Effective 29 October 2026 · Last updated 29 October 2026
Privacy policy
How UGC.Place collects, uses, and shares information, including TikTok Login Kit data.
1. Who we are
UGC.Place is a public web directory at https://ugc.place. It is operated by Hnat Danylevych, a sole trader registered in Poland, NIP 6793354143, [Business address] (“we”, “us”). For privacy law, we are the controller of personal data we collect through the site and our API at api.ugc.place.
Questions, access requests, and deletion requests: [email protected]. Anything else: [email protected]. We answer in English or Polish.
TikTok Inc. and its affiliates are separate controllers of the TikTok accounts creators connect. Their practices are described in TikTok’s privacy policy. This page covers only what we receive and what we do with it.
This policy is information about how we handle personal data, as the GDPR requires (Art. 13 and 14). It is not a contract and adds no terms to our Terms of service.
2. What UGC.Place is
UGC.Place is a free public discovery directory for tech-oriented TikTok UGC creators (SaaS, apps, AI, and similar products). Brands search public profiles. Creators list a public profile. We sell a small number of sponsor slots on the directory. We are not a marketplace, escrow, or payroll service. We do not take a cut of creator–brand deals, hold campaign funds, or pay creators.
You can browse without an account. Creators and brands sign in the same way, with Google or an emailed one-time code and link; creators then connect their TikTok account through TikTok Login Kit. Some of those account features launch in stages; this policy describes them so it is accurate when they go live.
3. Information we collect
When you browse
Our hosts and content network (including Cloudflare) receive standard request data: IP address, date and time, URL, referrer, user agent, and similar server logs. We use this to operate, secure, and debug the site. We do not run advertising pixels or session replay.
When you open a creator’s profile, or creators appear in your search results, your browser tells us which creators were shown. We use this only to count, for each creator, how often their page was viewed and how often they appeared in search results. We count without cookies or local storage: to count each visitor once a day, our server combines your IP address and browser user agent with a random key that changes every day and is kept only in the server’s memory. The result is never written down and is forgotten when the day ends (UTC). What we keep is a daily total per creator.
We measure how the site is used with PostHog, an analytics service, in its cookieless mode, on PostHog’s EU servers in Frankfurt. Your browser sends the request to our own server, which removes search text, links’ secret parts and anything after “?” other than directory filters and campaign tags, and then passes on: the page address, the website you came from (its address only), your browser, operating system, language, time zone and screen size, your country, and a few actions without their content: a search found results or none, a profile was opened, a message or offer was sent, an offer was accepted, a sponsor checkout was started or paid. PostHog also receives your IP address and browser user agent only to count you once a day, with an identifier that changes every day, and deletes them after doing so. Nothing is stored in your browser. We never send your name, email, account, messages, offers or anything you type.
When you ask us to email you a sign-in code, or join the brand waiting list, the form first runs Cloudflare Turnstile, a check that you are a person and not a bot. It loads in a frame from Cloudflare and receives your IP address, browser user agent and technical signals from your browser and connection, and which site the check is on. It does not read what you type into the form. Our server then asks Cloudflare to confirm the result, sending your IP address with it. Cloudflare uses this to detect and block bots and, as its own controller, to improve that detection (Turnstile Privacy Addendum). Signing in with Google does not use this check.
Creator accounts
Creators sign in with a Google account (we store the Google account ID and its verified email) or with a one-time code and link we email to them (we store only hashes; both expire after 15 minutes). There is no password. We keep your verified email as your sign-in and to tell you about new messages and offers — each time, in a daily summary, or not at all, as you choose. We also store a session so you stay signed in.
Before you can list, you connect the TikTok account behind your profile. After you authorize us, TikTok sends the data listed in section 4. TikTok is never used to sign in.
If you complete a public listing, you may provide:
- A public handle, display name, city, country, and TikTok profile URL
- Rates (a base fee, a CPM or both; at least one is needed to list)
- Deal preferences: whether you take deals without a fixed fee, post on a new account for a brand, or send video files only (all on unless you turn one off)
- Languages, niches and video types, and optional gender, age range, and ethnicity (filter fields)
- A portrait you upload, or our stored copy of your TikTok avatar
- An optional short bio (“About”) in your own words
- One to eight example videos: links to your own TikTok posts or to TikTok, Instagram or YouTube videos you made, each with an optional video type and the brand or app it was made for, and our stored copy of each video’s cover
- Confirmation that you are 18 or older
- Whether you are taking new work, and optionally the last day you are not
When you use your creator account, we note when (at most once an hour). Your public profile shows only “Active this week” or “Active this month” from it, never the time, and brands can narrow the directory to creators active in the past 7 or 30 days. Your availability (“Not taking new work”) is public while it is on.
