Privacy Policy

We collect information you provide directly when you register for an account, including your name, email address, profile details, and payment information. Authentication is handled by Clerk, and payment data is processed by Stripe — we do not store raw card numbers.

Creators may optionally choose to save their bank account details (such as account holder name, bank name, account number, and routing/sort code) to prefill future withdrawal forms. This is entirely opt-in — bank details are only stored if you explicitly choose to save them. Stored bank details are encrypted at rest and can be deleted at any time from your account settings.

When you use the platform, we automatically collect usage data such as pages visited, features used, IP address, approximate geographic location, and device/browser information. This helps us improve the platform experience and enforce geographic campaign restrictions.

Creators may submit video content and personal profile information (e.g. social media handles, audience demographics). Brands may provide campaign briefs, budgets, and company details.

We process your personal data on the following legal bases: (a) Contract — processing necessary to provide the UGCBloom platform and fulfil our obligations to you; (b) Legitimate interest — analytics, fraud prevention, platform security, and service improvement; (c) Consent — optional features such as storing bank details for withdrawal prefill, and non-essential cookies; (d) Legal obligation — where we are required to retain or disclose data by law (e.g. financial records, tax reporting).

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, adjust the relevant setting in your account or contact us at xenia@ugcbloom.com.

We use the information we collect to: (a) operate and provide the UGCBloom platform; (b) process transactions and send related information including confirmations and invoices; (c) match brands with appropriate creators; (d) send service and account-related communications; (e) improve, personalise, and expand our platform; (f) detect and prevent fraud, abuse, and violations of our Terms of Service; (g) enforce geographic campaign restrictions; (h) comply with legal obligations.

We do not use your data to make fully automated decisions that significantly affect you without human review.

We share your data only with trusted third-party service providers (sub-processors) necessary to operate the platform. We maintain Data Processing Agreements (DPAs) with each sub-processor to ensure your data is handled in accordance with applicable data protection law:

• Clerk — authentication and identity management • Supabase — secure database hosting • Stripe — payment processing • Resend — transactional email delivery • Vercel — platform hosting and edge delivery

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may disclose information if required by law, court order, or governmental regulation, or to protect the rights, safety, or property of UGCBloom, our users, or the public.

When brands and creators collaborate through campaigns, limited profile information (such as creator name, profile photo, and social media handles) is shared between the parties as necessary to facilitate the collaboration.

UGCBloom uses cookies and similar tracking technologies to maintain your session, remember your preferences, and analyse platform usage. The types of cookies we use include:

• Strictly necessary cookies — required for authentication, session management, and core platform functionality. These cannot be disabled. • Functional cookies — remember your preferences and settings (e.g. saved form data, language). • Analytics cookies — help us understand how users interact with the platform so we can improve the experience. These are anonymised where possible.

You may decline non-essential cookies via your browser settings. Disabling certain cookies may affect platform functionality.

We do not currently use third-party advertising trackers or retargeting pixels.

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymise your data within a reasonable period, except where we are required to retain it for legal or compliance reasons (e.g. financial records).

Campaign content and associated metadata may be retained for analytics and dispute resolution purposes for up to 3 years after campaign completion.

Under the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong SAR, you have the right to: (a) request access to the personal data we hold about you; (b) request correction of inaccurate data. If you are located in the UK or EEA, additional rights under UK GDPR / GDPR may also apply, including the right to erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest.

You also have the right to: (a) withdraw consent for any opt-in data processing (such as stored bank details) at any time; (b) request deletion of your stored bank details from your account settings; (c) request a copy of your personal data in a structured, machine-readable format.

To exercise any of these rights, contact us at xenia@ugcbloom.com. We will respond within 30 days. You may also lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong, or with the relevant supervisory authority in your jurisdiction.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Data at rest is encrypted, and all data in transit is protected via HTTPS/TLS. Sensitive data such as bank account details receives additional encryption at the application level.

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security and encourage you to use a strong, unique password for your account.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

If the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected users directly via email. Notification will include the nature of the breach, the data affected, the likely consequences, and the measures we have taken or propose to take to address the breach.

UGCBloom is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that a minor has provided us with personal data, we will take steps to delete that information promptly.

UGCBloom is operated by AiDevLimited, a company registered in Hong Kong SAR (2301, 23/F Bayfield Building, 99 Hennessy Road, Wan Chai, Hong Kong). Your data may be processed in countries outside Hong Kong by our service providers. Where this occurs, we ensure appropriate safeguards are in place in accordance with the Personal Data (Privacy) Ordinance (PDPO) and other applicable data protection law.

We may update this Privacy Policy from time to time. When we do, we will revise the 'Last updated' date at the bottom of this page and, where appropriate, notify you by email. Your continued use of the platform after any changes constitutes your acceptance of the updated policy.