Privacy Policy
This policy explains how UP UGC Planner LLC, a Pennsylvania limited liability company ("UGC Planner", "we", "us", or "our"), handles personal information when you use the UGC Planner mobile app, ugcplanner.com, ugcplanner.app, public share and invite pages, and the UGC Planner Partner Program (together, the "Service").
1. Who we are
Controller / business: UP UGC Planner LLC, 1500 Chestnut Street, Suite 2 PMB 1081, Philadelphia, PA 19102, United States. Email support@ugcplanner.app and put "Privacy" in the subject line.
2. Data map: what, why, where, and how long
This table is our practical data inventory and notice at collection. A period may be extended only where reasonably needed to investigate abuse, resolve a dispute, comply with a preservation request, or meet tax and accounting law. When the reason ends, we delete or de-identify the data.
| Category | Examples | Purpose and GDPR basis | Retention | Recipients / processors |
|---|---|---|---|---|
| Account and profile | Email, sign-in provider identifier, optional name and avatar, language, country, state, tax-rate and filing-status settings. | Create and secure your account, personalize the Service, and send transactional messages. Contract; legitimate interests in security. | While the account is open; ordinarily deleted or de-identified within 30 days after account deletion. | Our application-hosting, managed-database, authentication, and transactional-email providers. |
| Business records and backups | Deals, brands, invoices, expenses, ideas, calendar items, notes, files, and the backup mode you choose. | Provide device storage, optional encrypted cloud backup, restore, and features you request. Contract. | Local data stays on your device. Cloud copies remain until backup is disabled or the account is deleted, then are scheduled for deletion within 30 days. | Our managed-database and object-storage providers; AI providers only for content you deliberately submit to an AI feature. |
| Share links and recipient activity | Shared files, link settings, optional feedback, view or download time, and requesting IP address. | Deliver files, show delivery status, secure links, and prevent abuse. Contract; legitimate interests. | Until the owner revokes the link, an optional expiry is reached, or the owner deletes the account; cleanup then removes the link and files. | Our object-storage and application-hosting providers, and recipients selected by the user. |
| Instagram connection | Instagram ID, username, display name, profile-photo URL, counts, and recent-post metadata available through the permitted API scope. | Provide the Instagram features you choose to connect. Consent. | While connected; deleted when you disconnect Instagram or delete the account. | Meta and our hosting and database providers. |
| Subscriptions and store transactions | Platform, product, transaction and original-transaction identifiers, app account token, offer identifier or type, price and currency, purchase, renewal, expiry, refund, and chargeback status. We do not receive card details. | Unlock paid access, validate referral eligibility, calculate earnings, prevent duplicate benefits, handle reversals, and keep accounting records. Contract; legitimate interests; legal obligations. | For the subscription relationship and generally up to seven years afterward where needed for tax, accounting, fraud, or dispute records. | Apple App Store, Google Play, and our managed-database provider. |
| Referral visits and attribution | Partner link token, short-lived invite code or session, cookie or browser-session digest, visit and claim times, campaign version, status, and keyed pseudonyms of relevant account or subscription identifiers. | Reuse a live invitation for the same browser, limit automated issuance, attribute an eligible customer, apply the offer, count qualified referrals, and preserve an auditable history. Contract or requested pre-contract steps; legitimate interests. | Unsuccessful operational records only as long as needed for abuse controls and disputes. Attribution follows the commission window; financial proof follows the accounting period below. | Our application-hosting and managed-database providers, Apple App Store, and Google Play. |
| Referral device and anti-abuse evidence | Keyed IP and installation digests, rate-limit counters, attestation status, promotion-history values from Apple DeviceCheck or Google Play Integrity Device Recall, and a temporarily encrypted device credential. No advertising ID or precise location. | Limit automated code generation, prevent self-referral and repeated introductory discounts, distinguish a possible device resale, and investigate fraud. Legitimate interests. | Raw IP addresses are not stored in the referral ledger. Temporary credentials expire quickly and are deleted when resolved or expired. Keyed pseudonyms and decision evidence remain only as needed for eligibility, audit, disputes, and repeat-abuse prevention. | Apple DeviceCheck, Google Play Integrity, and our application-hosting and managed-database providers. |
| Partner enrollment, earnings, and payout | Accepted terms version and time, partner status, tier, masked invitee hints, commission and bonus ledger, payout requests and references, country, currency, and encrypted payout destination where supplied. | Operate the Partner Program, calculate and pay earnings, prevent duplicate destinations, satisfy tax and accounting duties, and resolve disputes. Contract; legitimate interests; legal obligations. | Payout destinations are deleted when the partner account is purged. Acceptances, commissions, payouts, and audit records are de-identified where possible and generally retained up to seven years, or longer for a legal hold or active dispute. | Our managed-database provider; the payout provider identified during setup; tax authorities where legally required. |