We do not ask for legal name, date of birth, street address, postal code, phone number, government ID, tax ID, or payout details. We have no reason to hold them: we do not pay you and we do not run escrow.
Brand accounts
Brands sign in the same way as creators: a Google account (we store the Google account ID and its verified email) or a one-time code and link we email to them (we store only hashes; both expire after 15 minutes). There is no password. After the first sign-in a brand gives a name, plus an optional website. Search stays public without this account. The account exists so a brand can contact a listed creator and keep a list of creators it saved (which creators, and when). The saved list is private to the brand unless the brand shares it: a brand can create a read-only link to its list, and anyone with that link sees the brand name and the saved creators’ public cards, until the brand stops sharing. Creators are not told who saved them; a creator sees only how many brands saved them each week. Brands can also keep private offer templates (terms, deliverables, example links and notes) that only they see. Creators you talk to see your brand name, your website, the month you joined and whether the email you sign in with is at your website’s domain — never the address itself.
Brand waiting list
Before brand accounts open, a brand can join a waiting list. We store the email address it gives, and the company name and website if it adds them, with the date it joined and the date we told it brand accounts were open. We use them only to tell you when brand accounts open, and we delete them when you ask us to at the address in section 15.
Messages and offers
When a signed-in brand writes to a listed creator, we store each message in that conversation, from either side, and who sent it. A brand can also send an offer: the payment terms, number of videos, delivery, usage rights, what to make, example video links, a due date and a note, and whether the creator accepted, declined or the brand withdrew it. Messages and offers are not bookings, invoices or payments; we do not handle payment between brands and creators.
Messages, offers, bios and the “made for” names on example videos are checked automatically for abuse such as scams and threats (see processors in section 7). Text that is flagged, blocked or reported is kept for up to 90 days so our staff can review it, and staff may read the surrounding conversation when they do.
Reports
If you report a profile, a video, an offer, a brand or a message, we store who reported it, what was reported, the reason you picked and any note you add. Only our staff see who reported; the person reported is never told. A note is removed after 90 days; the record of the report and what staff decided stays as our audit trail until the accounts it names are deleted.
Sponsor payments
When you buy a sponsor slot, Stripe processes the payment; you do not need a UGC.Place account. We receive the payment status, amount, Stripe identifiers and the email address you give Stripe. We use that address to send you a private link to add your sponsor card and, if the card is still missing after 48 hours, one reminder. We do not store card numbers. The card you add (name, short description, link and logo) is stored and shown on the directory once we approve it.
Information we do not collect from TikTok
We do not request TikTok email, phone, direct messages, audience country/age/gender breakdowns, or permission to post on your behalf. We do not use TikTok Content Posting API, Share Kit, or Data Portability API.
4. TikTok Login Kit
This section is the disclosure TikTok requires for apps that use Login Kit. UGC.Place is not TikTok, not a TikTok product, and not endorsed by TikTok. Connecting TikTok here does not create a TikTok account, and TikTok is not how you sign in to UGC.Place.
Why we use TikTok
Creators connect TikTok through Login Kit to prove they control the TikTok account behind their listing, to start the profile from that account’s display name, username and avatar, to read the numbers shown on their profile (follower count and figures from recent public videos), and to let them pick their own videos to show.
Products and scopes
| TikTok product | Scope | Data we receive | What we use it for |
|---|---|---|---|
| Login Kit | user.info.basic | open_id, display name, avatar URL | Link your TikTok account to your creator profile; default name and portrait |
| Login Kit | user.info.profile | Your TikTok username and profile link | Suggest your UGC.Place handle and set the TikTok link on your public profile |
| Login Kit | video.list | Metadata for your recent public videos (for example cover, caption, create time, duration, view and engagement counts) | Compute aggregate stats shown on your public profile and in search, and let you pick your own videos to show on your profile with their view counts. We do not publish the rest of the list, and captions are shown only to you, in the picker. |
| Login Kit | user.info.stats | Your account’s follower count only (we do not ask for following, likes or video counts) | Show your follower count on your public profile and in search. |
We request only the scopes the features need, all on the one consent screen when you connect TikTok: user.info.basic, user.info.profile where we read your username, and, where we read your numbers, video.list and user.info.stats. You can untick a scope there or revoke access in the TikTok app. We do not request audience demographics.
