Privacy Policy

The controller is PENDENTE — razão social , Brazilian tax ID (CNPJ) PENDENTE — CNPJ , headquartered at PENDENTE — endereço completo .

Data Protection Officer (DPO): PENDENTE — e-mail do encarregado (DPO) .

• Registration: name, email, city, state, WhatsApp and Pix key. The Pix key exists for one reason only: to pay you.
• Professional profile: niches, recording format and videos you upload to your portfolio.
• Connected social accounts: your username, the identifier returned by the platform, follower count, and your videos' public metrics — views, likes and comments.
• Platform history: campaigns, deliveries, deadlines, reviews received and wallet transactions.
• Document acceptance: which version you accepted and when.

The platform itself confirms account ownership through its login. We receive read-only authorization limited to your videos' public metrics, and you can revoke it at any time in the dashboard.

• Registration and contact details of the person operating the account.
• Brand information: name, app links, brief, materials.
• Campaign, budget and financial transaction data.
• If the brand connects RevenueCat, we receive daily aggregated counts of registrations and subscriptions in its app. We do not receive data about the app's end users.

The legal bases we use, in LGPD terminology:

• Performance of a contract (Art. 7, V) — registration, campaign data, video metrics and Pix key. Without these, we cannot measure or pay.
• Consent (Art. 7, I) — connecting each social account. You authorize this on the platform's own screen, and you revoke it.
• Legal obligation (Art. 7, II) — tax and accounting records of payments.
• Legitimate interest (Art. 7, IX) — fraud prevention and platform security, limited to what is necessary.

With the contracting brand, when you accept its campaign: your profile name, city and state, niches, portfolio, performance metrics and that campaign's deliveries.

Before you accept, the brand sees a limited profile and does not see your full name, WhatsApp, email or Pix key. These details are never shared with the brand.

With providers who operate the platform, each with access only to what is necessary:

• Supabase — database and authentication, servers in Brazil (São Paulo).
• Vercel — application hosting, with processing abroad.
• Resend — transactional email delivery, with processing abroad.
• TikTok and Meta — to read the metrics you authorized.

Where international transfers occur, they are based on providers' contractual clauses. We do not sell personal data to anyone under any circumstances.

• While your account exists, we retain registration data and history.
• After the account is closed, we delete personal data within 30 days, with two exceptions.
• First exception: tax records of payments, which the law requires us to retain for 5 years.
• Second exception: the document acceptance record, retained for the duration of the usage license for videos you delivered.
• Access tokens for your social accounts are deleted the moment you disconnect.

The LGPD (Art. 18) gives you the right to:

• Know whether we process your data and which data.
• Access and obtain a copy of that data.
• Correct incomplete, inaccurate or outdated data.
• Request anonymization, blocking or deletion of unnecessary data.
• Request portability to another provider.
• Revoke consent — for connected accounts, independently in the dashboard.
• Know who we share data with.
• Object to processing you consider inappropriate.

To exercise any of these rights, write to PENDENTE — e-mail do encarregado (DPO) . We respond within 15 days. See also the page on data deletion .

Data is encrypted in transit. Database access is controlled by rules that isolate each account: one brand cannot access another's data, and one creator cannot access another's data.

Your social account tokens are stored in a database area that the website cannot read — even when you are signed in. Only internal measurement processes have access.

If an incident occurs that may affect you, we notify you and the ANPD as required by Art. 48 of the LGPD.

We use only cookies necessary to keep you signed in and protect social account connections against fraud. We do not use advertising cookies or third-party tracking.

UGCode is not intended for people under 18, and we do not knowingly collect minors' data. If identified, the account is closed and the data deleted.

We notify you by email before any material change and retain a record of which version each person accepted.