Privacy Policy

This policy explains how theUGC(“we”, “us”) collects, uses and protects your information when you use our platform to generate and publish UGC-style content. It applies to the theugc.ai website and the app behind it.

We do not sell your personal information, and we do not use your content or your connected accounts for advertising.

• Account data: your name, email address, and authentication details. If you sign in with Google we receive your email, name and profile picture from Google — we never receive your Google password.
• Content you provide: product links, uploaded images, video, audio, scripts and avatars used to generate output, and the output itself.
• Connected-account data:when you connect a social account (TikTok, YouTube, Instagram), we receive an access token, a refresh token, your account’s public profile (such as display name and avatar), and the permission scopes you grant.
• Usage and billing data: the jobs you run, your credit usage, and payment records. Your invoices are created by our payment provider; we store the record of the payment, not your card number.
• Security data: login attempts, including the email tried, the IP address and whether it succeeded. This is what lets us lock an account under attack and alert you.

We do not collect special-category data, and you should not upload it. We do not run third-party advertising or analytics trackers on the site.

We use your information to operate the service: to generate the content you request, to publish it to the social accounts you connect and authorise, to manage your subscription and credits, to secure your account, and to email you about the service. The legal bases are performance of our contract with you (running the service you paid for), our legitimate interest in keeping the platform secure, and your consent where you have given it — for example when you connect a social account.

We use a small number of strictly necessary cookies only. The main one is your session cookie, which keeps you signed in; there is also a CSRF token that protects sign-in requests, and a browser-local preference for light or dark theme. We do not set advertising or cross-site tracking cookies. Blocking the session cookie will stop you being able to sign in.

Purchases are handled by Dodo Payments, which acts as the merchant of record and is an independent controller of the billing data you give it. Dodo Payments receives your billing details directly and shares with us only what we need to grant your plan: the fact of payment, the amount, the plan, and your billing email. We never receive or store your full card number.

Dodo Payments’ own handling of your data is governed by its buyer terms and privacy notice.

When you connect a TikTok, YouTube or Instagram account, we request only the scopes needed to identify your account and publish content on your behalf (for TikTok:user.info.basicandvideo.publish). Access and refresh tokens are stored encrypted at rest with AES-256-GCM and are used solely to perform actions you initiate.

We do not read your feed, your messages or your followers, we do not post without your instruction, and we do not sell this data or use it for advertising. You can disconnect an account at any time, which revokes our access going forward; we delete the stored tokens when you do.

We rely on third parties to run the service. Each receives only what its function requires, and is bound to process it on our instructions.

Payments and invoicing

Dodo Payments, our merchant of record. Receives your billing name, email, country and payment details in order to take payment, calculate tax and issue invoices.

AI generation

The model providers behind each tool. Receive the prompts, images, audio and video you submit for that job, for as long as it takes to return a result.

File storage and delivery

Cloudflare R2, which stores your uploads and generated output and serves them to you.

Hosting and database

Our own servers, which hold your account, jobs, credit balance and connection records.

Email

Our transactional email provider, which sends account, billing and security email. Used for service email, not marketing.

Publishing

TikTok, YouTube and Instagram, which receive only the video, caption and settings you choose to publish.

Our providers operate globally, so your data may be processed in countries other than your own, including the United States and the European Union. Where data leaves your region we rely on the transfer mechanisms our providers put in place, such as standard contractual clauses.

We keep your account data and generated content for as long as your account is active. Delete an individual file or avatar and it goes when you say so. Close your account and we delete your personal data and content within 30 days, except for records we must keep by law — payment and tax records in particular, which are retained for as long as the applicable tax rules require.

Security logs, such as login attempts, are kept for a short period and then discarded.

Passwords are hashed with bcrypt and never stored in readable form. Social-account tokens are encrypted at rest. Traffic to the site is served over HTTPS, and access to the production database is restricted to the application over a private network. No method of transmission or storage is completely secure, but we work to protect your information and will tell you promptly if a breach affects you.

You may access, correct, export or delete your personal information, withdraw consent, and disconnect any linked social account, at any time from within the app or by emailing us. Depending on where you live you may also have the right to object to or restrict certain processing, and to complain to your local data-protection authority.

We answer rights requests within 30 days. Write to [email protected] from the address on your account.

The service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be notified by email to active subscribers, and the date at the top of this page records when it last changed.

For privacy questions or data requests, contact [email protected], or see our contact page.