Applies to: the ugcvid app for iPhone and iPad, distributed through the Apple App Store, and the ugcvid service at ugcvid.io that the app connects to.
Effective date: 29 August 2026
Last updated: 29 August 2026
Contact: support@ugcvid.io
Who we are and what this policy covers
ugcvid is an AI UGC video generator. You give it a product — a photo, or a link to a store page, website or app listing — and it analyses the product, writes an ad script, casts an AI creator, and renders short vertical or landscape ad videos you can post to TikTok, Reels, YouTube Shorts and Facebook.
This policy explains what personal data the ugcvid iOS app and its backend collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the iOS app and to the ugcvid backend API that serves it. It does not apply to third-party sites or apps you reach from ugcvid, or to the platforms you choose to publish your finished videos on.
For the purposes of the EU/UK GDPR, ugcvid is the data controller for the personal data described here. To reach the person responsible for privacy at ugcvid, write to support@ugcvid.io.
We do not track you. ugcvid does not use the Advertising Identifier (IDFA), does not link your data to third-party data for advertising, and contains no ad networks, attribution SDKs or analytics SDKs. Because we do not track, the app does not present an App Tracking Transparency prompt.
Data we collect
2.1 Account data — collected when you sign in
ugcvid has no password of its own. You sign in with a third-party identity provider — Sign in with Google, and Sign in with Apple where the app offers it. Authentication is handled by Firebase Authentication, part of Google Cloud.
From that sign-in we receive and store:
Email address — Identifies your account, receipts and support requests
Display name — Shown in the app so you know which account you are in
Profile photo URL — Shown as your avatar; the image itself stays with your identity provider
Firebase user ID (UID) — The internal key that every product, video and credit balance of yours is filed under
We never receive or store your Google or Apple password.
If you use Sign in with Apple and choose "Hide My Email," we only ever see Apple's private relay address. That relay address is what we store, what we email, and what we use to identify your account. We do not attempt to resolve it to your real address.
2.2 Content you give us — the product you want an ad for
This is the heart of the service, and it is the data you most consciously provide:
• Product images you upload. JPEG, PNG, WebP or GIF, up to 30 MB per file. They are uploaded straight from your device to our storage bucket using a short-lived (5 minute) signed upload link, and stored under a path private to your account.
• A product link you paste. If you give us a URL instead of an image, our servers visit that public page on your behalf, read its text, and take screenshots of it (a desktop view and a phone view) to use as visual reference. We only fetch pages you explicitly ask us to fetch.
• The product name and description you type, and any other brief or instruction you write.
• Generation settings you choose: aspect ratio, duration, resolution, number of takes, and whether audio is generated.
2.3 Data the service creates about your use
• Generated scripts and prompts. The full prompt sent to the video model, including the AI-written script.
• Generated videos. The finished MP4, stored in our storage bucket under a path keyed to your account and reachable by a link.
• Generation records. Status (queued / processing / completed / failed), cost in credits, timestamps, the provider's task identifier, and diagnostics about how a link capture went (which method worked, which host, how long it took) so we can fix pages that fail to capture.
• A short history of script "fingerprints" per product — the angle, hook, setting and opening line of your recent scripts — kept so the next video for the same product does not repeat the last one.
• Credits and subscription state: your credit balance, credits held in escrow for a running job, and your plan.
2.4 Technical and diagnostic data
• Server logs. Our API records request metadata — IP address, timestamps, the endpoint called, the app's user-agent, response codes and error details — for security, abuse prevention, rate limiting and debugging.
• Session and local storage. The app stores a session token so you stay signed in, plus a small local cache of your recent products and runs on the device. Signing out or deleting the app clears it.
• Apple-provided crash reports. If you have opted in to sharing analytics with app developers in iOS Settings, Apple may send us aggregated crash and performance reports. Those come from Apple, not from an SDK inside our app, and Apple does not identify you to us in them.
2.5 What we do not collect
• We do not collect or request the IDFA / Advertising Identifier, and there is no App Tracking Transparency prompt because we do not track.
• We do not collect location of any precision.
• We do not collect your contacts, calendar, reminders, health data, HomeKit data or messages.
• We do not read your Photos library in the background. Images reach us only through the system photo picker or a camera capture you start yourself for a specific upload.
• We do not run third-party analytics, session-replay, ad-attribution or fingerprinting SDKs.
• We do not collect payment card numbers (see Section 6).
Faces, people and biometrics — please read this section
Product photos, especially fashion ones, often show a model wearing the item. Because of that we want to be explicit:
• We do not perform biometric identification. We never build, store or compare a face template, faceprint or any other biometric identifier. We cannot and do not use a face to work out who someone is.
