Privacy

UGC‑Barter connects venues running creator campaigns with the creators who post about them. This page is the whole of what we hold about a creator, in the order it arrives. It is written from the database schema, so it is a list of actual fields rather than a summary of categories.

We are the data controller for it. Where you are in the EU or UK, our lawful basis is performance of the contract you enter by joining a campaign, except for the analytics we do not run and the marketing we do not send.

What we collect, and why

Your email address, and a name and picture if you give one

To create your account and sign you in. Held for as long as the account exists.

The platform account you connect — the platform's own account id, your handle at the time, and your public follower count

To confirm the account that posted a video is the account claiming the prize. Without it anyone could submit anyone's video.

The access and refresh tokens for that connection, encrypted in our database and never readable from a backup alone

To ask the platform who authorized the connection, and to keep asking as tokens expire. We never post, message, or read anything private with them. If you remove our access on the platform, the connection stops being verified here within the hour.

The link to each video you submit, and which campaign you submitted it to

It is the entry itself. One video enters one campaign.

A periodic record of that video's public numbers — views, likes, comments, length, whether it is still public, and when the platform says it was posted

Tiers unlock on public metrics, so a prize has to be traceable to the numbers that earned it. Each reading is kept rather than overwritten, so a disputed prize can be answered with a history instead of a current total.

The caption, hashtags and mentions on that video at each reading

Campaign rules are things like a required hashtag. Keeping what the post said at each reading is what makes an edit visible and a dispute answerable.

Which rules passed or failed, when, and — where a person decided — which member of the venue's team decided it

So a refusal can be explained and a decision can be attributed.

The prizes you have unlocked, the codes issued, and when and where each was redeemed

It is the record of what you are owed and what you have collected. The venue sees that a code was redeemed at their counter.

What we never collect

• Payment details of any kind. Nothing on this platform moves money — the reward is a meal or a discount.
• Your private posts, drafts, direct messages, or anything on an account you have not connected.
• Your contacts, your location, or your device identifiers.
• Analytics on this website. These four pages set no cookie and load no tracker.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's advertising.

The venue running a campaign you entered

Your handle, the video you submitted, its public numbers, which rules passed, and whether a prize was redeemed at their counter. Not your email address.

TikTok and Instagram

Only the request itself: we ask them who authorized a connection and what a public video's numbers are. We send them nothing about you that they did not already have.

Our hosting and email providers

What is technically necessary to run the service and send the one email it sends — that a prize is waiting. They act on our instructions and hold nothing for their own purposes.

How long we keep it

Your account and its connected platform accounts are kept until you delete them. The readings we take of a submitted video are kept for as long as the account is, and they are added to rather than overwritten — that is deliberate, and it is what lets a prize awarded two months ago still be explained. Redemption records are kept for as long as the venue needs them to account for what they gave away.

Disconnecting a platform account stops us reading anything new from it immediately.

Your rights, and how to delete your data

You can ask us for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Email privacy@example.invalid from the address on your account and say which you want.

Deletion today is a request we action by hand, within 30 days and usually much sooner — there is no self-serve delete button in the app yet, and we would rather say so than imply one. When we delete an account we remove your email and name, your platform connections and their tokens, your submissions and every reading taken of them, and any prize codes not yet redeemed. Records of prizes already redeemed are kept without your account attached to them, because the venue has a legitimate need to account for what it handed over.

If you think we have got this wrong you can complain to your local data protection authority. In Romania that is the ANSPDCP.

Asking us anything

Everything on this page has a person behind it. Contact has the addresses and who to expect a reply from.