Privacy Policy

Lumina UGC is a platform that connects content creators with brands running user-generated content campaigns. A creator picks a campaign, posts content on their own social accounts, submits the post, and is paid once it is approved. Lumina UGC is operated by COGNOVATE LABS FZCO.

Where this policy applies

• creators.ugcagency.io and the Lumina UGC mobile app for iOS and Android, used by creators.
• client.ugcagency.io, used by brands and their staff to review campaigns and submissions.
• admin.ugcagency.io, the internal tool used by Lumina staff.

Most of this policy is about creator data, because that is the bulk of what we handle. Where a rule applies only to brand users or only to staff, we say so. The separate marketing website at ugcagency.io publishes its own privacy policy.

"We", "us" and "Lumina UGC" mean COGNOVATE LABS FZCO. "You" means whoever is using the service, whether as a creator, a brand user or a member of staff.

2.1 Information you give us

• Email address and password. Passwords are stored only as a salted cryptographic hash, never in plain text.
• Name, display name, country and city.
• Profile details you choose to add: photo, bio and portfolio.
• Phone number, if you choose to add one.
• Social media handles for the accounts you post from.
• Payout method and the details needed to pay you. We support PayPal, Whop and Solana wallet addresses.
• Links to posts you submit, and any video files you upload.
• Messages you send through the platform, and anything you send to support.
• Campaign agreements: if a brand approves you for a campaign, an agreement is prepared that records your name, your email address, the name you type to sign, and the IP address you sign from.

Brand users give us a name, an email address and a password. Nothing else on this list applies to them.

2.2 Information we collect automatically

• Public performance figures for the posts you submit, such as view counts, likes and comments. These are read from the social platform the post is published on. We only ever read what is already public.
• Attribution data: if you arrive from one of our adverts, we record which advert brought you. Section 05 explains this in full.
• Diagnostics needed to keep the service working. If a page crashes, we record the error message, the page you were on, the app version and your browser or device type, so we can fix it.
• Sign-in records, used to keep your account secure and to detect abuse.
• The city and country you type are checked against OpenStreetMap so that made-up places are rejected.

2.3 What we do not collect

We do not collect your device contacts, your GPS location, your microphone or camera feed, or the passwords to your social accounts. We never ask for and never store payment card numbers. The mobile app asks for photo library access only at the moment you choose to attach a video to a submission, and only the file you pick is uploaded. We do not scan or read your library otherwise.

• To create your account and sign you in.
• To show you campaigns and let you apply to them.
• To review submissions and work out what you have earned.
• To pay you.
• To tell you when a submission is approved, needs changes, or is paid, by email and by push notification if you allow them.
• To run leaderboards and campaign rankings, which show your display name and public view counts.
• To detect fraudulent, duplicate or bot-driven submissions.
• To provide support when you contact us.
• To measure whether our adverts work. See section 05.
• To meet our legal, tax and accounting obligations.

We do not sell your personal data. We do not share it with data brokers, and we do not use your account data to build advertising profiles about you.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR:

• Performance of a contract, to run your account, process submissions and pay you.
• Legitimate interests, to keep the platform secure, prevent fraud, and measure whether our adverts work.
• Legal obligation, to keep tax and accounting records and to respond to lawful requests.
• Consent, where we ask for it, such as for push notifications and for non-essential cookies. You may withdraw consent at any time.

We keep this short and specific, because a vague answer here is worse than none.

On the creator website (creators.ugcagency.io)

• Essential cookies. These keep you signed in. The service does not work without them.
• An attribution cookie called first_touch_src. If you arrive from one of our adverts, this records which advert it was and keeps that for 30 days, so that an account you create two days later is still credited to the right advert. It holds a short campaign label, nothing about you.
• The Meta pixel. The creator website loads advertising measurement code from Meta, the company behind Facebook and Instagram. It reports a page view, and reports when a visitor completes a sign-up, so that we can see which adverts produce accounts. Meta receives this as the operator of that tool and handles it under its own privacy policy. The same pixel runs on our advert landing pages.

Where there is no ad tracking

• The Lumina UGC mobile app contains no advertising or analytics software development kit of any kind.
• admin.ugcagency.io and client.ugcagency.io load no pixel. Staff and brand sessions are deliberately kept out of advertising data.

