We collect information you provide directly when you register for an account, including your name, email address, phone number (if you register one), profile details, and payment information. Authentication is handled by Clerk, and payment data is processed by Stripe - we do not store raw card numbers.

Creators may optionally choose to save their bank account details (such as account holder name, bank name, account number, and routing/sort code) to prefill future withdrawal forms. This is entirely opt-in - bank details are only stored if you explicitly choose to save them. Stored bank details are encrypted at rest and can be deleted at any time from your account settings.

When you use the platform, we automatically collect usage data such as pages visited, features used, IP address, approximate geographic location, and device/browser information. This helps us improve the platform experience and enforce geographic campaign restrictions.

Creators may submit video content and personal profile information (e.g. social media handles, audience demographics). Brands may provide campaign briefs, budgets, and company details.

We process your personal data on the following legal bases: (a) Contract - processing necessary to provide the UGCBloom platform and fulfil our obligations to you; (b) Legitimate interest - analytics, fraud prevention, platform security, and service improvement; (c) Consent - optional features such as storing bank details for withdrawal prefill, and non-essential cookies; (d) Legal obligation - where we are required to retain or disclose data by law (e.g. financial records, tax reporting).

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, adjust the relevant setting in your account or contact us at xenia@ugcbloom.team.

We use the information we collect to: (a) operate and provide the UGCBloom platform; (b) process transactions and send related information including confirmations and invoices; (c) match brands with appropriate creators; (d) send service and account-related communications; (e) improve, personalise, and expand our platform; (f) detect and prevent fraud, abuse, and violations of our Terms of Service; (g) enforce geographic campaign restrictions; (h) comply with legal obligations; (i) analyse content you submit using AI to generate feedback for creators and support content review.

We do not use your data to make fully automated decisions that significantly affect you without human review.

We share your data only with trusted third-party service providers (sub-processors) necessary to operate the platform. We maintain Data Processing Agreements (DPAs) with each sub-processor to ensure your data is handled in accordance with applicable data protection law:

• Clerk - authentication • Supabase and Fly.io - database, file storage and application hosting • Stripe and Airwallex - payments and creator payouts • Resend and Twilio - email and SMS delivery • AI model providers (via OpenRouter) - automated content analysis, creator feedback and campaign communications • Email and social outreach tools - contacting prospective creators • Social media data providers - collection of public profile and post data for creator discovery and performance measurement • Meta and Google - analytics, conversion tracking and connected-account integrations • Optional integrations you connect (live chat, Slack, scheduling) - only if you use them

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may disclose information if required by law, court order, or governmental regulation, or to protect the rights, safety, or property of UGCBloom, our users, or the public.

When brands and creators collaborate through campaigns, limited profile information (such as creator name, profile photo, and social media handles) is shared between the parties as necessary to facilitate the collaboration.

UGCBloom sends SMS (text) messages to creators who have opted in by registering and verifying a phone number on the platform and agreeing to SMS communications as part of their campaign agreement. Messages include campaign and contract updates, content deadline reminders, submission status updates, payment notifications, and account or security notices. Message frequency varies. Message and data rates may apply depending on your carrier and plan.

Mobile information and SMS consent will not be shared with third parties or affiliates for marketing or promotional purposes. No mobile information will be sold, rented, or shared with any third party for marketing purposes at any time. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding sub-processors acting on our behalf solely to deliver messages (such as our SMS provider, Twilio).

You may opt out of SMS messages at any time by replying STOP to any message, or reply HELP for assistance. You can also withdraw consent by contacting us at xenia@ugcbloom.team; opting out does not affect essential account security messages such as phone verification codes you request. SMS messaging for UGCBloom may be provided under the carrier registrations of The Comet Korlátolt Felelősségű Társaság, a company registered in Hungary and the principal investor in AiDevLimited, the operator of UGCBloom.

UGCBloom uses cookies and similar tracking technologies to maintain your session, remember your preferences, and analyse platform usage. The types of cookies we use include:

• Strictly necessary cookies - required for authentication, session management, and core platform functionality. These cannot be disabled. • Functional cookies - remember your preferences and settings (e.g. saved form data, language). • Analytics cookies - help us understand how users interact with the platform so we can improve the experience. We use Google Analytics (Google LLC) to collect anonymised usage data such as pages visited, session duration, and referral sources. Google may process this data on servers outside your jurisdiction. • Advertising & measurement cookies - we use the Meta Pixel (Meta Platforms, Inc.) to measure the effectiveness of our advertising campaigns, track conversions, and build audiences for ad targeting on Facebook and Instagram. The Meta Pixel may collect data such as pages visited, actions taken, and device information, which Meta may use in accordance with its own data policy.

When you first visit, we ask for your consent before setting any non-essential cookies. Analytics, marketing, and functional cookies stay off until you opt in, and you can change or withdraw your choices at any time via the "Cookie Settings" link in the footer. Strictly necessary cookies cannot be disabled, as they are required for the platform to work.

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymise your data within a reasonable period, except where we are required to retain it for legal or compliance reasons (e.g. financial records).

Campaign content and associated metadata may be retained for analytics and dispute resolution purposes for up to 3 years after campaign completion.

Under the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong SAR, you have the right to: (a) request access to the personal data we hold about you; (b) request correction of inaccurate data. If you are located in the UK or EEA, additional rights under UK GDPR / GDPR may also apply, including the right to erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest.

You also have the right to: (a) withdraw consent for any opt-in data processing (such as stored bank details) at any time; (b) request deletion of your stored bank details from your account settings; (c) request a copy of your personal data in a structured, machine-readable format.

To exercise any of these rights, contact us at xenia@ugcbloom.team. We will respond within 30 days. You may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong, or with the relevant supervisory authority in your jurisdiction.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Data at rest is encrypted, and all data in transit is protected via HTTPS/TLS. Sensitive data such as bank account details receives additional encryption at the application level.

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security and encourage you to use a strong, unique password for your account.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

If the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected users directly via email. Notification will include the nature of the breach, the data affected, the likely consequences, and the measures we have taken or propose to take to address the breach.

UGCBloom is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that a minor has provided us with personal data, we will take steps to delete that information promptly.

UGCBloom is operated by AiDevLimited, a company registered in Hong Kong SAR (2301, 23/F Bayfield Building, 99 Hennessy Road, Wan Chai, Hong Kong). Your data may be processed in countries outside Hong Kong by our service providers. Where this occurs, we ensure appropriate safeguards are in place in accordance with the Personal Data (Privacy) Ordinance (PDPO) and other applicable data protection law.

We may update this Privacy Policy from time to time. When we do, we will revise the 'Last updated' date at the bottom of this page and, where appropriate, notify you by email. Your continued use of the platform after any changes constitutes your acceptance of the updated policy.