Privacy policy

1. Controller and contact

Filippos Kagkiouzis, Würzburger Straße 2, 60385 Frankfurt am Main, Germany. E-mail: hello@ugchub.de, phone: +49 1573 1317011. You can contact us directly at these details for access, rectification and erasure requests.

2. Provision and security

When you visit, technically necessary connection data such as IP address, time, requested address, browser and error data are processed for delivery, abuse prevention and troubleshooting. Hosting: Vercel Inc., USA. Accounts, database and video files: Supabase, project region Ireland (EU). The website’s server functions run in the Vercel region Dublin (EU). The legal basis is our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR). Technical logs are processed in line with the retention periods that apply at the respective provider; they are not intended for public profiles.

The project region alone does not rule out access or processing outside the EEA, in particular by international providers and subcontractors. Information on recipients, contractual terms and their safeguards: Vercel privacy policy, Vercel DPA, Supabase privacy policy and Supabase DPA. Where data is transferred to third countries, the safeguards are governed by the respective provider agreements, for example EU standard contractual clauses. No specific certification is promised here.

3. Account and login

When you register, we process your e-mail address, display name, chosen role and login data to provide the test access you requested (Art. 6(1)(b) GDPR). Supabase processes the password data in its authentication service; passwords are never displayed publicly. Confirmation and login e-mails serve account security. Roles are assigned on the server. Necessary session cookies are HttpOnly, Secure in production and SameSite=Lax; the access cookie lasts about one hour, the refresh cookie up to 30 days.

4. Public creator profile

Creators can publish a profile in the creator directory. Only the information intended for this is then publicly visible: public name, handle, description, city, country, languages, industries, style, base fee and up to three portfolio videos uploaded by the creator. The account name and e-mail address are not published. A profile only becomes visible once the creator publishes it and the administrators have reviewed it; if the creator changes their name, handle or description or uploads a new video, it is hidden until it has been reviewed again. The purpose is to arrange orders, as requested by the creator (Art. 6(1)(b) GDPR). Publication can be ended at any time in your own profile; videos can be deleted there at any time. Videos are kept in private storage and are only delivered via time-limited links.

5. Briefs and applications

Brands can publish briefs. Open briefs are publicly visible with the brand name given, title, description, fee, licence and delivery time. Applications from creators (public name, the handle if the profile is approved, and the application message) are only seen by the applicant and the brand that published the brief. If the brand accepts an application, this creates a test order as described in section 6. The purpose is to arrange orders (Art. 6(1)(b) GDPR). Closed briefs are no longer public.

6. Shared test orders and videos

In the pilot, we store participant identifiers, brief, fee and licence simulation, deadlines, status, revisions and video deliveries. The purpose is to carry out and evaluate the test you requested (Art. 6(1)(b) GDPR). The order and video are intended for the two accounts involved. Videos are kept in private storage; short-lived retrieval links are used for playback. Anyone with a valid link can use it until it expires. Please do not share such links. The operator and technical providers may process data to the extent necessary for administration, troubleshooting and handling data subject requests. Messages within an order are only seen by the two parties; they are stored with the order. For requests, status changes, applications, reviews and approvals, we create notifications in your account that only you can see; they contain the names of the accounts involved and a link to the matter.

7. Mutual reviews

After a completed test order, both sides can rate four criteria and leave a comment. Your own reviews are visible to you immediately. The other side only sees the content once both reviews have been submitted or the 14-day review period has expired. This release is checked in the database. In the pilot, these reviews are only visible to the parties to the order. The basis is carrying out this requested feedback procedure (Art. 6(1)(b) GDPR). This does not result in a public overall rating or automatic suspension decisions. You can report errors or misuse via support.

8. Contact and WhatsApp

When you contact us, we process your contact details, the content and, where applicable, the order number in order to respond (Art. 6(1)(b) GDPR for access-related requests, otherwise Art. 6(1)(f) GDPR: handling incoming enquiries). WhatsApp is optional; e-mail and phone are alternatives. Only an active click opens wa.me. No WhatsApp scripts are loaded on UGCHub and no message is sent automatically. WhatsApp Ireland / Meta processes data under its own terms; processing in third countries is possible. WhatsApp privacy policy.