| Product analytics and diagnostics | Account ID while signed in, random installation ID, diagnostic session ID, screen and feature events, app version and platform, crash reports, and technical logs. Deal-creation events contain no deal content. | Understand onboarding and feature use, improve the product, diagnose errors and security events. Legitimate interests where permitted; see the usage-events explanation below. | Operational and security logs ordinarily up to 90 days unless needed for an active investigation. Product usage events are retained for no more than 365 days after we receive them, then deleted; account-linked identifiers and details are removed sooner on account deletion as explained below. | Our crash-diagnostics, application-hosting, and managed-database providers. |
| Notifications, email, and support | Push token, email delivery status, and messages, attachments, and contact details you send to support. | Deliver requested alerts, sign-in codes, and service messages; respond to support; detect delivery failures. Contract; notification consent; legitimate interests. | Push token until unregistered; support correspondence ordinarily two years after the last reply; delivery records only as long as operationally needed. | Our push-delivery, transactional-email, support, and hosting providers. |
Product usage events
We receive first-party events for the screen opened, subscription-catalogue loading, purchase steps and outcomes, invitation-discount status (not the code), and steps in preparing a file delivery (counts and yes/no settings, not file names or contents). From app version 1.3.3, we also receive the fact that a signed-in person using Cloud Backup & Sync created a deal through the New Deal form. That event contains no brand, amount, notes, files, deal ID, or other deal content. At launch we receive the app version, build, and update so we can diagnose problems.
Events include the device time, app version and platform, a random installation ID, a diagnostic session ID, and your account ID while you are signed in. They can therefore be linked to your account. An event sent before sign-in has no account ID, but can later be connected through the same installation ID. General usage events are sent in both device-only and cloud-storage modes; the deal-creation event is limited to signed-in cloud users. An event already queued can still be sent after you change storage mode. The app currently has no usage-analytics off switch and does not use these events for advertising or tracking across other companies' apps.
Version 1.3.3 sends a screen as a route pattern, such as /delivery/:slug, without the link slug or invitation code. Earlier app versions could send parts of the screen address containing those values; we normalize new arrivals from older versions on the server, and previously stored rows require separate cleanup. On account deletion, we remove identifiers and details from rows carrying your account ID. Events sent before sign-in carry no account ID and are not automatically removed by account deletion, but they are deleted within 365 days after we receive them. Deleting the app does not itself erase events already received. Contact us before deleting your account if you want us to locate and assess removal of those earlier events sooner. We will explain any limits on a deletion request.
3. Where personal information comes from
- You: information you enter, upload, connect, or send to support.
- Your device and browser: technical events, invite sessions, cookie state, diagnostics, and attestation credentials.
- Apple, Google, and Meta: sign-in, store transaction, device-integrity, and connected Instagram data allowed by their APIs and your choices.
- Referral partners: the Partner Link or invitation code you choose to use. Partners do not receive your name, email, subscription identifier, device evidence, or payment details from us.
4. Device-first storage and cloud backup
4.1 On this device only
Your deals, invoices, expenses, notes, and other business records are not backed up to our servers. We cannot recover them if the device or app data is lost. This choice does not disable network features you actively use or the limited account, store, referral, security, and diagnostic processing listed above.
4.2 Encrypted cloud backup
Your backup travels over an encrypted connection and receives application-level AES-256-GCM encryption before database storage, in addition to provider encryption at rest. Our systems decrypt it only to operate backup and restore for your account, maintain security, provide support you request, or comply with law. This is server-side encryption, not end-to-end encryption with a user-held recovery key.
We hold the key for this application-level encryption so signing in on a new device can restore your data without a separate recovery phrase. It helps protect a copied database, but it is not designed to prevent our Service from decrypting data when necessary for the limited purposes described in this policy.
5. Referral privacy and fraud prevention
Opening a Partner Link requests a short-lived invitation. We use a same-browser cookie, keyed digests of limited network and installation signals, a challenge when traffic appears automated, and rate limits to avoid issuing unlimited codes to scripts, link-preview bots, or repeated refreshes. Clicking a link alone does not create a paid attribution; the invitee must expressly submit the code and satisfy the displayed eligibility rules.
On supported devices, Apple DeviceCheck or Google Play Integrity Device Recall may tell us whether a referral promotion was previously used on that device. These services provide limited promotion-history values rather than an advertising identifier. We use them only for promotion security and fraud prevention—not advertising, cross-app tracking, or precise location. A service outage normally places the promotion in a pending state instead of inventing a result.
