ReefRaf (“ReefRaf”, “we”, “us”) is operated by Itay Rose ari, a sole proprietor (osek) registered in Israel (the “Operator”). This policy explains what personal data we collect when you use ReefRaf at reefraf.com (the “Service”), why we collect it, who receives it, and the rights you have over it.
For anything in this policy, contact us at support@reefraf.com. The Operator is the data controller for the personal data described here, except where this policy says otherwise (in particular payments; see Section 5).
1. Who this Service is for
ReefRaf is a professional search library of creative video references. It is intended for users aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
2. Data we collect
2.1 Account data
ReefRaf uses Google Sign-In only. When you sign in, we receive and store from your Google account:
- Email address
- Display name
- Profile photo URL
- A unique Google account identifier (UID)
We never see or store your Google password.
2.2 Usage data
- Search queries. When you search, the text of your query is sent to our servers to run the search and is stored, linked to your account, as part of your search session. Search sessions also record when they were created and last used.
- Search count.We count how many search sessions you have used, to enforce the free plan’s limit of six lifetime searches.
- Collections. If you are a paid member, the collections you create, including their names, descriptions, and the references they contain, are stored and linked to your account.
2.3 Billing data
Payments are processed by Lemon Squeezy as merchant of record (see Section 5). We never receive or store your card number or other payment credentials. We store only your subscription state: plan, subscription status, renewal and end dates, and Lemon Squeezy customer and subscription identifiers.
2.4 Technical data
- IP address. Your IP address is used transiently in memory to protect the Service against abusive traffic (rate limiting). We do not store IP addresses in our database.
- Server logs. Our hosting infrastructure may keep standard, short-lived request logs for security and debugging.
2.5 Analytics and marketing data
We use analytics and advertising tools (currently or planned: Google Analytics and Meta (Facebook) tools such as the Meta Pixel) to understand how the Service is used and to measure and run marketing campaigns. These tools use cookies and similar technologies and may collect your device information, approximate location, pages viewed, and interactions with the Service.
If you are in the EEA, UK, or another region where consent is required, these tools run only after you consent through the consent banner. You can withdraw consent at any time. Declining consent does not limit your use of the Service.
3. Why we process your data, and on what legal basis
We process personal data for the purposes below. For users covered by the GDPR, the legal basis is noted for each.
- Providing the Service: sign-in, running searches, collections, and sharing (account and usage data; performance of a contract, Art. 6(1)(b)).
- Enforcing the free search quota and preventing quota abuse (search count and UID; legitimate interests, Art. 6(1)(f)).
- Managing subscriptions and entitlements (billing state; performance of a contract).
- Security, rate limiting, and abuse prevention (transient IP address and logs; legitimate interests).
- Analytics, marketing measurement, and advertising (analytics data and cookies; consent, Art. 6(1)(a), where required, and otherwise legitimate interests).
- Service emails such as receipts and account or billing notices (email address; performance of a contract).
- Marketing emails, if any (email address; consent, and you can opt out at any time).
- Complying with legal obligations such as tax and accounting (billing records; legal obligation, Art. 6(1)(c)).
4. Search queries and AI processing
To run a search, your query text is sent to Google’s Gemini APIto be converted into an embedding and to rank results. We use Google’s paid API tier; under Google’s terms for that tier, your queries are not used to train Google’s models. Your queries are processed by Google as our service provider for the sole purpose of returning search results.
5. Who receives your data
We share personal data only with service providers needed to run ReefRaf, and only for the purposes above:
- Google (Firebase, Google Cloud): authentication and our database, hosted in the United States (“nam5” region). Google acts as our processor.
- Google (Gemini API): search query processing, as described in Section 4.
- Lemon Squeezy, LLC (USA): our merchant of record. When you purchase a membership, Lemon Squeezy is the seller: it processes your payment, handles applicable taxes and invoicing, and acts as an independent controller of your payment data under its own privacy policy. At checkout we pass your email, name, and ReefRaf user ID to Lemon Squeezy so your purchase can be linked to your account.
- Google Analytics and Meta: analytics and advertising, as described in Section 2.5 and subject to consent where required. Meta may act as an independent or joint controller for data collected through its tools, under Meta’s own privacy policy.
- YouTube and Vimeo: see Section 6.
We do not sell personal data. Where the CCPA applies, the use of advertising tools such as the Meta Pixel may be considered “sharing” for cross-context behavioral advertising; you can opt out via the consent controls or by contacting us.
We may disclose data if required by law, or to protect the rights, safety, or property of ReefRaf or others.
6. Embedded video players
Reference videos are embedded from YouTube (and, for some references, Vimeo). ReefRaf does not host video files. When a page containing an embedded player loads, your browser connects to YouTube/Google or Vimeo, which may set cookies and collect data under their own policies, including on publicly shared collection pages viewed without an account. See the Google Privacy Policy and Vimeo Privacy Policy. By playing an embedded YouTube video you are also agreeing to the YouTube Terms of Service.
7. Cookies and similar technologies
- Strictly necessary storage.Sign-in uses Firebase Authentication tokens kept in your browser’s local storage. These are essential and used only to keep you signed in.
- Embedded players may set third-party cookies (Section 6).
- Analytics and advertising cookies (Google Analytics, Meta Pixel) are set only per Section 2.5, with consent where required.
You can manage cookies through the consent banner and your browser settings.
8. International transfers
We are based in Israel, which benefits from a European Commission adequacy decision. Our service providers (Google, Lemon Squeezy, Meta) process data in the United States. Transfers to them rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses, as implemented in each provider’s data processing terms.
9. Retention
- Account, usage, and collection data are kept while your account exists.
- When you delete your account (Section 10), your user record, collections, and search sessions are deleted. We retain only a pseudonymous record containing your account UID, your used search count, and your subscription identifier. This record contains no name or email address. It exists to prevent the free quota from being reset by deleting and re-creating an account, and to prevent stale billing events from re-creating a deleted account.
- Billing records are retained by Lemon Squeezy, and by us in summary form, as required by tax and accounting law.
10. Your rights and controls
You can, at any time:
- Delete your account yourself from the Account page. Deletion removes your personal data as described in Section 9 and cancels any active subscription.
- Manage or cancel your subscription through the billing portal in your account.
- Access, correct, export, or delete your personal data, object to or restrict processing, or withdraw consent, by using the in-product controls or emailing support@reefraf.com. We respond within the timelines required by applicable law.
These rights are provided under the GDPR (for EEA/UK users), the Israeli Protection of Privacy Law, 5741-1981 (as amended), and, where applicable, US state privacy laws such as the CCPA/CPRA. We do not discriminate against you for exercising them.
If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority. In Israel, you may contact the Privacy Protection Authority.
11. Security
All traffic is encrypted in transit (HTTPS). Data is stored in Google Cloud infrastructure with access restricted to verified server endpoints; the database is not directly accessible from browsers. Payment credentials never touch our systems. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.
12. Changes to this policy
We may update this policy as the Service evolves. Material changes will be announced in the Service or by email before they take effect. The “Last updated” date above always reflects the current version.
13. Contact
ReefRaf, operated by Itay Rose ari (sole proprietor, Israel)
Email: support@reefraf.com
See also our Terms of Service.