Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME] (“UGCBank”, “we”, “us”) collects, uses, discloses, and safeguards personal information when you use the UGCBank platform, websites, and related services (the “Service”). UGCBank is a marketplace that connects brands with user-generated-content (UGC) creators, coordinates campaigns, and moves money between the two sides through escrow-backed payments. By using the Service you agree to the practices described here.

1. Information we collect

Information you provide

• Account and profile. Name, email address, password, role (brand or creator), business or creator profile details, avatar, social handles, portfolio content, location, and languages.
• Campaign and content data. Briefs, applications, messages, deliverables, videos and images you upload, ratings, and dispute submissions.
• Payment and tax information. Payout and payment details, and the identity and tax information required for onboarding are collected and processed by our payments provider, Stripe. We receive limited account status and metadata, not full card or bank numbers.
• Communications. Messages you exchange on the platform and any support correspondence.

Information collected automatically

• Usage and device data. Pages viewed, actions taken, approximate location derived from IP address, browser and device type, and timestamps.
• Cookies and similar technologies. Used to keep you signed in, remember preferences, secure the Service, and understand product usage. See “Cookies” below.

Information from third parties

• Where you connect an external account (for example Meta, TikTok, or Shopify for campaign attribution and ad integrations), we receive the data those platforms make available under the permissions you grant.

2. How we use information

• Operate the marketplace: create accounts, match brands and creators, and run campaigns.
• Process payments, hold funds in escrow, release payouts, and support tax onboarding.
• Provide support, resolve disputes, and enforce our Terms.
• Draft and suggest campaign briefs and related copy using AI (see below).
• Secure the Service, prevent fraud and abuse, and comply with legal obligations.
• Measure and improve the product, and communicate service and (with consent where required) marketing messages.

Where required by law, we rely on the following legal bases: performance of a contract with you, our legitimate interests in operating and securing the Service, your consent (for example, certain cookies and marketing), and compliance with legal obligations (for example, financial record-keeping).

3. AI-assisted features

UGCBank uses Anthropic (the Claude API) to help draft campaign briefs and related content. When you use these features, the prompts and relevant campaign inputs are sent to Anthropic to generate a response. We do not use Anthropic to make automated decisions that produce legal or similarly significant effects about you. AI output is a starting draft and should be reviewed before use.

4. Payments, escrow, and tax

Payments, escrow, and payouts are powered by Stripe and Stripe Connect. When you transact or onboard as a creator, Stripe collects and processes your payment, bank, identity, and tax information as an independent controller under its own privacy policy. We retain transaction metadata (amounts, status, timestamps, and associated campaign and booking references) as needed to run the marketplace and to meet financial and tax record-keeping obligations.

5. Service providers and third parties

We share personal information with vendors that process it on our behalf, including:

• Stripe — payments, escrow, payouts, identity and tax onboarding.
• Supabase — authentication and database hosting.
• Cloudflare Stream — video upload, encoding, storage, and delivery.
• Anthropic — AI drafting of campaign briefs.
• PostHog — product analytics.
• Sentry — error monitoring and diagnostics.
• Cloudflare Turnstile — bot and abuse protection on sign-in and sign-up.

We also share information between brands and creators as necessary to run a campaign (for example, a creator’s deliverables are shared with the contracting brand), and we may disclose information to comply with law, enforce our Terms, or protect rights and safety. If we are involved in a merger, acquisition, or asset sale, information may be transferred subject to this Policy. We do not sell your personal information for money.

6. Cookies

We use strictly necessary cookies to authenticate you and keep the Service secure, and analytics cookies (via PostHog) to understand usage. Where required, we request consent for non-essential cookies. You can control cookies through your browser settings; disabling strictly necessary cookies may break core functionality such as staying signed in.

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service. After account closure we delete or de-identify personal data, except where we must retain it to meet legal, tax, accounting, or fraud-prevention obligations (for example, transaction and payout records are typically retained for the period required by applicable financial regulations) or to resolve disputes and enforce agreements.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing.

• EEA/UK (GDPR). You may exercise the rights above, including the right to erasure under Article 17, and you may withdraw consent at any time. You also have the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA). You may request access to, deletion of, and correction of your personal information, and you may opt out of “sharing” for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.

To make a request, contact us at privacy@[DOMAIN]. We will verify your identity before acting and respond within the timeframes required by law. Note that some records must be retained as described in “Data retention”.

9. Account deletion

You can delete your account at any time from Settings. Deletion blocks on active work (for example, an open booking or unreleased escrow), then scrubs personal information and removes your user record, subject to the financial and audit records we are legally required to keep. You can also request deletion by emailing privacy@[DOMAIN].

10. Security

We use technical and organizational measures including encryption in transit, row-level access controls, scoped access keys, and bot protection to safeguard personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. International transfers

Your information may be processed in countries other than where you live, including the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses where required.

12. Children

The Service is not directed to children under 16 (or the minimum age required in your jurisdiction), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with an updated “Last updated” date, and where required we will notify you.

14. Contact

Questions or requests can be sent to [COMPANY LEGAL NAME] at privacy@[DOMAIN].