Tokens
After you authorize, TikTok issues an access token and a refresh token. We exchange the authorization code on our server, store both tokens encrypted at rest, and never put them in the browser, in API JSON, or in logs. We use them only to call TikTok APIs you authorized (your account identity, and the numbers described in this section). We keep the tokens until your account is deleted. If you revoke UGC.Place in TikTok, or our access expires, the stored tokens stop working and your account asks you to reconnect TikTok.
Avatar copy
TikTok avatar URLs expire. If we use your TikTok avatar as a default portrait, we fetch the image once and store our own copy. We do not hotlink the TikTok CDN on public cards or profiles.
Video covers
Video cover URLs expire too. For each example video you add, we fetch its cover once, re-encode it, check it automatically and store our own copy; a cover that fails the check is not stored. Public profiles show our copies, never the platform’s image hosts.
Aggregates
We read numbers only from the TikTok account behind your profile. Public profiles may show only your follower count and aggregated figures from up to 30 recent posts (posts analyzed, median views, average views, 75th-percentile views, average engagement, last update time). Numbers we have not been able to refresh for 90 days are removed.
What we will not do with TikTok data
- Sell it, rent it, or use it for cross-context behavioral advertising
- Build or sell marketing profiles unrelated to your public UGC.Place listing
- Post, edit, or delete TikTok content, or message TikTok users through TikTok
- Scrape TikTok outside the official Login Kit
- Remove TikTok watermarks or imply that UGC.Place is TikTok
TikTok’s developer terms require us to use TikTok information only to provide this application — here, the directory, creator accounts, and the numbers on creator profiles. If you delete your UGC.Place account, we delete the TikTok tokens and identity records we hold and ask TikTok to revoke UGC.Place’s access.
You can revoke UGC.Place in TikTok’s app or website (authorized apps / manage access). After revoke, API calls fail; you can also delete your account in your UGC.Place account settings, which deletes the stored tokens.
5. How we use information
We use personal data to:
- Run the public directory and your account
- Show the public profile and search filters you opted into
- Keep you signed in (HTTP-only session cookie)
- Deliver messages and offers between brands and creators
- Show a brand’s shortlist to people the brand shares its link with
- Review reports and abuse, and act on them
- Show creators private weekly totals for their own page (views, saves and appearances in search)
- Email you about new messages and offers as you choose in your account settings (every time, a daily summary, or off); every such email has a one-click unsubscribe
- Process sponsor slot payments, send buyers the link to add their card, and display approved ads
- Measure, in aggregate, how the site is used (pages viewed, searches, messages and offers sent — never their content) to decide what to improve
- Secure the service, prevent abuse (including a bot check before we send a sign-in email), and debug outages
- Comply with law and respond to valid legal requests
Legal bases
Where the GDPR (or the UK GDPR) applies, this is the legal basis for each purpose. “Art.” means an article of the GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Your account and sign-in | Email, Google account ID, sign-in code and link hashes, session; for brands, the brand name and website | Contract (Art. 6(1)(b)) |
| Your creator listing and public profile | The listing fields in section 3, including optional gender and age range, availability and when you were last active | Contract (Art. 6(1)(b)) |
| Optional ethnicity filter | The ethnicity you pick | Explicit consent (Art. 6(1)(a) and 9(2)(a)), given by picking it. Withdraw it by clearing the field in your account settings. |
| TikTok connection and the numbers on your profile | The TikTok data and tokens in section 4 | Contract (Art. 6(1)(b)): connecting TikTok is required to be listed, and the listing is the service you asked for. It ends when your account is deleted. |
| Messages and offers | What you write and send, who sent it, when, and an offer’s terms and status | Contract (Art. 6(1)(b)) |
| Automated abuse checks, and staff review of flagged, blocked or reported text | Messages, offers, report notes, bios, “made for” names, photos and video covers; flagged text for up to 90 days | Legitimate interests (Art. 6(1)(f)): keeping people safe from scams, threats and fraud |
| Reports | Who reported, what, the reason, the note, and what staff decided | Legitimate interests (Art. 6(1)(f)): safety and fraud prevention; legal obligation (Art. 6(1)(c)) to act on notices of illegal content |
| Saved creators and shared shortlists | Which creators a brand saved and when; the brand name and the saved creators’ public cards on a shared link | Contract with the brand (Art. 6(1)(b)); for the creators shown, legitimate interests (Art. 6(1)(f)): their cards are already public |
| Brand waiting list | Email, and the optional company name and website | Consent (Art. 6(1)(a)), given by joining the list; you can withdraw it at any time |
