Privacy policy

Draft for legal review. Not in effect. This page lists the facts a privacy policy has to cover. The final text, the legal entity, the governing law and the data-protection contact must be provided by the owner and reviewed by counsel before launch.

Facts to cover

Account data: the email and workspace name given at signup; Stripe customer and subscription identifiers. Payment card details are handled by Stripe and never reach UGC Engineer.
API keys: only a SHA-256 hash and a short prefix are stored; the full key is shown once.
Data customers register: creator names and notes, social handles, campaigns.
Data collected about tracked accounts: public post metadata and public metrics of the registered accounts (post URL, publication time, caption, media type, duration, views, likes, comments, shares, saves, follower count), fetched daily through a third-party data vendor.
Retention: records are not hard-deleted by the service today; the retention period and deletion-on-request process are to be defined.
Sub-processors: payment processor (Stripe), social data vendor, cloud hosting, and this website’s host (Cloudflare), including Cloudflare Web Analytics if enabled.
Website: this site sets no cookies of its own. The hooks feed plays videos from a media host operated for UGC Engineer and links to the original posts.
Contact: hello@ugcengineer.app (placeholder).