• Face detection is transient and purely cosmetic. The AI video model we use refuses reference images containing a real human face. So before an image is sent for rendering, an automated step may detect a face in it and crop the image above the chin, so the garment survives and the face does not. That detection exists only for the moment of the crop; nothing about the face is retained, indexed or reused.
• The cropped image, not the original, is what leaves our systems for rendering when this step applies.
• If a reference image still contains a recognisable real person, the video provider rejects it and the generation falls back to a text-only render.
• Do not upload images of people who have not agreed to it. You are responsible for having the rights to every image and link you submit, including any depicted person's permission.
We do not use your images or videos to advertise to you, to profile you, or for automated decisions producing legal or similarly significant effects. Face ID and Touch ID, if used to unlock your device, never share biometric data with us — that stays on your device with Apple.
Why we use your data, and the legal basis for it
Create and run your account
Data used: Account data
Legal basis (GDPR): Performance of a contract
Generate the videos you ask for
Data used: Product images, links, briefs, settings
Legal basis (GDPR): Performance of a contract
Show you your library of products and past videos
Data used: Generation records, storage links
Legal basis (GDPR): Performance of a contract
Meter credits, run plans, prevent double-spending
Data used: Credits and generation cost records
Legal basis (GDPR): Performance of a contract
Keep the service secure, prevent abuse and fraud
Data used: Logs, IP, UID, request metadata
Legal basis (GDPR): Legitimate interests
Debug failures and improve reliability
Data used: Diagnostics, logs
Legal basis (GDPR): Legitimate interests
Answer your support emails
Data used: Whatever you send us, plus account data
Legal basis (GDPR): Legitimate interests / contract
Comply with law, tax and platform rules
Data used: Transaction and account records
Legal basis (GDPR): Legal obligation
We do not use your product images, briefs or generated videos to train our own AI models. Your content is processed to produce your output. See Section 5 for the providers involved.
Who we share data with
We share only what a provider needs to do its job. We do not sell personal data, and we do not share it with data brokers or advertisers.
Google (Firebase Authentication, Cloud Firestore)
What reaches them: Account identity, your products, generation records, credit balance
Purpose: Sign-in and our primary database
Apple (Sign in with Apple, App Store)
What reaches them: Your sign-in identity and purchase state
Purpose: Authentication and payments
Cloudflare (R2 object storage)
What reaches them: Uploaded product images, page screenshots, generated videos
Purpose: File storage and delivery
apiyi (AI gateway) and the Seedance video model behind it
What reaches them: The generation prompt and the reference image URLs
Purpose: Rendering your video
OpenRouter, with Together AI as a fallback
What reaches them: Your product brief, product page text and the product image
Purpose: Writing the ad script and analysing the product
Our own face-crop service
What reaches them: A reference image URL and your user ID
Purpose: The cosmetic face crop described in Section 3
Discord (internal operations webhook)
What reaches them: Your user ID, generation ID, product title, the prompt, input image links and the output video link, when a job completes or fails
Purpose: Our own alerting, so we notice broken generations quickly
We may also disclose data where we are legally required to (a valid court order, lawful request or regulatory obligation), where it is necessary to protect our rights, safety or the security of the service, or in connection with a merger, acquisition or sale of assets — in which case we will tell you before your data becomes subject to a different privacy policy.
International transfers. Our providers operate globally, so your data may be processed outside your country, including outside the EEA and UK, and in the United States and Asia. Where required, those transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
Purchases
Credits and subscriptions bought inside the iOS app are processed by Apple's In-App Purchase system. Payment is handled entirely by Apple through your Apple Account. We never see or store your card number, bank details or full billing address. We receive a transaction receipt and the resulting entitlement, and we record your credit balance and plan against your account. Subscriptions renew and are cancelled through your Apple Account settings, and refunds follow Apple's policies.
How long we keep data
Account (email, name, UID)
Retention: Until you delete your account
Uploaded product images and page screenshots
Retention: Until you delete the product, or delete your account
Generated videos and their records
Retention: Until you delete the video, or delete your account
Credit balance and transaction records
Retention: Until account deletion; anonymised transaction totals may be kept where tax or accounting law requires
Server logs
Retention: A short operational period, typically up to 90 days, then rotated out
Support emails
Retention: Up to 24 months after the conversation ends
Internal ops notifications (Discord)
Retention: Per that channel's retention; purged on request
There is no automatic expiry on your library — your products and videos stay available to you until you remove them. If you want them gone sooner, delete them (Section 8).
Your choices and rights
8.1 Deleting things yourself, in the app
Apple requires that an app offering account creation also offer account deletion inside the app. ugcvid does:
• Delete one video. Removes the generation record and permanently deletes the video file from storage.
