NavigationCreatorsOpportunities
Login
Get Started

Be a part of the ultimate community for creators & brands

UGCDecks Legal Compliance•Doc ID: POL-PRIV-2026

Master Privacy Policy

Official legal disclosure detailing the processing, collection, retention, and protection of user personal records across the UGCDecks software platform.

Effective Date: June 16, 2026
Last Reviewed: October 12, 2026
Version: v2.4.1
1

Data Controller & Entity Identification

This Privacy Policy governs the processing of personal data by UGCDecks Inc. ("UGCDecks", "we", "us", or "our"), operating as the Data Controller in accordance with the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and the California Consumer Privacy Act as amended by the CPRA.

Entity: UGCDecks Technologies, Inc.

Registered Office: 548 Market St, Suite 4800, San Francisco, CA 94104, USA

Data Protection Officer (DPO): [email protected]

General Privacy Inquiries: [email protected]

2

Categories of Data Collected & Legal Bases

We process your personal information strictly under established lawful bases pursuant to GDPR Article 6 and applicable statutory frameworks:

A. Account Registration & Identity Credentials

Full legal name, email address, cryptographic password hashes, profile avatar, and country of residence.

Legal Basis: Art. 6(1)(b) Contractual Necessity
B. Creator Portfolio Assets & Commercial Media

Uploaded digital media (images, video reels, audio), connected social media handles, self-attested audience demographics, rates, and historical campaign metrics.

Legal Basis: Art. 6(1)(b) Contractual Necessity
C. Telemetry, Machine Identifiers & Audit Logs

IP addresses, browser client fingerprints, HTTP referral headers, geographic region, and platform interaction logs.

Legal Basis: Art. 6(1)(f) Legitimate Interest (Platform Security & Error Isolation)
D. Transactional & Financial Records

Subscription billing statuses, masked payment tokens, and invoice identifiers. We do not store raw primary account numbers (PAN).

Legal Basis: Art. 6(1)(c) Legal Obligation (Tax & Fiscal Audit Compliance)
3

Cookies & Automated Tracking Technologies

We implement first-party and restricted third-party cookies, HTML5 local storage objects, and telemetry pixels to sustain system integrity:

  • Strictly Necessary Cookies: Essential for session authentication, CSRF mitigation, and load-balancer route persistence. These cannot be deactivated via platform menus.
  • Functional & Analytic Cookies: Aggregated, pseudonymous performance tracking (e.g., page load latencies, link click-through frequency). Deployed solely with prior user consent where mandated by the ePrivacy Directive.

You can modify cookie handling directly via browser controls. Opting out of functional cookies may impact responsive media kit generation.

4

Data Disclosures & Subprocessor Network

UGCDecks does not sell, lease, or monetize personal data to broker syndicates. Data disclosures are restricted to:

1. Public Presentation of Portfolios

Creator profile cards and media kits designated as "Public" are indexed and viewable by any third party accessing your unique profile domain.

2. Authorized Subprocessors

Data is transferred under active Data Processing Addendums (DPAs) incorporating Standard Contractual Clauses (SCCs). Categories include cloud compute (AWS, Supabase), transactional email (Postmark/Resend), and billing (Stripe).

3. Statutory Disclosures

We may release verified customer records when legally compelled by subpoena, court decree, or mandatory national security process.

5

Cross-Border International Data Transfers

If you access our services from the European Economic Area (EEA), the United Kingdom, or Switzerland, please note that personal data is transferred, stored, and processed in the United States.

We govern cross-border data transmissions via the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) alongside supplementary technical safeguards including in-transit envelope encryption.

6

Data Retention & Account Termination

We maintain personal data solely for the period required to fulfill the operational purposes detailed herein, or until you initiate profile termination.

Upon receipt of a verified account closure command:

  • Media assets and production decks are detached and purged within 30 calendar days.
  • Cold-storage database backups are irreversibly overwritten within 90 calendar days.
  • Invoicing records are retained for up to 7 years strictly to comply with corporate financial reporting statutes.
7

Technical & Organizational Security Measures (TOMs)

UGCDecks employs comprehensive physical, administrative, and technical safeguards engineered to prevent unauthorized alteration, destruction, or exfiltration:

  • Transport Encryption: All transit channels enforce TLS 1.3 encryption protocols with strict HSTS policies.
  • Storage Encryption: Database records and media assets persist behind AES-256 encrypted block volumes.
  • Access Controls: Role-Based Access Controls (RBAC) enforced via multi-factor authentication (MFA) on zero-trust principles.
8

Statutory Global Privacy Rights

Pursuant to the GDPR, UK Data Protection Act, and CCPA/CPRA, users retain statutory privacy entitlements:

Right to Access / KnowRequest full disclosures regarding data categories processed and recipients.
Right to RectificationCorrect inaccurate or incomplete profile data directly via account settings.
Right to Erasure ("Be Forgotten")Demand prompt purge of personal identifiers where retention is no longer justified.
Right to Data PortabilityExport assets and portfolio analytics in structured, JSON/CSV formats.
Right to Restrict / ObjectCease processing under legitimate interest evaluations or direct promotional campaigns.
Non-Discrimination GuaranteeWe will not deny service or modify subscription terms for asserting your rights.

To submit an authentic Subject Access Request (SAR), email [email protected]. We fulfill verified requests within 30 days without charge.

9

Children's Online Privacy (COPPA / GDPR Art. 8)

UGCDecks is an enterprise creator tool not targeted at individuals under 16 years of age (or 13 where local state law stipulates). We do not knowingly process personal data belonging to children. If we identify that a minor has submitted unauthorized records, we will immediately initiate deletion protocols across our active database partitions.

10

Policy Amendments & Notification Protocols

We periodically revise this Privacy Policy to reflect changing product architecture or legal rulings. Material changes will be communicated at least 14 days prior to enforcement via registered user email notifications or prominent in-app dashboards.

Certification of Compliance

This Privacy Policy has been constructed to conform with European Union General Data Protection Regulation (GDPR) Regulation (EU) 2016/679, California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA).

© 2026 UGCDecks Technologies, Inc. All rights reserved.