentication is available and we recommend enabling it. No system is perfectly secure, and Section 5 of the Terms of Service describes the limits of our warranties.

Use of the Services and any associated features is subject to the terms of this Privacy Policy and our Terms of Service. By creating an account, uploading content, or accessing the Services, you grant Repost Productions the limited rights necessary to operate, maintain, and improve the platform. These rights are strictly limited to what is required to provide the Services and do not transfer ownership of your audio, video, or other stored content.

You retain all ownership rights in the User Content you upload or store through the Services. Repost Productions does not claim ownership of your User Content. However, you grant Repost Productions a non-exclusive, worldwide, royalty-free license to host, store, transmit, process, display, and otherwise use your User Content solely for the purpose of providing, securing, troubleshooting, and improving the Services. This includes the right to create temporary copies, backups, and metadata necessary for technical operations.

You are responsible for ensuring that you have all necessary rights to upload, store, or share User Content through the Services. You agree not to upload or store content that violates applicable law, infringes intellectual property rights, or contains harmful or malicious code. Repost Productions may restrict or remove content that violates our Terms of Service or is required to be removed under applicable law.

You can update your account details and cancel from your account page. You can revoke share links you created. You can request a copy of your footage at any time while your account is active, and during the grace period after cancellation. To ask what personal information we hold about you, to correct it, or to request deletion, email legal@repostproductions.com. Be advised that a copy of the User Content may be required to be retained for legal and archival purpose reasons after a written deletion request.

Reposit is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 13.

We will post any changes here with a new version number and effective date, and give 30 days' email notice of material changes.

Repost Productions LLC, 215 S Union St, Alexandria, VA 22314 · support@repostproductions.com for general enquiries · legal@repostproductions.com for privacy and deletion requests