UGC SUITE

Privacy Policy

This policy is issued by Chief Labs LLC, which operates UGC Suite.

Effective date: 2026-10-09.

UGC Suite (“UGC Suite,” “we,” “us,” or “our”) provides software for user-generated content creators to manage briefs, scripts, shoots, media, clients, and revenue. This Privacy Policy explains what information we collect when you use our website and application, how we use it, and the rights you have over it.

1. Information we collect

We collect the following categories of personal information:

  • Account information. Name, email address, password hash, profile photo, phone number, social handles, and other details you provide when signing up or completing onboarding.
  • Content you create. Briefs, scripts, notes, uploaded media, client and deal records, invoices, calendar events, and any other data you store in the application.
  • Billing information. Subscription tier, billing status, and Stripe customer identifiers. Card numbers are handled directly by Stripe. We do not see or store full payment card details.
  • Usage information. Pages visited, features used, device and browser type, IP address, approximate location derived from IP, and crash or error reports. Product analytics are consent-gated: they are off by default and we capture nothing — anywhere, including the public landing page — until you accept in our cookie banner. You can withdraw consent at any time in Cookie settings.
  • Connected financial accounts. If you link a bank account through Plaid, we receive the institution name, the accounts you select, and the transactions Plaid returns for them, which we turn into proposed income and expense rows for you to review. We never receive your bank login. You can disconnect an account at any time under Finances.
  • Shipping and tracking. Tracking numbers and carriers you enter for products a brand sends you, and the carrier status history we retrieve for them.
  • Notification tokens. Browser push subscriptions and device tokens, if you turn notifications on.
  • Support correspondence. Emails, in-app feedback submissions, and screenshots you send us.

2. How we use information

  • To provide, maintain, and improve the service.
  • To authenticate you and secure your account.
  • To process payments and manage subscriptions.
  • To generate AI-assisted content (scripts, summaries, brief organization) at your request.
  • To send transactional email about your account, billing, security, and product updates you have opted into.
  • To diagnose bugs, monitor performance, and prevent abuse.
  • To comply with legal obligations.

AI training. We do not use your account content to train foundation AI models. Prompts and outputs are sent to AI sub-processors (listed below) only to fulfill your request. Pending counsel verification, this commitment may be expanded in a future revision of this policy.

What the AI features send, and where

AI features run only when you ask for them. When you do, the content below leaves our systems and reaches the provider named beside it. Nothing on this list is sent on a schedule or in the background.

  • Scripts, briefs and rate analysis. Your prompt, the brief or deal details you attach, and your own past rates and deal history are sent to OpenRouter, which routes them to Anthropic (Claude).
  • Contract Summary. The full contract text you upload or paste is sent to OpenRouter and Anthropic. Section 5 describes this tool in more detail.
  • Chief, the assistant. The messages, images and documents you send it, the deal, invoice, client and finance records it looks up to answer you, and the short durable facts about your work it has kept from past conversations are sent to OpenRouter and Anthropic. Those durable facts are also embedded by OpenAI so the assistant can match them to what you are asking about.
  • Notes. Note text is sent to OpenAI, which cleans it up, categorizes it, and produces the embedding that makes your notes searchable.
  • Voice notes. The audio file is sent to OpenAI (Whisper) and returned as a transcript.
  • Uploaded images and documents. Invoices, receipts, briefs and contact screenshots you upload are sent to Google (Gemini) through OpenRouter, or to OpenAI for images we read directly, so the fields inside them can be pulled out into a row you confirm.

AI usage metadata. We record each AI request in PostHog so we can see what the features cost and where they fail. That record carries your user id, which feature ran, the model, the timing, the token counts and the cost. It does not carry the prompt or the model’s response.

3. Sub-processors

We share information with the following service providers:

  • Supabase: Database, authentication, file storage, and the serverless functions behind note processing, audio transcription and document extraction
  • Vercel: Application hosting and edge runtime
  • Stripe: Subscription payments and billing, and Stripe Connect onboarding and payouts if you connect an account to get paid through the app
  • Plaid: Bank connection and transaction import for the Finances tools, only for accounts you choose to link
  • Resend: Transactional and lifecycle email delivery
  • OpenRouter: Routes AI requests to the model providers below. Receives the prompt and the model's response for each request it routes
  • Anthropic: AI model provider (Claude), via OpenRouter, for scripts, contract summaries, rate analysis and the assistant
  • Google: AI model provider (Gemini), via OpenRouter, for reading uploaded invoices, receipts, briefs and contact screenshots. Google Sheets also receives the email address of anyone who joins the launch waitlist
  • OpenAI: Audio transcription of voice notes, note processing and the embeddings behind note search, and text extraction from images you upload
  • PostHog: Product analytics (consent-gated, opt-in) and AI usage metadata (see Section 2)
  • Sentry: Error and crash reporting, with personal data scrubbed before the report is sent
  • Cloudflare: Bot protection (Turnstile) on sign-up. Receives the challenge token and the originating IP address
  • EasyPost: Carrier tracking for products a brand ships you, from the tracking number you enter
  • Brandfetch: Brand logo lookup from a company name or domain, so a brand's mark appears on its deals
  • Telegram: Relays your Help messages and affiliate applications to our support team
  • Apple: Push notification delivery to iOS devices (APNs), for the notifications you turn on

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. Data retention

We retain your account data for as long as your account is active. When you delete your account, we delete or de-identify associated personal information within a reasonable period, except where we are required to retain it for legal, tax, audit, or fraud-prevention purposes. One such record survives deletion by design: we keep a de-identified copy of your invoice rows, with names, addresses, emails and other identifying fields stripped out, so our own books stay complete. Specific retention windows are pending counsel review.

