Privacy Policy

• Account and profile data: name, email, role, country, password credentials held by our authentication provider, profile photo, biography, social handles, rates, and the niches you list.
• Membership application data: your legal name, date of birth (we check you are over 18), city, timezone and languages, the answers you give when requesting access, the portfolio links you submit, and the outcome of the review. Answers and portfolio links are fixed once submitted. Whether you consent to occasional updates about UGCollab is recorded with the application.
• Brand data: company name, business details, billing contact, and plan.
• Billing and tax data: the business, tax, and bank or remittance details a brand gives us so we can invoice it, and a creator gives us so we can pay them for work we have engaged them to do, together with the invoices and payment records themselves.
• Campaign data: briefs, offers and counters, deliverables, submitted content and its versions, review decisions and feedback, posted links and the view counts reported for them, disputes, and the records of amounts agreed and settled.
• Messages: the content of messages and attachments you send through the product, and the metadata needed to deliver them. Where a message matches one of the policy indicators described under Automated message screening, we also record the indicator category alongside the message.
• Connected social account data: if you are a creator and choose to connect a social account (currently Instagram), we collect, through the platform’s official API and with the permissions you approve on the platform’s own screen: your account identifier and username; follower, following, and post counts; a sample of your recent posts (links, posting dates, and their view, like, comment, and share counts); and, where the platform provides it, aggregated audience information such as top countries and age ranges. We also hold the access token the platform issues so we can refresh these figures. We never receive or store your social account password, we cannot post, message, or comment as you, and we do not collect data about your followers as individuals.
• Product analytics: pages viewed, features used, and events raised as you use the product, with your account identifier once you are signed in.
• Enquiry data: if you ask us for a managed campaign quote or contact us through the site, the name, work email, phone or messaging handle, job title, company, and budget range you give us, and our correspondence with you. You do not need an account to send an enquiry.
• Technical and security data: IP address, device and browser information, log and error diagnostics.

We do not ask for special category data (health, ethnicity, political opinions, and similar) and ask that you do not supply it in free-text fields.

Some of this is required and some is not. Your name, email, date of birth, country, and the application answers marked as required are obligatory: without them we cannot verify eligibility, admit you, or run a campaign, and we will not be able to give you an account. Everything else, including your photo, biography, social handles, published rates, and consent to occasional updates, is voluntary, and leaving it out only limits how complete your profile is.

Where the GDPR applies, we rely on the legal bases named below. Under the PDPO we use personal data for the purposes for which it was collected and directly related purposes.

• To provide the service: create and run accounts, match briefs and creators, carry campaigns through submission, review, and settlement, and deliver messages. Basis: performance of a contract.
• To run admissions: assess applications, record decisions, and manage invitations. Basis: steps taken at your request before entering a contract, and our legitimate interest in a vetted network.
• To keep the network safe and honest: verify identity and business status, screen for fraud and financial-crime risk, investigate disputes, and enforce our terms. Basis: legitimate interests, and compliance with legal obligations.
• To keep creator statistics current and credible: where a creator connects a social account, we fetch the figures above on a schedule and display them on the creator’s profile to the vetted brand members who can already see that profile, labelled with their source and recency. Platform-sourced figures are used for this display, for discovery filtering and ranking inside the network, and, where a campaign includes performance bonuses, to check whether an agreed threshold was met. They are used for nothing else: never for advertising, never sold, and never shared outside the network. Basis: consent, given on the platform’s authorization screen and withdrawable at any time by disconnecting.
• To improve the product: understand which features are used and where they fail. Basis: legitimate interests.
• To meet legal and tax obligations: keep accounting, invoicing, and compliance records. Basis: legal obligation.
• To send service messages: notifications about your account, applications, campaigns, and submissions. These are part of the service and are not marketing. Basis: performance of a contract.
• To send occasional updates about UGCollab, where you ticked the optional box on your application to receive them. This is separate from the service messages above, you are never required to accept it, and you can stop it at any time by using the unsubscribe link or writing to info@ugcollab.ai. We will not use your data for direct marketing without your consent. Basis: consent.

We do not sell personal data, and we do not use it to make decisions producing legal effects about you by automated means alone. Discovery ranking is a convenience: a person decides who is invited, accepted, or admitted.

Messages sent through UGCollab are checked automatically, at the moment of sending, against a fixed list of indicators of the conduct our terms forbid: sharing contact details or off-platform messaging handles, naming payment channels, and phrasing that proposes taking a deal off the platform to avoid the record or the fee.

