Privacy Policy

1. Scope and who we are

For account administration, our direct customer relationship, marketing, product security, product analytics, and public social-media data that UGC Pulse selects for its own purposes, UGC Pulse acts as a controller or equivalent business under applicable privacy law.

When a business customer submits personal data or directs us to process it solely for that customer's purposes, UGC Pulse acts as a processor or service provider. In that situation, the business customer is the controller or business and is responsible for its instructions, notices, permissions, and lawful basis. We process that data under the customer's documented instructions, our Data Processing Addendum, and an applicable agreement.

Privacy questions and requests may be sent to hello@ugcpulse.app.

2. Information we collect

We may collect these categories:

• Account and organization data: name, email, login information, account role, organization name, company or app URLs, assigned seat, preferences, and account status.
• Product and Customer Content: selected competitors and accounts, searches, tracked subjects, prompts, chats, scripts, briefs, analyses, generated outputs, saved collections, files, instructions, and feedback.
• Billing data: plan, subscription status, billing dates, invoices, transaction references, tax information, refund or dispute status, and limited billing details received from Dodo Payments. We do not directly store complete payment-card details.
• Communications: support, privacy and rights-holder requests, feedback, survey responses, email preferences, and other messages.
• Technical, security, and usage data: IP address, browser and device data, operating system, timestamps, referring page, pages and features viewed, approximate location derived from IP, diagnostic events, security logs, cookie or similar identifiers, and interactions with emails or the Service.

3. Public social-media data

UGC Pulse is designed to collect and analyze information publicly available on TikTok, Instagram, and similar platforms. This may include account names and identifiers, usernames, profile and post URLs, captions, timestamps, media metadata, views, engagement figures, posting activity, and trend or performance signals.

UGC Pulse does not connect to customers' social-media accounts and does not access their private account analytics, private posts, private messages, or social-account credentials. Public data may relate to creators and other people who do not have a UGC Pulse account.

Public availability does not mean information is outside privacy, copyright, publicity, platform, or other laws. We do not intentionally use public data to infer sensitive personal traits, facilitate surveillance or harassment, unlawfully discriminate, or target minors.

4. Sources of information

We may obtain information:

• directly from you, your organization, or an authorized user;
• automatically from your use of the marketing site, Service, or our communications;
• from Dodo Payments and other providers involved in delivering the Service;
• from public sources and data providers; and
• from another customer when that customer lawfully instructs us to process information on its behalf.

5. How we use information

We may use information to:

• provide, operate, personalize, and maintain the Service;
• authenticate users and manage accounts, subscriptions, seats, and usage allowances;
• analyze public creative performance and generate requested scripts, briefs, analyses, and other outputs;
• process billing and maintain transaction records;
• respond to support, privacy, and public-data requests;
• send essential service communications and, where permitted, onboarding, product, research, and marketing communications;
• understand use, troubleshoot, improve performance, and develop features;
• secure the Service, prevent fraud and abuse, investigate incidents, enforce agreements, and establish or defend legal claims; and
• comply with law and lawful requests.

6. Legal bases

The legal basis depends on the information, purpose, and your location. We may process data to perform a contract or take steps at your request, comply with law, pursue legitimate interests, protect vital interests in an emergency, or act with consent.

Our legitimate interests may include providing and securing the Service, preventing fraud, communicating with customers, improving product performance, and turning public creative-performance information into useful business intelligence. For public data, we balance those interests against individual rights through data minimization, use restrictions, retention controls, source and purpose limits, and correction, objection, or removal channels.

UGC Pulse does not make decisions based solely on automated processing that produce legal or similarly significant effects for individuals.

7. How we disclose information

We disclose information only as reasonably necessary for the purposes in this Policy. Provider roles depend on the service and applicable law:

• Supabase: authentication, database, storage, and backend infrastructure. Our primary production database is hosted in the United States.
• Dodo Payments: Merchant of Record for checkout, payment processing, tax, invoices, refunds, fraud prevention, sanctions screening, and disputes. Dodo may act as an independent controller for transaction and legal-compliance activities and as a processor for limited services where its contract says so.
• OpenAI: OpenAI API processing for prompts, selected context, and generated outputs.
• Google Analytics 4, Mixpanel, and Microsoft Clarity: website or product analytics when configured. The current marketing code supports GA4 conditionally. Mixpanel and Microsoft Clarity are planned or may be used in the signed-in product, but this Policy does not claim they are loaded on a page where they are not actually deployed.
• Autosend: transactional, support, onboarding, product-update, and marketing email.
• Public social-data provider: a provider has not yet been selected. We will review this Policy and applicable provider disclosures before production processing begins where an update is required.

We may also disclose information to professional advisers, auditors, insurers, affiliates, or authorities when reasonably necessary; to address fraud, security, legal claims, or lawful requests; or in connection with a merger, financing, reorganization, or sale of all or part of the business. We do not permit providers to use Customer Content for their own advertising.

8. AI processing and model training

We use the OpenAI API to process prompts, relevant customer context, and generated outputs when you use AI features. Customer Content is not used to train UGC Pulse or third-party AI models unless you separately opt in.

OpenAI states that business and API inputs and outputs are not used to train its models by default. Depending on the API feature, account setting, and legal requirements, OpenAI may retain abuse-monitoring data for a limited period. If we change AI providers, we will review the new provider and update required disclosures before routing Customer Content to it.

