Privacy Policy

Last updated: 13 October 2026

This policy explains what UGCFinder collects, why we collect it, and what you can ask us to do with it. We've tried to write it in plain language rather than the usual wall of defensive text.

The short version

• We collect your email, your work in the app, and basic usage records.
• We do not sell your data, and we do not run ad tracking on you.
• We never read or send your email on your behalf without your action.
• You can ask us to delete your account and data at any time.

What we collect

Information you give us

• Account details. Your email address and a password. We store passwords only as a bcrypt hash — we cannot read your password, and neither can anyone who obtains our database.
• Your work. The brands you research, the contacts you save, the pitch templates you write, the pitches you generate, and your media kit content.
• Anything you send us by email.
• Payment details — entered on Stripe's checkout page, not ours. We store only a reference to your Stripe customer record and what you purchased, never your card number.

Information we generate

• Brand research. Publicly available business information we retrieve on your behalf: company websites, published contact addresses, page captions and screenshots.
• Credit ledger. A record of what each credit was spent on, so both of us can audit your balance.
• Media kit views. When a brand opens your hosted media kit, we record that it was opened so you can see interest. We do not build profiles of those visitors.
• Operational logs. Standard server records — request times, error traces — kept for a limited period to keep the service working.

What we do not collect

We do not use advertising trackers or third-party analytics pixels. We do not access your social accounts. We do not read your inbox.

Why we collect it

To run the service you signed up for: finding brands, drafting pitches, tracking follow-ups, keeping your credit balance honest, and answering you when you contact support. We also use aggregate, non-identifying figures to understand which features are worth keeping.

Who we share it with

We use a small number of service providers to make the product work. They receive only what they need to perform their function, and they are not permitted to use it for their own purposes:

• Anthropic — the Claude models that classify brands and draft your pitches. The brand information and the pitch context are sent for processing.
• Hunter.io — used only when you explicitly request a named contact at a company, to look up a business email address.
• Supabase — the managed Postgres database where your account and work are stored.
• Stripe — payment processing. Stripe receives your email and payment details directly; we receive only a customer reference, the subscription status, and what you bought. We never see or store your card number.
• DigitalOcean — the servers the application runs on.

We do not sell your personal information, and we do not share it with advertisers or data brokers. We may disclose information if legally required to, or where necessary to protect the safety of people or the service.

Business contact information

UGCFinder helps you find business contact details that companies have published for exactly this purpose. We collect only what is publicly available or supplied by our contact-lookup provider, and only business addresses — not personal ones. If you are a business and you would like your details removed from our system, email support@ugcfinder.app and we will remove them.

We also keep a brand list that subscribers can browse. Every address on it is a role inbox — partnerships@, press@ and the like — that the company publishes on its own website for this purpose, found by the same scanner the rest of the app uses. We deliberately exclude named individuals' addresses from that list, and we do not publish anything a company has not put on its own site. A company that would rather not appear can write to us and we will take it off.

Cookies

We use two first-party cookies. One keeps you signed in. The other remembers where you first came from — for example an Instagram post — for 30 days, so we can see which channels bring people to UGCFinder. Neither is used for advertising or cross-site tracking, and there is no third-party cookie on the site.

How long we keep it

We keep your account and your work for as long as your account is open. When you ask us to delete your account, we remove your personal data and your saved work. Some records may persist briefly in encrypted backups before being overwritten on their normal cycle, and we keep the minimum billing records we are legally required to retain.

Security

Traffic to the site is encrypted with TLS. Passwords are hashed with bcrypt and never stored in readable form. Credentials for third-party services are held in server-side environment configuration, not in the application or in your browser. No system is perfectly secure, and we won't claim otherwise — but if we ever discover a breach affecting your data, we will tell you.

Your rights

Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or send you a copy. If you are in the UK, the EU, or a US state with a comparable privacy law, those rights are yours by statute and we apply them to everyone regardless. Write to support@ugcfinder.app and we will respond within 30 days.

Children

UGCFinder is not intended for anyone under 16, and we do not knowingly collect information from them.

International transfers

Our servers and service providers are located in the United States. If you use UGCFinder from elsewhere, your information is transferred and processed there.

Changes to this policy

If we change how we handle your data in a way that matters, we will update the date at the top of this page and tell account holders by email. We won't make a material change quietly.

Contact

Privacy questions, data requests, or complaints: support@ugcfinder.app.