Referral eligibility and payout steps may be automatically cleared, held, or refused based on store receipts, previous subscription evidence, link or session validity, rate limits, and device-integrity evidence. These rules govern a voluntary promotion, not ordinary access to the paid Service. You may ask us to review a result, and we provide human review where applicable law requires it or a decision may materially affect earned compensation.
6. Account deletion and pseudonymized records
Account deletion disables a Partner Link and removes account content, backups, live discount benefits, and payout destinations under our Data Deletion Notice. A deletion does not rewrite another person's earned payment or erase records we must keep for tax, accounting, fraud prevention, or a dispute.
For those limited purposes, referral attributions, accepted agreement versions, subscription-chain evidence, commissions, payouts, and audit entries may remain after direct identifiers are removed. A keyed HMAC pseudonym can preserve proof that an account or subscription was already counted without retaining the original identifier in that row. We treat that evidence as protected personal data while re-linking remains reasonably possible.
7. AI features
Voice Fill, parsing, and caption tools send only the content you choose for that request to our contracted third-party AI processors, OpenAI or Anthropic. We use their business/API services to return the requested output, not to build advertising profiles. Under the providers' current business terms, API content is not used to train their general-purpose models by default. Do not submit another person's sensitive information unless you have authority to do so.
8. Service providers and other disclosures
We use service providers only for the functions described here:
- Infrastructure providers — application and website hosting, managed database services, backups, and shared-file object storage;
- Apple and Google — sign-in, billing, receipt validation, push delivery, and supported device-integrity checks;
- Meta — the optional Instagram connection;
- Transactional-email providers — sign-in and service messages;
- Crash-diagnostics providers — error and stability reports;
- OpenAI or Anthropic — only AI requests you initiate, including Voice Fill;
- Brand-logo lookup providers — logo lookup by domain;
- Rankry — website analytics that counts visits to ugcplanner.com arriving from AI assistants (referring site, page, browser language, and screen size; IP address hashed); no cookies;
- the payout provider identified during setup — partner payout processing.
We do not sell personal information or share it for cross-context behavioral advertising. We disclose data to another party only when you direct us to, a service provider needs it for the described function, a transaction or corporate reorganization requires it subject to appropriate protections, or a good-faith review shows disclosure is necessary for law, fraud prevention, or safety.
9. International transfers
UGC Planner operates from the United States, and some providers process data in the United States and other countries. Where transfer law requires it, we rely on a lawful transfer mechanism appropriate to the provider and destination, which may include an adequacy decision, Standard Contractual Clauses, or a recognized equivalent. We also use the technical protections described below.
10. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information; restrict or object to certain processing; withdraw consent; opt out of sale or sharing; appeal a refusal; and complain to a regulator. We do not discriminate against you for exercising a privacy right.
To make a request, email support@ugcplanner.app from the address associated with your account. We may verify your identity and an authorized agent's authority. We respond within the period required by applicable law and explain any permitted extension or refusal.
You can also object to the use of product usage events for our legitimate interests by writing to that address with "Privacy" in the subject line. There is currently no in-app switch for usage events. We review requests under applicable law; choosing device-only storage does not itself opt you out of these events.
If GDPR or UK GDPR applies, you may complain to your local supervisory authority; the European Data Protection Board lists EU authorities. If California law grants you a right to opt out of sale or sharing, there is presently nothing to opt out of because we do not sell or share personal information as those terms are defined by the CCPA.
11. Security
- HTTPS/TLS for network transport and provider encryption at rest.
- Application-level AES-256-GCM encryption for Cloud Backup & Sync records before database storage.
- OS secure storage for usable refresh tokens; the server keeps a one-way hash and session metadata.
- Scoped credentials, access controls, monitoring, and restricted production access.
- Keyed pseudonyms rather than raw referral network, installation, account, or subscription identifiers where the product can operate without the raw value.
No system is perfectly secure. If a personal-data breach requires notice, we will notify affected people and regulators within the time required by applicable law.
12. Children
The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from a person under 18. If you believe a minor has provided us personal information, email support@ugcplanner.app and we will investigate and delete it as appropriate.
13. Changes to this policy
We may update this policy as the Service evolves. We will post the new revision date and, where required, provide notice before a materially different use of personal information takes effect. We will request consent where law requires it.
14. Contact
Privacy questions and requests: support@ugcplanner.app · UP UGC Planner LLC, 1500 Chestnut Street, Suite 2 PMB 1081, Philadelphia, PA 19102, United States.