• What is recorded. The indicator category and a reference to the message. We do not copy the message text into a separate file; the flag is a label on a message you already sent through us.
• What happens. You may see a reminder about the protections that come with keeping a deal on the platform. Nothing is blocked, and no penalty is ever applied automatically: any action that affects an account is taken by a person, after review, and you can respond before and contest after any such decision.
• Why. The record of what was agreed on UGCollab is what protects both sides of a deal. Screening for circumvention protects that record. Basis: our legitimate interest in enforcing the terms both sides rely on. Under the PDPO this is a directly related purpose of running the messaging service, disclosed here.
• Retention. A flag lives and dies with the message it refers to.

We use the following processors, and no others. Each is bound by a data processing agreement and may use the data only on our instructions.

• Supabase: database, authentication, and file storage. Hosted on Amazon Web Services in Tokyo (ap-northeast-1). This is where account, campaign, message, and submission data lives.
• Vercel: application hosting and delivery, with the application region pinned to Tokyo (hnd1).
• PostHog: product analytics, hosted in the European Union.
• Resend: transactional email (account, application, and campaign notifications), hosted in the European Union.
• Sentry: error and performance monitoring. Session replay is switched off, so we do not record your screen.
• Google Workspace: our business email, used when you correspond with us directly.
• Stripe: payment processing for brand plans, passes, and approved-work billing. Card numbers are entered on pages Stripe serves and are never stored on our servers; we keep only the card brand, its last four digits, and the invoice and receipt records. Stripe processes this data under its own privacy policy, including the identity and fraud checks it runs on payments.
• Wise: creator payouts. When you add a payout account, your bank details are sent straight to Wise and are never stored on our servers; we keep only the account holder’s name and country, the bank’s name, the last four digits, and the payout records. Wise processes this data under its own privacy notice, including the identity and sanctions checks it runs on transfers.

We also share personal data with the other party to a campaign : a brand sees the profile, submissions, and messages of creators on its campaign, and creators see the brand and its brief. We may disclose data to professional advisers, to authorities where the law requires it, and to a buyer or investor in a corporate transaction, subject to confidentiality.

Applicant assessments and internal review notes are never shown to other members.

Creator payouts are made by bank transfer from UGCollab’s own account through Wise, listed above. Wise receives the account holder’s name, address and bank details, and the amount and reference of each payout, and nothing else about your work on UGCollab.

Connecting a social account is optional. A creator who never connects one keeps a complete profile; the figures they enter themselves remain the displayed ones. When you do connect, you approve the access on the platform’s own screen, and we receive only what those permissions cover. For Instagram we request the two read-only permissions that identify the professional account and read its statistics (instagram_business_basic and instagram_business_manage_insights); we do not request permission to publish, comment, or read messages, and our use of this data follows Meta’s Platform Terms and Developer Policies. Instagram is a service of Meta Platforms, whose own privacy policy governs what Meta does with your data.

For YouTube we request two read-only permissions through Google (youtube.readonly and yt-analytics.readonly). With them we read the channel you choose to connect: its subscriber, view, and video counts, the view, like, and comment counts of its recent videos (with each video’s duration, used only to separate Shorts from long-form videos), and aggregate audience statistics by age range, gender, and country. UGCollab uses YouTube API Services; by connecting a channel you also agree to the YouTube Terms of Service, and Google’s Privacy Policy governs what Google does with your data. UGCollab’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. YouTube-sourced figures are refreshed from the API, or deleted, at least every thirty days, and we re-confirm your authorisation on the same schedule.

For TikTok we request four read-only permissions (user.info.basic, user.info.profile, user.info.stats, and video.list). With them we read the connected account’s identity and profile, its follower, like, and video counts, and the view, like, comment, and share counts of its public videos. TikTok does not make audience statistics such as age or location available through this connection; any TikTok audience figures on a profile come from evidence the creator supplied and our team reviewed, and are labelled as such. TikTok’s own privacy policy governs what TikTok does with your data.

The access token the platform issues is held encrypted (AES-256-GCM) in a store that our application cannot read back except inside the sync process itself; it is never shown to any member, including you, and never leaves our infrastructure.

You can end the connection at any time, three ways:

• Disconnect in UGCollab: the Disconnect control on your profile severs the connection and destroys our copy of the access token immediately. Statistics already gathered remain on your profile history until you ask us to erase them.
• Revoke on the platform: removing UGCollab in your Instagram settings (Settings, then Website permissions), in your Google Account (Security, then Third-party apps with account access), or in TikTok (Settings and privacy, Security, then Manage app permissions) has the same effect. Instagram notifies us and we destroy the token on receipt; for Google and TikTok the revoked token fails at the next sync, at which point we destroy it and stop updating.
• Ask for erasure: to also delete the statistics we gathered while connected, use Instagram’s data deletion request (which reaches us automatically and triggers deletion of everything we obtained from Instagram about your account), or write to info@ugcollab.ai. Erasure removes the platform-sourced data from every connected platform; it does not touch the figures, links, and portfolio you entered yourself, which remain yours to edit or remove on your profile.