9. Matching requests

Through the request form in the creator finder we store your e-mail address, optionally your brand or company, the chosen industry, budget and language, your message, the page language, the time and – if you are signed in as a brand – your account. Each request gets a ticket number. The purpose is to answer your request with suitable creator profiles (Art. 6(1)(b) GDPR, pre-contractual steps at your request). Only administrators and, if signed in, you yourself can see the request. Where set up, we send you a confirmation e-mail through the delivery service Resend (Resend, Inc., USA) as our processor; this may involve a transfer to the USA on the basis of appropriate safeguards. We delete requests no later than 12 months after they are closed, unless they led to an order.

Waitlist: If you join the waitlist before launch, we store your e-mail address, whether you signed up as a brand or creator, and the time. The purpose is to inform you about the launch and your access (Art. 6(1)(b) GDPR, pre-contractual steps at your request). You receive a confirmation and a message once your access is ready, sent via Brevo (Sendinblue SAS, Paris, France). We delete the data once you create an account, on request, or at the latest 12 months after launch.

10. Ads via Meta (Marketing API)

On the "Ads" page, brands can connect their Meta account (Facebook/Instagram) to create approved videos with a paid ads licence as ads in their own ad account. When connecting, you sign in with Meta and grant UGCHub the permissions shown. We then store the access token issued by Meta with its expiry date and the name of your Meta account. The token is kept only on the server in a protected part of the database, cannot be retrieved by any account and is used solely to list your ad accounts and Pages and to create ads at your request.

For each ad created we store the ad account, the IDs of the video, campaign, ad set and ad, the daily budget, countries, run time, text, headline, link and button, and the chosen Facebook Page and Instagram account. The brand and the creator involved can see these details. We transmit to Meta the video (via a private download link valid for one hour), the ad texts and settings, and the brand name as beneficiary and payer, as required by the Digital Services Act for ads in the EU. Everything is created paused; the brand switches the ad on itself in Ads Manager.

The legal basis is the performance of the user agreement with the brand that requests this feature (Art. 6(1)(b) GDPR). For the creator's data recognisable in the video, the basis is the paid ads licence the creator granted for the order (Art. 6(1)(b) GDPR); the ad ends no later than the licence. Meta Platforms Ireland Ltd. is independently responsible for processing in its services; a transfer to Meta Platforms, Inc. in the USA is possible. Meta Privacy Policy.

We delete the access token immediately when you disconnect on the "Ads" page, and Meta invalidates it after about 60 days at the latest. You can also remove UGCHub in your Facebook settings under "Business integrations". The details of ads created remain stored with the order and are deleted with it (section 12). Campaigns and videos already created at Meta remain in your ad account until you delete them there.

11. Cookies and external media

Necessary session and security technologies serve the service you have expressly requested (§ 25(2) TDDDG). Your media choice is kept in local storage for up to 180 days. YouTube images and embedded players only load after consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). In this case, IP address, device and usage information may be transmitted to Google / YouTube and storage technologies may be used, including outside the EEA. You can change your consent at any time with effect for the future. Direct external links only contact the provider after you click them. UGCHub contains no analytics or advertising trackers.

Details on cookies and local demo storage · Google privacy policy

12. Storage and deletion

Account data, test orders, reviews and uploaded videos are stored for the duration of the requested pilot. After the test ends, they are reviewed for necessity and, as a rule, deleted or anonymised within 30 days, unless retention obligations or specific open disputes prevent this. An automatic deletion routine has not yet been set up in the pilot; the operator carries out this clean-up. You can delete your account yourself at any time in the account settings; this immediately removes your account, profile, portfolio videos, chats, shortlist, notifications and the reviews you wrote. Completed orders remain with the other party as proof of the agreed licence (Art. 17(3)(e) GDPR), without a link to your account. Deletion is not possible while an order is in progress. Deletion requests can also be made at any time via the contact above. Technical backups may be removed with a delay according to the respective provider's deletion cycles. Local demo data remains in your browser until you delete the website data.

13. Your rights

Subject to the legal requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests and withdraw consent at any time with effect for the future. You can lodge a complaint with a data protection supervisory authority, in particular the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit). To exercise your rights, contact hello@ugchub.de.

14. Necessity and decisions

Providing account data is required for test access, and order and video data for the respective feature used. Without this data, you cannot use the corresponding feature. External media and WhatsApp are optional. There is no automated decision-making with legal or similarly significant effects and no corresponding profiling. Please only upload content you are entitled to use, and do not use any sensitive personal data in the test.