9. Analytics and similar technologies

The marketing site's current code can load Google Analytics 4 only when a measurement identifier is configured for an authorized environment. It does not display an analytics pop-up when no analytics vendor is configured because no optional analytics tool is loaded in that state. When GA4 is configured under the current implementation, an existing consent control can accept or reject analytics before the Google tag loads.

UGC Pulse may also configure Mixpanel or Microsoft Clarity for the marketing site or signed-in product. These tools may receive IP address, device and browser data, pages or screens viewed, interactions, session identifiers, approximate location, and diagnostic events. Clarity may provide heatmaps and masked session recordings if activated. Free-form Customer Content should not be intentionally sent to analytics tools.

Where an existing consent control is available, you can change or withdraw your choice through Cookie settings. You may also use browser controls, vendor controls, or contact us. We honor Global Privacy Control and other legally binding preference signals where applicable and technically supported. Browser controls do not retroactively erase information already transmitted.

We do not sell Customer Content. Some laws define sale or sharing broadly enough to include certain analytics disclosures even when no money changes hands. We therefore do not make an unqualified no-sale statement for every statutory definition and will provide notices and opt-out rights where applicable.

10. Email communications

Autosend helps us send transactional, support, onboarding, product, research, and marketing messages. You may unsubscribe from marketing through the link in those messages or by contacting us. Unsubscribing from marketing does not prevent essential account, billing, security, legal, or service messages.

11. International data transfers

Our primary Supabase database is hosted in the United States. We and our providers may process information in the United States, India, and other countries where they operate. Those countries may have different privacy laws than your country.

Where applicable law requires an additional transfer safeguard, we use an appropriate contractual or other recognized mechanism after the required details are completed. We do not claim that a specific transfer mechanism applies to every data flow.

12. Data retention

We keep personal data only as long as reasonably needed for the purposes described above, subject to these current targets and legal exceptions:

• Customer Content is kept while an account is active and deleted or anonymized from active systems within 30 days after a verified account-deletion request.
• Deleted data may remain in encrypted or access-controlled backups until normal rotation, generally within 90 days.
• Security, access, and fraud-prevention logs may be kept for up to 12 months unless an incident or legal need requires longer.
• Support records may be kept for up to three years.
• Billing, tax, fraud, dispute, and legal records may be kept as required by law, generally up to seven years.
• Analytics data follows the configured provider setting and is kept for the shortest practical period consistent with the purpose. Session recordings and heatmaps may have different provider retention periods.
• Public social data may be retained and refreshed while useful and lawful for the Service, subject to platform deletion, provider terms, correction, objection, removal, and suppression requests.

We may retain limited information longer for legal holds, disputes, fraud prevention, security, tax, or other legal obligations.

13. Security and incidents

We use reasonable administrative, technical, and organizational measures intended to protect personal data. Access is limited to people and providers with a legitimate operational need. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

If a personal-data incident occurs, we will investigate, mitigate, keep legally required records, and notify affected people, customers, or authorities when and within the time applicable law requires.

14. Your privacy rights

Depending on your location and our role, you may have rights to access, correction, deletion, restriction, objection, and portability; to withdraw consent; to opt out of certain sale, sharing, targeted advertising, or profiling; and to complain to a competent data-protection authority.

You may submit a request to hello@ugcpulse.app. We may request information reasonably needed to verify identity, authority, and the records involved. An authorized agent may submit a request where law permits, subject to verification of authority. If a request is denied, you may have a right to appeal by replying to our decision. You may exercise legally protected rights without discrimination.

Rights are not absolute. We may deny or limit a request where a lawful exception applies, including inability to verify identity, protection of others' rights, security, fraud prevention, legal claims, or required record retention. We will explain the basis where law requires.

15. Additional US privacy disclosures

Where applicable US state law covers our processing, the categories collected are described in Sections 2 and 3, sources in Section 4, purposes in Section 5, and recipients in Section 7. We do not use or disclose sensitive personal information to infer characteristics.

Residents may have rights to know, access, correct, delete, obtain a copy, opt out, appeal, and use an authorized agent. We do not offer financial incentives for personal data. Whether analytics constitutes sale, sharing, or targeted advertising depends on the law and configuration, so applicable opt-out signals and requests are assessed rather than categorically rejected.

16. Public-data correction and removal

If public social data about you appears in UGC Pulse, you may ask us to identify the source, correct inaccurate information, object to processing, restrict display, or remove it by emailing hello@ugcpulse.app. Include the relevant profile or post URL and the basis for the request.

We will assess the request under applicable law, our interests, the rights of others, and available verification. After removal, we may keep a minimal suppression record, such as an identifier or URL, to prevent the same item from being re-collected. We may retain information required for security, legal claims, or compliance.

17. Age restriction

The Service is for users who are at least 18. It is not directed to children, and we do not knowingly solicit account data from them. Contact us if you believe a child has provided personal data through the Service.

18. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will update the date above and give additional notice or request consent when applicable law requires it. Material changes do not retroactively reduce rights that cannot legally be waived.

19. Contact us

Send privacy questions, rights requests, appeals, complaints, and public-data requests to hello@ugcpulse.app. You may also review our Terms of Service and Cookie Policy, and Subprocessor List.