We use cookies that are strictly necessary to run the service: they keep you signed in, protect the session, and remember basic preferences such as your theme. These cannot be turned off without breaking the product.

Our analytics provider, PostHog, also sets cookies in your browser to recognise a returning session and to measure feature use. Anonymous visitors are counted without a stored person profile; a profile is created only once you sign in. Analytics traffic is routed through our own domain, so an analytics cookie is set as a first-party cookie.

We do not use advertising or cross-site tracking cookies, and we do not share analytics data with advertising networks.

These analytics cookies are set when you visit the site. You can block or delete them at any time in your browser settings, or use its tracking-protection controls, and UGCollab will continue to work without them.

UGCollab is based in Hong Kong, our data and application are hosted in Japan, and our analytics and email providers operate in the European Union. Our members are international. Personal data therefore moves between these places in the ordinary course of running the service.

In practice: your account, campaign, and message data is stored in Japan; product analytics and transactional email are processed in the European Union; and our team accesses data from Hong Kong.

Where personal data protected by the UK or EU GDPR leaves that area, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK GDPR applies. Our agreements with the processors listed above incorporate those clauses. We do not rely on an adequacy decision for this hosting: our data sits on infrastructure operated in Japan by our providers, which is not the same as transferring it to an organisation covered by the EU adequacy decision for Japan. We assess these transfers and apply technical measures including encryption in transit and access control. You can ask us for a copy of the safeguards we rely on by writing to info@ugcollab.ai.

For Hong Kong data subjects, we handle transfers consistently with the PDPO and the guidance of the Privacy Commissioner for Personal Data.

• Account and profile data: while your account is active, and for up to two years afterwards.
• Membership applications: for up to two years after the decision, so that we can explain outcomes and prevent repeat abuse.
• Campaign, contract, invoice, and tax records: for seven years, as Hong Kong company and tax law requires.
• Submitted content: for the life of the campaign record it belongs to, since it is the evidence of what was delivered and approved.
• Messages: while the account is active, and with the campaign record where they evidence a dispute.
• Connected social account data: access tokens until you disconnect, the platform tells us access was revoked, or the token lapses, whichever comes first. Platform-sourced statistics for up to twenty-four months on a rolling basis, so that profiles can show how an account has grown, and sooner if the platform’s rules require earlier deletion or you request erasure.
• Analytics and diagnostic data: for up to twelve months.

After these periods we delete or anonymise the data, unless a legal hold, a live dispute, or a statutory duty requires us to keep it longer.

Under the PDPO you may ask whether we hold personal data about you, request a copy, and require correction of anything inaccurate.

If the UK or EU GDPR applies to you, you may also ask us to delete data, restrict or object to processing, receive your data in a portable form, or withdraw a consent you have given. Withdrawing consent does not affect processing already carried out.

Address requests for access to, or correction of, your personal data to the Privacy Officer, UGCollab Limited, Flat B, 14/F, Gold Swan Commercial Building, 438-444 Hennessy Road, Causeway Bay, Hong Kong, or by email to info@ugcollab.ai. We may need to verify your identity, and we will respond within the time the applicable law allows. Some data must be kept even after a deletion request (campaign, invoice, and tax records in particular), and we will tell you when that applies.

You can complain to the Privacy Commissioner for Personal Data in Hong Kong, or to your local supervisory authority in the UK or EU. We would rather you raised it with us first.

Access to member data is enforced at the database level: every table carries row-level security policies, so a request can only ever return the rows that the signed-in account is entitled to. Uploaded files are private and served through short-lived signed links rather than public URLs.

We encrypt data in transit, restrict administrative access, keep audit and error logs, review our providers, and run automated checks against accidental exposure of credentials. Financial and submission records are append-only, so history cannot be quietly rewritten.

No system is perfectly secure. Protect your credentials, and tell us at info@ugcollab.ai if you suspect an account has been compromised. If a breach affects your personal data and the law requires notification, we will notify you and the relevant regulator, and we keep an incident-response process for that purpose.

UGCollab is for business use by adults. It is not intended for anyone under 18, and we do not knowingly hold personal data about children. If you believe a child has given us data, write to info@ugcollab.ai and we will delete it.

We may update this policy as the product and our obligations change. Where a change materially affects how we use your data, we will tell you through the product or by email before it takes effect.

UGCollab Limited, Flat B, 14/F, Gold Swan Commercial Building, 438-444 Hennessy Road, Causeway Bay, Hong Kong.
Privacy contact: info@ugcollab.ai.