Privacy

ugcjobs.io is operated by YR Labs LLC, 7901 4th St N, STE 300, St. Petersburg, FL 33702, United States. We are the controller of the personal data described here. Questions, requests and complaints go to hello@ugcjobs.io.

This is the whole list. It is the set of fields the database actually has, not a category list that leaves room for more.

We do not hold your password. Signing in goes through Google, so what reaches us is a confirmation plus your name, email address and avatar.

Typing your Instagram handle into the field on the home page does not send it to us. It is kept in your own browser’s session storage and travels no further until you sign in — at which point we use it to look up your public Instagram profile and work out which niches you shoot in. Close the tab before signing in and it is gone.

The lookup reads what Instagram already shows the public: display name, bio, follower count, whether the account is a business one, and recent post thumbnails. We do not connect to your Instagram account, ask for its password, or post anything.

The product is a list of brands, and building it means holding information about people who never signed up here: a marketing manager named on a company contact page, the bio and follower count on a brand’s Instagram account, the fact that a company is running video ads. All of it is collected from sources that are already public — company websites, public social profiles, and public ad libraries.

Our basis for this is legitimate interest: connecting creators with companies that buy creator video is the point of the service, and the data is business-contact data rather than private life. We do not collect special categories of data, and we do not buy consumer data.

If you are one of those people and you would rather not be listed, write to hello@ugcjobs.io from an address at that company, or from the account in question, and we will remove the record and keep the domain out of future crawls. No reason required.

We run three analytics tools, and the line between them is whether you have signed in.

Before you sign in, PostHog records the pages you open, what you click, and any error the page throws, and Simple Analytics counts the visit. Neither writes a cookie or anything else to your device: PostHog keeps its identifier in memory and forgets it the moment the page unloads, and Simple Analytics never has one. The identifier is random and is not linked to a name or email. PostHog session recording is off. Microsoft Clarity records how the page is used — scrolls, clicks, where people stop — in its no-cookie mode, so it too writes nothing to your device, with the same masking as below.

Once you sign in, the same PostHog events are tied to your account — your user id, name, email and plan — and PostHog starts a session replay: a reconstruction of what the page looked like while you used it. Every input field is masked before it leaves your browser, and so are the contact names and email addresses the product shows and the mail you read in the inbox, so a replay cannot become a contact list. Microsoft Clarity does the same with its own recording and heatmaps; it gets your account id, hashed in your browser, and never your name or email. We use both to see where the product confuses people and to reproduce bugs.

Events go to ph.ugcjobs.io, a relay we run on Cloudflare, and from there to PostHog in the United States; Clarity sends its recordings to Microsoft in the United States. If your browser sends the Do Not Track or Global Privacy Control signal, neither captures anything or stores anything, signed in or not. There is no advertising pixel and nothing is shared with ad networks.

Signed out, there are none — not from us, and not from an analytics script. The banner at the bottom of the page decides only whether the anonymous analytics described above runs at all: Accept leaves it as it is, Decline switches it off. Your answer is kept in your browser’s localStorage so we do not ask again; Decline also leaves PostHog’s own opt-out flag there, which is what keeps it off after a reload, and Clarity is not loaded at all.

Signed in, three: the session cookie that keeps you signed in, a PostHog cookie (with a matching localStorage entry) that keeps your analytics identifier from resetting on every reload, and Clarity’s two cookies (_clck and _clsk) that keep one recording together across pages. All are set on our own domain, and all are cleared when you sign out.

The services we run on. Each one sees only what its job needs, and each is bound by a data processing agreement.

Several of these are in the United States, so your data is transferred there. Those transfers rely on the European Commission’s standard contractual clauses, or on the EU–US Data Privacy Framework where the provider is certified under it.

We do not sell personal data, and we do not share it with advertisers. The only circumstances in which we hand data to anyone else are a binding legal order, or a sale of the business — in which case you would be told before your data moved.

If you connect an AI tool to your account — Claude, ChatGPT, Cursor or another — the brand data you ask it for is sent to that tool’s provider and handled under their terms, not ours. We are not a party to that; connect a tool you trust. On our side we log which tools you connected and what you requested — the tool, the filter or the brand, and how much came back — but not the content of your conversation and not the contacts themselves. The log is kept for 90 days.

• Sessions expire on their own and are deleted when they do.
• Account data lives as long as the account. Ask us to delete it and it is gone within 30 days.
• Invoices and the records behind them are kept for as long as tax law where we are established requires, because we are not allowed to delete those on request.
• The log of what a connected AI tool requested is deleted after 90 days.
• Brand and public-profile records are refreshed continuously; a record we can no longer verify is dropped rather than kept as history.

If you are in the UK, the EU or the EEA, you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, take it elsewhere in a portable form, or object to processing we do on the basis of legitimate interest. We answer within 30 days, and we do not charge for it.

You can also complain to your data protection authority. We would rather you wrote to us first, but that right does not depend on it.

Traffic is encrypted end to end. We store no passwords and no card numbers — sign-in goes through Google and payment through Stripe, so neither secret is ours to lose. Access to the production database is limited to the people who operate the service.

If a breach happens that puts you at risk, we will tell you and the relevant authority within 72 hours of finding out. Saying nothing is not an option we are keeping.

The service is for people doing paid creator work and is not intended for anyone under 16. We do not knowingly hold data about children; if you believe we do, write to us and it will be removed.

When this policy changes, the date at the top changes with it. If a change affects what we do with data we already hold, we email account holders before it takes effect rather than quietly editing the page.