Applies to: the ugcvid app for Android, distributed through Google Play, and the ugcvid service at ugcvid.io that the app connects to.
Effective date: 29 August 2026
Last updated: 29 August 2026
Contact: support@ugcvid.io
Who we are and what this policy covers
ugcvid is an AI UGC video generator. You give it a product — a photo, or a link to a store page, website or app listing — and it analyses the product, writes an ad script, casts an AI creator, and renders short vertical or landscape ad videos you can post to TikTok, Reels, YouTube Shorts and Facebook.
This policy explains what personal data the ugcvid Android app and its backend collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the Android app and to the ugcvid backend API that serves it. It does not apply to third-party sites or apps you reach from ugcvid, or to the platforms you choose to publish your finished videos on.
For the purposes of the EU/UK GDPR, ugcvid is the data controller for the personal data described here. If you need to reach the person responsible for privacy at ugcvid, write to support@ugcvid.io.
We do not sell your personal data, we do not show you ads, and we do not use advertising identifiers or third-party tracking SDKs in the app.
Data we collect
2.1 Account data — collected when you sign in
ugcvid has no password of its own. You sign in with Google Sign-In (and, where the app offers it, another supported identity provider). Authentication is handled by Firebase Authentication, part of Google Cloud.
From that sign-in we receive and store:
Email address — Identifies your account, receipts and support requests
Display name — Shown in the app so you know which account you are in
Profile photo URL — Shown as your avatar; the image itself stays with your identity provider
Firebase user ID (UID) — The internal key that every product, video and credit balance of yours is filed under
We never receive or store your Google password.
2.2 Content you give us — the product you want an ad for
This is the heart of the service, and it is the data you most consciously provide:
• Product images you upload. JPEG, PNG, WebP or GIF, up to 30 MB per file. They are uploaded straight from your device to our storage bucket using a short-lived (5 minute) signed upload link, and stored under a path private to your account.
• A product link you paste. If you give us a URL instead of an image, our servers visit that public page on your behalf, read its text, and take screenshots of it (a desktop view and a phone view) to use as visual reference. We only fetch pages you explicitly ask us to fetch.
• The product name and description you type, and any other brief or instruction you write.
• Generation settings you choose: aspect ratio, duration, resolution, number of takes, and whether audio is generated.
2.3 Data the service creates about your use
• Generated scripts and prompts. The full prompt sent to the video model, including the AI-written script.
• Generated videos. The finished MP4, stored in our storage bucket under a path keyed to your account and reachable by a link.
• Generation records. Status (queued / processing / completed / failed), cost in credits, timestamps, the provider's task identifier, and diagnostics about how a link capture went (which method worked, which host, how long it took) so we can fix pages that fail to capture.
• A short history of script "fingerprints" per product — the angle, hook, setting and opening line of your recent scripts — kept so the next video for the same product does not repeat the last one.
• Credits and subscription state: your credit balance, credits held in escrow for a running job, and your plan.
2.4 Technical and diagnostic data
• Server logs. Our API records request metadata — IP address, timestamps, the endpoint called, the app's user-agent, response codes and error details — for security, abuse prevention, rate limiting and debugging.
• Session and local storage. The app stores a session token so you stay signed in, plus a small local cache of your recent products and runs on the device. Signing out or clearing app storage clears it.
2.5 What we do not collect
• We do not collect your Android Advertising ID, and the app contains no advertising or attribution SDK.
• We do not collect precise or coarse location.
• We do not collect your contacts, calendar, SMS, call logs, or installed-app list.
• We do not read your device's photo library in the background. Images come only from a picker or camera capture you start yourself for a specific upload.
• We do not run third-party analytics, session-replay, ad-attribution or fingerprinting SDKs.
• We do not collect payment card numbers (see Section 6).
Faces, people and biometrics — please read this section
Product photos, especially fashion ones, often show a model wearing the item. Because of that we want to be explicit:
• We do not perform biometric identification. We never build, store or compare a face template, faceprint or any other biometric identifier. We cannot and do not use a face to work out who someone is.
• Face detection is transient and purely cosmetic. The AI video model we use refuses reference images containing a real human face. So before an image is sent for rendering, an automated step may detect a face in it and crop the image above the chin, so the garment survives and the face does not. That detection exists only for the moment of the crop; nothing about the face is retained, indexed or reused.
• The cropped image, not the original, is what leaves our systems for rendering when this step applies.