• Delete one product. Removes the product, its thumbnail, its stored page screenshots and its script history.
• Delete your whole account. From the account menu in the app. This is irreversible, and when it completes it deletes:
• Every generated video of yours in storage.
• Every image and screenshot you uploaded or we captured for you.
• Your entire generation and product history in our database.
• Your credit balance and subscription record.
• Your sign-in identity itself.
Any unused credits are forfeited on deletion. Deleting the app from your device does not delete your account, and it does not cancel an active subscription — cancel that separately in Settings → your name → Subscriptions.
8.2 Deleting by email
If you cannot reach the in-app control, email support@ugcvid.io from the address on your account (including an Apple private relay address) and ask us to delete it. We will verify it is you and complete the deletion, normally within 30 days.
8.3 Your legal rights
Depending on where you live, you may have the right to:
• Access the personal data we hold about you and get a copy of it.
• Correct data that is inaccurate.
• Delete your data (the right to erasure).
• Restrict or object to processing based on legitimate interests.
• Portability — receive your data in a machine-readable form.
• Withdraw consent where we relied on it, without affecting processing already carried out.
• Not be discriminated against for exercising any of these rights.
If you are in the EEA or the UK, you also have the right to complain to your local data protection authority. If you are in California, the CCPA/CPRA rights above apply, and we confirm again: we do not sell personal information, and we do not share it for cross-context behavioural advertising.
To exercise any right, email support@ugcvid.io. We respond within 30 days and we do not charge for a reasonable request.
iOS permissions we may request
Photo library
Why: Only so you can pick a product photo to upload. Where the limited-access picker is used, we see only the image you hand over.
Optional: Yes — decline and use a link or the camera.
Camera
Why: Only if you choose to photograph a product.
Optional: Yes.
Save to photo library
Why: Only when you tap Save on a finished video.
Optional: Yes.
Notifications
Why: "Your video is ready" alerts.
Optional: Yes — manage in Settings → Notifications → ugcvid.
We do not request location, microphone, contacts, calendar, reminders, health, Bluetooth, or local network access. If a future version of the app needs a new permission, we will explain it in the app before requesting it and update this policy.
Apple App Privacy ("nutrition label") summary
This is what we declare on our App Store product page.
Data used to track you: None. We do not track, we do not use the IDFA, and we do not link your data with third-party data for advertising.
Data linked to you — collected and associated with your account:
• Contact info: email address, name — app functionality, account management.
• User content: photos you upload, the product briefs you write, the videos generated for you — app functionality.
• Identifiers: your ugcvid user ID — app functionality.
• Purchases: purchase history for credits and plans — app functionality.
• Usage data: your in-app generation history — app functionality.
• Diagnostics: crash data and performance/error logs — app functionality and diagnostics.
Data not linked to you: none beyond aggregate diagnostics Apple may forward if you opted in to sharing them.
Data we do not collect at all: location, contacts, health and fitness, financial info, sensitive info, browsing history outside the app, search history, and advertising identifiers.
Security
• All traffic between the app and our servers uses HTTPS/TLS, with App Transport Security enforced.
• Every API request is authenticated with a short-lived token, and the account it acts on always comes from that verified token — never from anything the client claims.
• Uploads use short-lived (5-minute) signed URLs scoped to a single file inside your own storage path.
• Session tokens are held in the iOS Keychain on-device.
• Stored data sits behind provider access controls, with credentials held only by our servers.
No method of transmission or storage over the internet is 100% secure. We work hard to protect your data, but we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator as the law requires.
Children
ugcvid is a marketing tool for businesses and creators and is not directed to children under 13 — or under 16 in jurisdictions where that is the applicable age of digital consent. The app is not part of the Kids Category. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email support@ugcvid.io and we will delete it promptly.
Your responsibilities for the content you submit
Because you can upload any image and paste any link, please note:
• Only submit product images, brand assets and links you own or are licensed to use.
• Do not upload photos of identifiable people without their permission.
• Do not upload anything unlawful, or anything you are contractually barred from sharing with a processor.
• Videos generated by ugcvid depict AI-generated people who do not exist. Follow the advertising disclosure rules of the platform you post to and of your country.
Changes to this policy
We may update this policy as the app changes. When we do, we will update the "Last updated" date at the top, publish the new version at its usual link, and — for changes that materially affect your rights — notify you in the app or by email before they take effect. Continuing to use ugcvid after a change means you accept the updated policy.
Contact us
Questions, requests, complaints or deletion demands:
support@ugcvid.io
We aim to reply within a few business days, and within 30 days for any formal data rights request.