UGC Swap
Make a video

Effective April 25, 2026

Privacy Policy

1. Who we are

UGC Swap is operated by World United Studios Limited ("UGC Swap," "we," "us"). This Privacy Policy explains what personal information we collect when you use the UGC Swap website and application (the "Service"), why we collect it, how we use it, and your rights over it. Contact us at support@ugcswap.com.

2. The Service in brief

UGC Swap is an AI-assisted video creation tool. You can generate, render, and edit short-form video.

3. The data we collect

Account & identity

Name, email address, password hash (or third-party sign-in identifier), profile picture if you set one, language and timezone preferences, and your subscription / plan status.

Content

The videos, images, audio, scripts, prompts, captions, characters, projects, notes, and conversation history you upload, generate, or store inside UGC Swap.

Billing

Plan status, invoice history, billing email, and tax identifiers. Card and bank-account details are collected and stored directly by our payment processor (Stripe); we never see or store full card numbers.

Logs & usage

Server logs (IP address, user agent, request paths, timestamps), device identifiers, product usage (pages viewed, features used, login timestamps), and session tokens.

Cookies and similar technologies

We use cookies, local storage, pixels, and SDKs for authentication, security, preferences, product analytics, and marketing attribution on the marketing site. See Section 14.

4. How we use the data & legal bases

  • Provide the Service — render videos, run the AI agent, and provide editing tools. (Performance of contract.)
  • Bill and collect payment. (Performance of contract; legal obligation.)
  • Secure the Service, detect abuse and fraud. (Legitimate interests; legal obligation.)
  • Operate, maintain, and improve the Service. (Legitimate interests.)
  • Communicate with you about your account, billing, and (if you opt in) product updates. (Performance of contract; consent.)
  • Comply with law. (Legal obligation; legitimate interests.)

We do not sell personal data. We do not use your private content (videos and prompts) to train AI models or to send you advertising.

5. AI-assisted features

UGC Swap relies on third-party model providers — currently including Anthropic, OpenAI, Google, fal.ai, ElevenLabs, and OpenRouter — to generate text, images, audio, and video. To operate these features we transmit your prompts and the inputs you choose to include to those providers acting as our sub-processors. We send only what is necessary to fulfill your request; we do not authorize sub-processors to use your data to train their models.

6. UGC Swap as controller and processor

For your account information, billing data, and product usage, UGC Swap is the data controller. For the content you create and store through the Service, UGC Swap acts as a data processor on your behalf and you are the controller.

7. Who we share data with

We share data only with the service providers required to operate UGC Swap:

  • Cloud and database — Convex (primary database and auth), Vercel (hosting and edge network), object storage providers (Vercel Blob / S3) for media assets.
  • Payments — Stripe for billing and payment processing.
  • Marketing measurement (on the public marketing site only) — Google Analytics, Meta Pixel, TikTok Pixel.
  • Generative AI providers — Anthropic, OpenAI, Google, fal.ai, ElevenLabs, OpenRouter, used as sub-processors to fulfill the AI features you invoke.
  • Professional advisors — accountants, lawyers, and auditors under confidentiality.
  • Authorities when required by lawful process.
  • Successor entity in a merger, acquisition, or asset sale; the successor will be bound by terms no less protective than this Policy.

8. International data transfers

UGC Swap is operated from Hong Kong (World United Studios Limited), and we use sub-processors in the United States, the European Union, the United Kingdom and other jurisdictions. As a result, personal data we process may be transferred to and stored in countries outside your own, including countries that may not have been recognised as providing an "adequate level of protection" by the European Commission, the UK ICO or other regulators.

Where personal data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, we rely on the European Commission Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), supplemented by additional technical and organisational measures (encryption in transit and at rest, access controls, contractual restrictions on sub-processor use of the data). You may request a copy of the relevant safeguards by emailing support@ugcswap.com.

9. Retention

  • Account data — kept while your account is active; deleted within 30 days after closure.
  • Content (videos, projects, notes, conversation history) — kept while your account is active.
  • Server logs — typically up to 90 days.
  • Billing records — retained for the period required by tax and accounting law (typically 7 years).
  • Encrypted backups — roll off on their normal schedule (typically within 90 days).

10. Security

We maintain administrative, technical, and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure or access. Measures include TLS encryption in transit, encryption at rest, password hashing, role-based access controls, audit logging, multi-factor authentication for staff, and vendor security reviews. No system is fully secure, and we cannot guarantee absolute security.

11. Your rights

You can:

  • Access your personal data and receive a copy in a portable format.
  • Request correction of inaccurate data.
  • Request deletion (subject to retention obligations described in Section 9).
  • Object to or restrict processing.
  • Withdraw any consent you previously gave.
  • Lodge a complaint with your local data-protection authority.

To delete your entire account and associated data, email support@ugcswap.com. We will respond within the timeframe required by applicable law (typically 30 days, extendable for complex requests).

12. California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "California Privacy Laws") gives you the rights summarised in Section 11, including the right to know what categories of personal information we collect about you and the purposes for which we use them (described in Sections 3 and 4), the right to delete, the right to correct, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising your rights. UGC Swap does not sell personal information and does not share it for cross-context behavioural advertising. To exercise your California rights, email support@ugcswap.com.

13. Hong Kong PDPO

Where the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") applies, World United Studios Limited handles personal data in accordance with the Data Protection Principles set out in the PDPO. You have the right to request access to and correction of personal data we hold about you. Requests should be sent to support@ugcswap.com.

14. Cookies and marketing choices

On the in-product application we use cookies and local storage only for authentication, security, preferences, and product analytics. On the public marketing site we additionally use marketing-attribution pixels (Google Analytics, Meta Pixel, TikTok Pixel). You can unsubscribe from marketing email at any time using the unsubscribe link in any such email; transactional emails (account, billing, security notices) remain necessary while your account is active.

15. Third-party sites and services

UGC Swap may link to or integrate with third-party services. Their handling of your data is governed by their own privacy policies, not this one.

16. Children

UGC Swap is intended for business and creator use and is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

17. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email at least 14 days before they take effect. The "Effective" date at the top of this page reflects the most recent update.

18. Contact

Questions about this Privacy Policy or your data? Email support@ugcswap.com. Postal address available on request to the same email.