5. Contract Summary Tool: additional disclosures

The AI Contract Summary tool accepts contract text that you upload or paste. Because that content can contain pay rates, exclusivity terms, and other deal-sensitive details, we describe its handling separately here.

  • Where the text is sent. When you run a summary or ask the chatbot a question, the contract text is transmitted to our AI sub-processors (OpenRouter, which routes the request, and Anthropic, which provides the underlying Claude model) so the model can produce the summary. Apart from the usage metadata described in Section 2, which does not include the contract text, we do not send the text to any other third party for that operation.
  • Where the text is stored. The contract text and the AI’s analysis are stored in our Supabase Postgres database (encrypted at rest, under row-level security tied to your account). We retain that record until you delete it from the “Saved” tab in the Contract Summary tool or until you delete your account, at which point it is removed under Section 4.
  • Sensitive personal information (CCPA / CPRA). Contract financials and similar deal terms may qualify as sensitive personal information under California Civil Code §1798.140(ae). We process this information only to operate the tool and respond to your account’s requests. We do not sell it, do not share it for cross-context behavioral advertising, and do not use it to train foundation AI models.
  • NDA and third-party rights. You are responsible for ensuring you have the right to upload each contract, including that no confidentiality obligation prohibits sharing it with our sub-processors. See Section 5 of the Terms of Service.

6. Data from Meta Platforms

If a brand connects an ad account to UGC Suite, we receive data from Meta Platforms. This section describes how we handle it.

  • What we access. With the brand’s authorization through Facebook Login for Business, we request these permissions, and read only the accounts and Pages the brand grants:
    • ads_read: ad account IDs and campaign and ad insights (spend, impressions, clicks and conversions).
    • business_management: the Business Manager accounts the brand connects, and the ad accounts and Pages assigned to them.
    • pages_show_list: the list of Pages the brand manages.
    • pages_read_engagement: Page and post engagement metrics.
    We use this data to attribute the performance of creator content and to calculate creator payouts.
  • What we don’t do. We do not post on anyone’s behalf. We do not create or edit ads without an explicit action from you. We do not sell Meta data or share it with third parties, and we do not use it for ad targeting.
  • Retention. We keep Meta data only while the connection is active, and we delete it within 30 days of disconnection.
  • Revoking access. See our Data Deletion Instructions for the ways to disconnect and have your Meta data deleted.
  • Compliance. We follow the Meta Platform Terms and Developer Policies.

6A. Data from TikTok for Business

If a brand connects a TikTok ad account to UGC Suite, we receive data from TikTok. This section describes how we handle it.

  • What we access. With the brand’s authorization through TikTok for Business, we request these scopes, and use them only for the ad accounts the brand grants:
    • Ad Account Management: the ad account name, ID, status, currency and time zone.
    • Ads Management: campaign, ad group and ad details and settings, plus creating, launching, pausing and editing them when the brand takes that action in UGC Suite.
    • Reporting: ad-level performance reports (spend, impressions, clicks, conversions and video views).
    We use this data to launch and manage the creator ads a brand approves, to show the brand how creator ads perform, and to calculate creator payouts.
  • Actions on your ad account. We create, launch, pause or edit campaigns and ads only when the brand takes that action in UGC Suite. We never change an ad account on our own.
  • What we don’t do. We do not post organic content on anyone’s behalf. We do not sell TikTok data or share it with third parties, and we do not use it to target any other ads.
  • Retention. We keep TikTok data only while the connection is active, and we delete it within 30 days of disconnection.
  • Revoking access. See our Data Deletion Instructions for the ways to disconnect and have your TikTok data deleted.
  • Compliance. We comply with the TikTok for Business Commercial Terms and API for Business developer terms.

7. Your rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the following rights with respect to your personal information:

  • Right to know. Request the categories and specific pieces of personal information we have collected about you.
  • Right to delete. Request deletion of personal information we have collected, subject to exceptions.
  • Right to correct. Request correction of inaccurate personal information.
  • Right to portability. Receive a copy of your personal information in a portable, readily usable format.
  • Right to non-discrimination. Exercise these rights without receiving discriminatory treatment.

8. How to exercise your rights

To exercise any of the rights above, email privacy@ugcsuite.app with the subject line [Privacy Request] {Type} (e.g., [Privacy Request] Delete). We will verify the request using the email address on file for your account, and we will respond within 45 days as required by CCPA §1798.130(a)(2). If we need additional time, we will notify you in writing during that window.

You may also designate an authorized agent to make a request on your behalf. We will require written authorization signed by you and may ask the agent to verify their identity directly with us.

9. Security

We use industry-standard safeguards including TLS in transit, encryption at rest, hashed passwords, row-level security in our database, and least-privilege access controls. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you in accordance with applicable law.

10. Children

UGC Suite is not directed to children under 16 and we do not knowingly collect information from them. If you believe we have inadvertently collected information from a child, contact us at the address below and we will delete it.

11. Changes to this policy

We will post any changes to this policy on this page and update the “Effective date” above. Material changes will be communicated by email or in-app notice.

12. Contact

Chief Labs LLC, 201 17th St S, St. Petersburg, FL 33712.

Questions or requests: privacy@ugcsuite.app.

Meta data and deletion requests: team@ugcsuite.app.