Privacy Policy
Last updated: September 7, 2026
1. Who controls your data
UGCFlow ("we", "us"), based in Spain, is the data controller for personal data processed through UGCFlow.
2. What we collect
- Account data: email address, hashed password (or OAuth identifier if you sign in with Google), account role, credit balance.
- Content you upload: product photos, reference images, voice recordings, and any video/audio you submit for generation or as a voiceover.
- Generated content: the videos, scripts, and ad copy the Service produces for you.
- Payment data: handled directly by Stripe — we never see or store your full card number. We retain a record of purchases and credit transactions.
- Usage data: pages visited, generation history, timestamps, IP-derived country (for legal-compliance purposes such as this page's own EU detection), device/browser type.
- Cookies: see our Cookie Policy for the full list.
3. How we use it
- To provide the Service — generating videos from your input, managing your account and credits.
- To process payments and prevent fraud.
- To send transactional emails (password resets, purchase receipts, service notices).
- With your consent (EU visitors), to measure ad performance via Meta/TikTok/X pixels — see our Cookie Policy.
- To improve the Service, including analyzing aggregate usage patterns.
4. Legal bases (EU/EEA users)
We process your data under: performance of a contract (providing the Service you signed up for), legitimate interest (fraud prevention, service improvement), consent (marketing cookies/pixels), and legal obligation (tax/accounting records).
5. Who we share it with
We share data only with service providers who process it on our behalf, under contract, to operate UGCFlow:
- Stripe — payment processing.
- Resend — transactional email delivery.
- Cloud/render infrastructure (including Modal.com for elastic AI compute) — to generate your videos.
- DeepSeek — our AI "director" model, which writes your ad script. To do that it receives the text you write and the images you upload, including a product photo and, if you choose to provide one, a photo of a face. DeepSeek is based in China. See Section 6.
- OpenAI — used narrowly, and only as a fallback: if our own speech-to-text server is unreachable, an uploaded voiceover may be transcribed by OpenAI instead. It is not used to write your ads.
- Our own hardware. Some AI processing — speech-to-text, and parts of image analysis and script writing — runs on servers we operate ourselves rather than a third party, so that data is not shared onward at all.
- Meta, TikTok, X — only if you're shown and accept the cookie consent banner, for ad-performance measurement. Never shares your raw uploaded content, only anonymized/hashed identifiers for conversion tracking.
We do not sell your personal data.
6. International transfers
Some processors above process data outside the EU/EEA. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses, consistent with GDPR Chapter V.
Specifically: our AI director model is provided by DeepSeek, which is based in China. China is not covered by a European Commission adequacy decision, so content you submit for a generation — your written brief and your uploaded images, which may include a photograph of a face — is transferred outside the EU/EEA to produce your video. If you would rather not have an image of a real person transferred this way, do not upload one: generations using our generic AI-generated presenters do not require a face photo.
7. Data retention
We retain account and generation data for as long as your account is active, plus a reasonable period after closure for legal/accounting purposes (typically up to the statutory retention period applicable under Spanish/EU law for financial records). You can request earlier deletion — see Section 8.
8. Your rights
If you're in the EU/EEA (and, separately, under most other privacy laws), you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request erasure ("right to be forgotten").
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent at any time (for anything based on consent, e.g. marketing cookies).
- Lodge a complaint with your national data protection authority.
Two of these you can exercise yourself, immediately, from the "Privacy & your data" section of your dashboard:
- Download my data — a complete machine-readable (JSON) export of your account, generations, transactions, saved assets and support history.
- Delete my account — permanent erasure of your account, every generated video, and every photo or voice recording you uploaded, plus cancellation of any active subscription. This is immediate and cannot be undone.
For anything else (correction, restriction, objection, or withdrawing consent), contact [email protected].
9. Security
We use industry-standard measures (encrypted connections, hashed passwords, access controls) to protect your data, but no system is perfectly secure — we can't guarantee absolute security.
10. Children's privacy
The Service is not directed at anyone under 18. We don't knowingly collect data from minors.
11. Changes
We'll notify you of material changes to this policy via email or an in-app notice.