1. Scope and controller
This Privacy Policy applies to ugcagent.app, the UGC Agent web application, related APIs and MCP connections, support communications, and other services that link to this policy (collectively, the “Service”). UGC Agent is an Autopilot product. Autopilot, operating UGC Agent, is the controller of personal information described in this policy unless a different party is identified at collection.
For privacy questions or requests, email hello@ugcagent.app. If you use UGC Agent for an organization, that organization may separately control information it uploads, saves, exports, or uses for outreach.
2. Information we collect
Account and contact information
We process information such as your name, email address, Firebase user identifier, authentication status, organization or team membership, invitations, preferences, and communications with support. Authentication may be completed through Google or passwordless email links.
Product content
We process prompts, conversations, campaign requirements, creator preferences and exclusions, saved leads, lists, tags, stages, automation settings, delivery email addresses, exports, and feedback. If you upload a seed list, creator application file, document, image, or video, we process the file and information extracted from it to perform the requested workflow.
Billing information
Stripe processes checkout, payment methods, invoices, taxes where applicable, subscription changes, and cancellation. We receive limited billing records such as Stripe customer and subscription identifiers, plan, billing period, subscription status, renewal or cancellation status, and transaction metadata. UGC Agent does not store full payment-card numbers.
Public creator information
The Service processes information made public on Instagram, TikTok, portfolio sites, and other public web sources. This may include names, handles, profile URLs, bios, public business emails, portfolio links, follower and engagement information, public posts or videos, content metrics, brand references, and inferences such as niche, campaign relevance, contact type, or first-pass fit score.
Device, usage, and referral information
We and our providers may process IP address, browser and device details, approximate location derived from IP, pages viewed, referring URL, timestamps, feature interactions, errors, subscription events, run status and counts, and session or console diagnostics. Product analytics may include the text of a submitted creator-search goal, limited to 1,000 characters, so we can investigate result quality. Do not include secrets or sensitive personal information in prompts.
3. Sources of information
We obtain information directly from you; from your organization or team administrator; from your browser and interactions with the Service; from billing, authentication, analytics, referral, hosting, and email providers; from public social profiles and websites; and from social-data and search providers that retrieve public information on our behalf.
Creator information generally originates from publicly accessible profiles, posts, videos, portfolio pages, and business contact points. Public availability does not remove applicable privacy rights. Creators may contact us using the process in Section 11.
4. How and why we use information
- Provide the Service: authenticate users, run searches, enrich and score creator profiles, store conversations and lists, operate automations and MCP access, generate exports, and provide support.
- Process subscriptions: initiate checkout, maintain plan entitlements, apply usage limits, handle team access, and connect users with Stripe’s billing portal.
- Improve and troubleshoot: measure feature performance, understand failed or difficult searches, replay technical sessions, diagnose errors, and develop safer or more accurate workflows.
- Communicate: send authentication links, service notices, team invitations, automation deliveries, onboarding messages, billing information, support replies, and product communications. Marketing messages include an opt-out where required.
- Protect the Service: prevent abuse, enforce plan limits, investigate fraud or security incidents, protect users and creators, and enforce our Terms.
- Meet legal obligations: maintain records required for tax, accounting, dispute, compliance, and law-enforcement purposes.
Where the GDPR or similar law applies, our legal bases include performance of our contract with account holders, our legitimate interests in operating and improving a business creator-sourcing service, consent where we specifically request it, and compliance with legal obligations. Our legitimate interests include service security, product analytics, support, fraud prevention, referral attribution, and processing public professional information for creator discovery requested by business users.
5. AI processing and creator scoring
UGC Agent sends relevant prompts, campaign context, uploaded content, and public creator information to configured AI providers, including Google Gemini, to interpret requests, research companies, derive search criteria, classify and summarize public information, analyze content, and generate recommendations or text.
Creator scores, classifications, and recommendations are automated first-pass tools based on available public evidence and user-supplied criteria. They can be incomplete or wrong. UGC Agent does not make hiring, employment, credit, housing, insurance, or other legally significant decisions. Users must review the underlying profile and evidence before contacting, selecting, or rejecting a creator.
8. Data retention
We retain account and product information while an account is active and afterward only as long as reasonably needed to provide requested access, resolve disputes, enforce agreements, maintain security and deduplication records, comply with law, or complete a verified deletion request. Users can delete individual conversations in the product. Guest conversations stored only in a browser remain until the user clears them.
Billing and transaction records are retained for periods required by tax, accounting, and financial laws. Support and security records are retained according to the nature of the issue. Analytics and referral information follows the applicable provider settings and is deleted or aggregated when no longer reasonably necessary. Backups may retain residual copies for a limited rotation period before being overwritten.
Public creator information is retained in user conversations, lists, exports, and operational deduplication records until deleted, suppressed, refreshed, or no longer needed for the requested business workflow. A creator may request correction, suppression, or deletion as described below.
9. International data transfers
UGC Agent and its providers may process information in the United States, European Economic Area, and other countries where they operate. Those countries may have different privacy laws. Where required, we rely on adequacy decisions, contractual safeguards such as standard contractual clauses, or another lawful transfer mechanism.
10. Your privacy rights
Depending on where you live, you may have rights to know or access personal information, correct it, request deletion, restrict processing, receive portable data, object to certain processing, withdraw consent, opt out of marketing, and lodge a complaint with a data-protection authority. California residents may also have rights to know the categories and sources of information, request correction or deletion, and receive equal service when exercising a right.
We do not sell customer account information or customer content for money, and we do not share them for cross-context behavioral advertising. UGC Agent’s core service does provide business users with public creator profile and contact information; creators can use the request process below.
Email hello@ugcagent.app with the subject “Privacy request.” Describe the right you want to exercise and the account, email, or public profile involved. We may request reasonable verification and may retain information where permitted or required by law. Authorized agents may submit requests where local law permits.
11. Requests concerning public creator data
If you are a creator whose public information appears in UGC Agent, send the profile URL or handle, the platform, the information at issue, and the requested correction or removal to hello@ugcagent.app. Do not send government identification unless we specifically request a safer verification method.
After reasonable verification, we will assess the request under applicable law and may correct, delete, restrict, or suppress the profile from future results. Suppression may require retaining a minimal identifier so the profile is not re-collected. Removal from UGC Agent does not remove information from the original social platform, public website, prior customer exports, or independent third-party systems.
12. Security
We use administrative, technical, and organizational safeguards designed for the nature of the information we process, including authenticated access, owner-scoped database rules, server-side secrets, transport encryption, restricted billing webhooks, and access controls. No online service can guarantee absolute security. Keep your account, email access, exported files, and private MCP URL secure, and notify us promptly if you suspect misuse.
13. Children
The Service is a business tool intended for adults and is not directed to children. You must be at least 18 years old to create an account or purchase a subscription. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided account information, contact us so we can investigate and delete it where required.
14. Changes and contact
We may update this policy when the Service, providers, or applicable laws change. Material updates will be identified by a revised date and, where appropriate, an in-product or email notice. Continued use after an update is subject to the updated policy, but we will request consent if the law requires it for a new use.
Privacy contact: hello@ugcagent.app
UGC Agent, an Autopilot product
https://ugcagent.app/privacy/