| Offer templates | Terms, deliverables, example links and notes a brand saves | Contract (Art. 6(1)(b)) |
| Profile-view and search counts, without cookies | IP address and user agent, used only in memory; daily totals per creator | Legitimate interests (Art. 6(1)(f)): showing creators how their page does |
| Measuring how the site is used | The analytics described in section 3 | Legitimate interests (Art. 6(1)(f)): knowing which parts of the site work, without identifying you |
| Sponsor payments and card review | Buyer’s email, payment status, amount, Stripe identifiers, the sponsor card | Contract (Art. 6(1)(b)) |
| Invoices and accounting records for sponsor sales | Payment records | Legal obligation under Polish tax law (Art. 6(1)(c)) |
| Sign-in, account and sponsor emails | Your email; sign-in codes and links, the account-deleted confirmation, the sponsor card link and its reminder | Contract (Art. 6(1)(b)) |
| Message and offer emails and daily summaries | Your email; who wrote, how many, and links to the conversations (never the text or offer terms) | Contract (Art. 6(1)(b)). Switch them to a daily summary or off in your account settings, or with the one-click unsubscribe in any of them. |
| Security, logs and the bot check | IP address, user agent, request logs, the bot check’s signals | Legitimate interests (Art. 6(1)(f)): keeping the service secure and working |
| Legal requests | What a valid request covers | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, you can object at any time (Art. 21) by writing to [email protected]. We then stop, unless we have compelling grounds that override your interests or need the data for a legal claim.
Ethnicity is optional, collected only if you choose it for filters, and is not shown on your public profile. Brands who filter by it can find you through it. Treat it as sensitive; provide it only if you want that filter to apply.
Do you have to give us data?
No. Giving us personal data is voluntary. But we need an email or a Google account to give you an account, and a creator listing needs its required fields (a connected TikTok account, handle, name, city, country, a language, a niche, a rate, an example video and your 18+ confirmation). Without them we cannot provide that part of the service. Fields marked optional stay optional.
Automated checks and decisions
Our abuse checks are automated. They can stop a message, offer, report note, bio or “made for” name from being sent or saved; remove a message or that profile text when a delayed check finds it breaks our rules; pause someone’s messaging for a few minutes, up to an hour, after repeated blocked messages; and stop a photo or video cover from being stored. Text they stop or remove is kept for our staff to review; a rejected image is not stored. The automated checks never unlist a profile, remove a video or close an account: staff decide those.
We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22). If an automated check stopped or removed something of yours, you can ask a person to review it at [email protected].
6. What is public
Listed creator profiles are public and may be indexed by search engines. That typically includes display name, handle, city and country, languages, niches and video types, rates you chose to publish, portrait, bio, linked TikTok profile URL, the follower count and aggregate performance read from your TikTok account, and your example videos: their links and covers, video types, the brands or apps you say they were made for, and the view counts of the ones on your own TikTok. While you have turned a deal preference off, your profile says so (for example “Only takes deals with a fee”). While you are not taking new work, your profile says so (with the date you are back, if you set one), and your profile says “Active this week” or “Active this month” when you used your account in that time; brands can filter the directory on the same two periods.
The following stay private:
- TikTok
open_idand tokens - Your email, sign-in code and link hashes, and session secrets
- Gender, age range, and ethnicity (filter inputs, not profile fields)
- When you last used your account (only the week or month bucket above is shown)
- Unread inbox contents, except to the other party in that thread
- Your page’s numbers (views, saves, appearances in search): only you see them, and they never affect search order
Until live creators replace them, some directory cards are labeled illustrative. Sample portraits, metrics, and sponsor names are not real people or sales.
9. How long we keep information
- Account and public profile: until you delete the account (you can do it yourself in your account settings) or we close it for a terms violation
- TikTok tokens and TikTok data: until the account is deleted (numbers we cannot refresh for 90 days go sooner, section 4). If you revoke UGC.Place in TikTok, the stored tokens stop working.
- Sessions: until expiry, logout, or revoke
- Messages and offers: for the life of the conversation. When either person deletes their account, the whole conversation is deleted for both.
- Flagged, blocked or reported text, and report notes: up to 90 days; the record of a report and its outcome stays until the accounts it names are deleted.