• If a reference image still contains a recognisable real person, the video provider rejects it and the generation falls back to a text-only render.
• Do not upload images of people who have not agreed to it. You are responsible for having the rights to every image and link you submit, including any depicted person's permission.
We do not use your images or videos to advertise to you, to profile you, or for automated decisions producing legal or similarly significant effects.
Why we use your data, and the legal basis for it
Create and run your account
Data used: Account data
Legal basis (GDPR): Performance of a contract
Generate the videos you ask for
Data used: Product images, links, briefs, settings
Legal basis (GDPR): Performance of a contract
Show you your library of products and past videos
Data used: Generation records, storage links
Legal basis (GDPR): Performance of a contract
Meter credits, run plans, prevent double-spending
Data used: Credits and generation cost records
Legal basis (GDPR): Performance of a contract
Keep the service secure, prevent abuse and fraud
Data used: Logs, IP, UID, request metadata
Legal basis (GDPR): Legitimate interests
Debug failures and improve reliability
Data used: Diagnostics, logs
Legal basis (GDPR): Legitimate interests
Answer your support emails
Data used: Whatever you send us, plus account data
Legal basis (GDPR): Legitimate interests / contract
Comply with law, tax and platform rules
Data used: Transaction and account records
Legal basis (GDPR): Legal obligation
We do not use your product images, briefs or generated videos to train our own AI models. Your content is processed to produce your output. See Section 5 for the providers involved.
Who we share data with
We share only what a provider needs to do its job. We do not sell personal data, and we do not share it with data brokers or advertisers.
Google (Firebase Authentication, Cloud Firestore)
What reaches them: Account identity, your products, generation records, credit balance
Purpose: Sign-in and our primary database
Cloudflare (R2 object storage)
What reaches them: Uploaded product images, page screenshots, generated videos
Purpose: File storage and delivery
apiyi (AI gateway) and the Seedance video model behind it
What reaches them: The generation prompt and the reference image URLs
Purpose: Rendering your video
OpenRouter, with Together AI as a fallback
What reaches them: Your product brief, product page text and the product image
Purpose: Writing the ad script and analysing the product
Our own face-crop service
What reaches them: A reference image URL and your user ID
Purpose: The cosmetic face crop described in Section 3
Discord (internal operations webhook)
What reaches them: Your user ID, generation ID, product title, the prompt, input image links and the output video link, when a job completes or fails
Purpose: Our own alerting, so we notice broken generations quickly
Google Play billing
What reaches them: Purchase and subscription state
Purpose: Selling credits and plans (see Section 6)
We may also disclose data where we are legally required to (a valid court order, lawful request or regulatory obligation), where it is necessary to protect our rights, safety or the security of the service, or in connection with a merger, acquisition or sale of assets — in which case we will tell you before your data becomes subject to a different privacy policy.
International transfers. Our providers operate globally, so your data may be processed outside your country, including outside the EEA and UK, and in the United States and Asia. Where required, those transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
Purchases
Credits and subscriptions bought inside the Android app are processed by Google Play Billing. Payment is handled entirely by Google. We never see or store your card number, bank details or full billing address. We receive a transaction identifier and the resulting entitlement, and we record your credit balance and plan against your account. Refunds for Play purchases follow Google Play's policies.
How long we keep data
Account (email, name, UID)
Retention: Until you delete your account
Uploaded product images and page screenshots
Retention: Until you delete the product, or delete your account
Generated videos and their records
Retention: Until you delete the video, or delete your account
Credit balance and transaction records
Retention: Until account deletion; anonymised transaction totals may be kept where tax or accounting law requires
Server logs
Retention: A short operational period, typically up to 90 days, then rotated out
Support emails
Retention: Up to 24 months after the conversation ends
Internal ops notifications (Discord)
Retention: Per that channel's retention; purged on request
There is no automatic expiry on your library — your products and videos stay available to you until you remove them. If you want them gone sooner, delete them (Section 8).
Your choices and rights
8.1 Deleting things yourself, in the app
• Delete one video. Removes the generation record and permanently deletes the video file from storage.
• Delete one product. Removes the product, its thumbnail, its stored page screenshots and its script history.
• Delete your whole account. From the account menu in the app. This is irreversible, and when it completes it deletes:
• Every generated video of yours in storage.
• Every image and screenshot you uploaded or we captured for you.
• Your entire generation and product history in our database.
• Your credit balance and subscription record.