You can block or clear these cookies in your browser, and you can limit ad tracking in your Meta account settings. Blocking the attribution cookie or the pixel does not stop you using the platform.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as California defines that term. We disclose it only as set out here.

• The brand running a campaign sees the submissions made to that campaign, their public performance figures, and the creator display name and handle. Brands do not see your email address, phone number, payout details or address.
• Lumina staff review submissions, payouts and support requests through an internal admin tool.
• Lumina Clippers, a separate company operating the portal at luminaclippers.com, runs some campaigns jointly with us. For those campaigns only, we send them the submission link, the platform it is on, the public view, like and comment counts, and the creator display name and handle. We never send them email addresses, phone numbers, payout details or payout amounts.
• Service providers who run parts of the platform on our behalf, under contract, and only to provide their service: Vercel and Render (hosting and databases), Cloudflare R2 (file storage), Resend (email delivery), Apify (reading public post metrics from social platforms), Google and Apple (sign-in, if you use it), Discord (if you link a Discord account), and Meta (advert measurement, as described in section 05).
• Social platforms, when we read the public figures for a post you submitted. We send them the post link. We never send them anything about you.
• Where the law requires it, such as a valid legal request, or to establish or defend a legal claim.
• In a business transfer, if Lumina UGC is ever merged, acquired or sold, your information may pass to the new owner under this same policy.

Account and submission records are kept while your account is open. After your account closes we keep only what we need for tax, accounting and fraud-prevention obligations, and we delete or anonymise the rest. Section 08 sets out exactly what survives deletion and why.

Crash diagnostics are kept for a short operational period and then discarded. Support messages are kept while they are needed to handle the issue and to show what was agreed.

Deleting your account: in the app, Account → Delete my account. You will be asked to type DELETE to confirm. You can also email support@ugcagency.io from your registered address.

Deletion permanently removes your name, email address, phone number, bio, profile photo, linked social accounts and handles, payout details, portfolio and sign-in credentials, and you will not be able to log back in by any method.

The videos you already submitted, the campaigns you took part in and the record of what you were paid are kept, and are no longer connected to your name or any of your details. We keep them because they are also the brand’s record of work they commissioned and paid for, and our own accounting and tax record, which we are required to retain.

Campaign agreements are the one exception. If a campaign agreement was ever prepared for you, your name and email address remain on that document, together with the name you typed to sign it and the IP address you signed from. An agreement is a contract between you and a brand, and the copy we store is a snapshot of the document itself — altering it afterwards would destroy the record of who agreed to what. Everything else described above is still removed.

Note this covers agreements prepared for you, not only ones you signed: the document is created when a brand approves you for a campaign, which happens before you are asked to sign anything.

Where you email us instead of using the in-app option, we act on a verified request within 30 days.

You can access, correct, export or delete your personal data. Depending on where you live you may also object to or restrict certain processing, and withdraw a consent you previously gave. To exercise any of these, email support@ugcagency.io from your registered address. We do not charge for this and we will not treat you differently for asking.

California residents. Under the CCPA and CPRA you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, and we do not discriminate against anyone who exercises these rights.

EEA and UK residents. You may lodge a complaint with your local data protection authority. We would rather you told us first so we can put it right.

Passwords are stored as salted hashes. Traffic is encrypted in transit using HTTPS and TLS. In the mobile app, authentication tokens are held in the operating system secure store, Keychain on iOS and Keystore on Android. Access to the admin tool is restricted to staff who need it, and admin actions are logged.

No method of transmission or storage is completely secure. If you think your account has been accessed by someone else, email support@ugcagency.io immediately.

Lumina UGC is for adults. The mobile app is rated 18+ because it involves payouts, and the service is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, email support@ugcagency.io and we will remove it.

We operate from the United Arab Emirates and our service providers are located in several countries, so your personal data may be processed outside the country you live in. Where we transfer personal data out of the EEA or the UK, we do so using appropriate safeguards, such as the standard contractual clauses approved for that purpose.

If we make a material change we will update the date at the top of this page and, where the change is significant, tell you in the app or by email. Continuing to use the service after a change means you accept the updated policy.

Questions, requests and complaints about privacy all go to the same place.

COGNOVATE LABS FZCO
Lumina UGC
support@ugcagency.io