- Sponsor payment records, including the buyer’s email and the card: as long as tax and accounting rules require. These are kept, without a link to any account, if you delete your account.
- Page stats: daily totals per creator, for 90 days. The daily key used to count each visitor once is never stored.
- Analytics: kept by PostHog for up to one year (our plan’s limit), without your name, email, account or IP address
- Brand waiting list: until you ask us to delete it
- Server logs: typically a short operational window, longer if needed for security
Deleting your account deletes your profile and public page, your photos and video covers, your conversations, messages and offers, your saved creators, shared shortlist link and offer templates, your TikTok connection and tokens, and your sign-in. Sponsor payment records stay, as listed above, for tax and accounting. Copies in server logs and backups last until those roll over.
10. Security
We use HTTPS, HTTP-only session cookies, hashed session secrets, hashed one-time sign-in codes and links, hashed sponsor card links, and encrypted TikTok tokens. No method of transmission or storage is perfectly secure.
Data breaches
If a personal data breach could put people’s rights at risk, we report it to the Polish data protection authority (UODO) within 72 hours of learning of it. Where the risk to you is high, we also tell you without undue delay (GDPR Art. 33 and 34).
11. Your choices and rights
You can:
- Browse without creating an account
- Decline TikTok authorization, or revoke it in TikTok later
- Edit or unlist your public profile
- Skip optional fields, including ethnicity
- Turn off message and offer emails, in your account settings or with the unsubscribe link in any of them. Sign-in and account emails are always sent.
- Delete your account and its data yourself, from your account settings: the Account tab, Delete account (section 9 says what is deleted and what is kept)
- Download a copy of your data yourself, as a machine-readable JSON file, from your account settings: the Account tab, Your data
- Ask us for a copy of your data, a correction, or deletion at [email protected]
Under the GDPR you also have the right to:
- Access the personal data we hold about you and get a copy
- Have inaccurate data corrected (rectification)
- Have your data erased
- Restrict how we use your data
- Receive the data you gave us, in a machine-readable format, or have it sent to another service (portability)
- Object to processing based on our legitimate interests (Art. 21; the table in section 5 says which)
- Withdraw your consent at any time. This does not affect what we did with your consent before you withdrew it.
Email [email protected]. We answer within one month. If a request is complex, or there are many, we may extend that by two more months and will tell you why within the first month. We may need to verify the request belongs to you.
You can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl. You can also complain to the authority in the EU country where you live or work, or where you think the law was broken. Residents of the UK, Switzerland and some US states have similar rights. We will not discriminate against you for exercising them.
12. Children
UGC.Place is for adults. You must be at least 18 to create an account or list a profile. Login Kit does not tell us your age, so creators confirm 18+ before listing. We do not knowingly collect personal data from anyone under 18. If you think we have, email [email protected] and we will delete it.
13. International transfers
We operate from Poland. Some of our processors are outside the European Economic Area (EEA) or are owned by companies outside it:
- Anthropic (United States): the automated abuse checks on text
- Stripe (United States): sponsor payments
- Cloudflare (United States): our content network, the bot check on the sign-in email form, and storage for photos, video covers and sponsor logos (kept in Cloudflare’s EU jurisdiction)
- Microsoft (Azure, EU region) for image checks, PostHog (EU servers) for analytics, and Zoho (EU data center) for email: data is processed in the EU, but their parent companies are outside it
Transfers to the United States rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses. Other transfers out of the EEA or UK rely on those clauses too. You can ask [email protected] for a copy of the safeguards.
TikTok is a global service; data you authorize them to send us may cross borders under TikTok’s developer data terms. Google, when you sign in with it, and TikTok, Instagram and YouTube, when you play a video, act as their own controllers.
14. US state privacy rights
If you are a US resident covered by a state privacy law (including California’s CCPA/CPRA), you may request to know, access, correct, or delete personal information, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising, including TikTok Login Kit data. We do not use sensitive personal information to infer characteristics beyond the optional filters you set. To exercise rights, email [email protected]. You may use an authorized agent as those laws allow.
15. Contact
Privacy requests: [email protected]
Site: https://ugc.place
Related: Terms of service
16. Changes
We will update this page when our practices change (for example a new service provider or a new TikTok scope). The “Last updated” date at the top will change. Material changes will be highlighted on this page or sent to an email we have for you.
Current version: 29 October 2026.
This page describes how UGC.Place works. It is not legal advice. If a mandatory consumer or privacy law in your country gives you rights this page does not list, those rights still apply.