• Your sign-in identity itself.
Any unused credits are forfeited on deletion. Removing the app from your phone does not delete your account — use the in-app deletion, or email us.
8.2 Deleting by email
If you cannot reach the in-app control, email support@ugcvid.io from the address on your account and ask us to delete it. We will verify it is you and complete the deletion, normally within 30 days.
8.3 Your legal rights
Depending on where you live, you may have the right to:
• Access the personal data we hold about you and get a copy of it.
• Correct data that is inaccurate.
• Delete your data (the right to erasure).
• Restrict or object to processing based on legitimate interests.
• Portability — receive your data in a machine-readable form.
• Withdraw consent where we relied on it, without affecting processing already carried out.
• Not be discriminated against for exercising any of these rights.
If you are in the EEA or the UK, you also have the right to complain to your local data protection authority. If you are in California, the CCPA/CPRA rights above apply, and we confirm again: we do not sell personal information, and we do not share it for cross-context behavioural advertising.
To exercise any right, email support@ugcvid.io. We respond within 30 days and we do not charge for a reasonable request.
8.4 Notifications
If the app asks for notification permission, it is only to tell you when your video is ready or has failed. You can decline, and you can turn it off at any time in Android Settings → Apps → ugcvid → Notifications.
Android permissions we may request
INTERNET / ACCESS_NETWORK_STATE
Why: Talk to our API; nothing works offline
Optional: Required
Photo picker / READ_MEDIA_IMAGES
Why: Only so you can choose a product photo to upload
Optional: Yes — decline and use a link or the camera instead
CAMERA
Why: Only if you choose to photograph a product
Optional: Yes
POST_NOTIFICATIONS
Why: "Your video is ready" alerts
Optional: Yes
We request no location, microphone, contacts, SMS, call log or all-files access. If a future version of the app needs a new permission, we will explain it in the app before requesting it and update this policy.
Google Play Data Safety summary
For the Data Safety section of our Play listing, this is our declaration.
Data collected and linked to your identity
• Personal info: name, email address — collected; not shared with third parties for their own purposes; used for app functionality and account management. Not used for advertising.
• Photos and videos: photos you upload and videos generated for you — collected; processed by our AI providers on our behalf; used for app functionality.
• App activity: your in-app generation history — collected; used for app functionality.
• Purchase history: plan and credit purchases — collected; used for app functionality.
• App info and performance: crash and error logs, request diagnostics — collected; used for app functionality and diagnostics.
Data we do not collect
• Location
• Contacts
• Calendar
• SMS
• Call logs
• Health and fitness
• Financial account or card numbers
• Advertising identifiers
• Browsing history outside the app
Security practices
• Data is encrypted in transit (HTTPS/TLS everywhere).
• You can request that data be deleted — both in the app and by emailing support@ugcvid.io.
• The app is not directed to children and we follow the Play Families policy where it applies.
Security
• All traffic between the app and our servers uses HTTPS/TLS.
• Every API request is authenticated with a short-lived token, and the account it acts on always comes from that verified token — never from anything the client claims.
• Uploads use short-lived (5-minute) signed URLs scoped to a single file inside your own storage path.
• Stored data sits behind provider access controls, with credentials held only by our servers.
• Web sessions use an httpOnly, secure cookie that page JavaScript cannot read.
No method of transmission or storage over the internet is 100% secure. We work hard to protect your data, but we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator as the law requires.
Children
ugcvid is a marketing tool for businesses and creators and is not directed to children under 13 — or under 16 in jurisdictions where that is the applicable age of digital consent. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email support@ugcvid.io and we will delete it promptly.
Your responsibilities for the content you submit
Because you can upload any image and paste any link, please note:
• Only submit product images, brand assets and links you own or are licensed to use.
• Do not upload photos of identifiable people without their permission.
• Do not upload anything unlawful, or anything you are contractually barred from sharing with a processor.
• Videos generated by ugcvid depict AI-generated people who do not exist. Follow the advertising disclosure rules of the platform you post to and of your country.
Changes to this policy
We may update this policy as the app changes. When we do, we will update the "Last updated" date at the top, publish the new version at its usual link, and — for changes that materially affect your rights — notify you in the app or by email before they take effect. Continuing to use ugcvid after a change means you accept the updated policy.
Contact us
Questions, requests, complaints or deletion demands:
support@ugcvid.io
We aim to reply within a few business days, and within 30 days for any formal data rights request.