Privacy Policy

1. Who we are & how to contact us

Controller: VM MEDIA LLC, trading as MabrookUGC, Sharjah Media City (Shams), Sharjah, United Arab Emirates.
Licence No.: 2322072.01
Privacy contact: support@mabrookugc.com — please use the subject line "Privacy request".

Data Protection Officer: we have not appointed a Data Protection Officer (DPO). Our privacy contact is support@mabrookugc.com. We are assessing whether we are required to appoint one; if we appoint a DPO, we will publish their contact details here.

1.1 Our role

• We are the controller for the website, creator and brand accounts, the marketplace, messaging, payouts, invoicing and our own marketing.
• Brands are independent controllers for the creator data they receive through MabrookUGC (for example to select a creator, run a project and use delivered content). Their obligations are set out in Section 18 of our Brand Terms.
• We act as a processor for a brand only where we provide a processing service on the brand's behalf, such as managed campaign services or Spark Ads management on the brand's ad account. That processing is governed by Schedule 1 (Data Processing Schedule) of the Brand Terms, and the brand's own privacy notice applies to it.

"Controller" and "processor" in this policy mean the roles defined in the UAE Personal Data Protection Law and the Saudi Personal Data Protection Law.

1.2 Regulators

In the UAE, the data protection regulator is the UAE Data Office. In Saudi Arabia, it is the Saudi Data & Artificial Intelligence Authority (SDAIA). Section 10.5 explains how to complain.

1.3 Short notices

Our brand and creator sign-up forms show a short collection notice below the terms checkbox that links to this policy, and the email inviting a team member to a brand account carries a privacy notice. These short notices summarise; this policy contains the full information.

2. Laws that apply

• UAE: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL").
• Saudi Arabia: the Personal Data Protection Law issued by Royal Decree No. M/19, as amended by Royal Decree No. M/148 (the "Saudi PDPL"), its Implementing Regulation, and the Regulation on Personal Data Transfer outside the Kingdom. These apply when we process personal data of people residing in Saudi Arabia, such as Saudi creators, staff of Saudi brands and visitors from Saudi Arabia.
• EU / UK: our Services are aimed at the GCC, Egypt and Türkiye, not at the EU or UK. If the GDPR or UK GDPR nevertheless applies to a particular processing activity, you have the rights those laws give you.
• Other countries: if another data protection law applies to our processing of your data (for example because you are a creator in Egypt or Türkiye), this policy does not reduce the rights that law gives you.

We do not rely on "legitimate interests" as a general legal basis. For each activity, Section 5 names the specific basis we rely on. Where Section 5 names legitimate interest for a specific activity under the Saudi PDPL, we rely on it only after a documented assessment that the processing does not prejudice the rights and interests of the people concerned and does not involve sensitive data.

3. What we collect

3.1 Creators

• Account: first and last name, email address, password (stored only in hashed form by our authentication provider) or your Google sign-in.
• Application: country, gender, phone number (used for project updates), TikTok handle or profile link, follower range, referral code (if another creator invited you), and your self-declaration that you are 18 or older.
• Advertising permit (only if you add it): permit number, expiry date and, if you choose to upload it, the permit certificate as a PDF, kept in private storage. It is optional at sign-up and needed only for Spark projects (a UAE Media Council Advertiser Permit for creators resident in the UAE; a Mawthooq licence for creators resident in Saudi Arabia). You can add it in your profile or directly on a Spark project, and it is saved to your profile.
• Profile: profile photo (required before your profile is shown to brands; see Section 11 on how it is stored), bio, city, niche, price, birth year (optional, used only for brands' age-range filters), TikTok One Pay email, and portfolio videos.
• TikTok statistics: performance figures calculated from your public TikTok videos, such as median views and engagement.
• Project work: project applications, delivered videos and draft versions, chat messages and voice notes, your shipping address (only for projects where a brand ships you a product), reviews and ratings, and records of strikes and conduct.
• Payouts: beneficiary name, IBAN and postal address (encrypted, see Section 11), and your payout history.

3.2 Brand users

• Account and company: company name, website, country, contact name, email address, phone number, logo, and password (hashed) or Google sign-in.
• Team members: the email addresses of colleagues a brand invites, and their account details once they join.
• Projects and orders: briefs, product information, orders and package requests, invoices and payment status, chat and support messages, and reviews you leave about creators.
• Terms acceptance evidence: see Section 5 (row "Terms acceptance evidence").
• Marketing choice: whether you ticked the optional marketing box, and when.

3.3 Website visitors and portal users

• Technical request data in our hosting provider's logs: IP address, browser and device type, the page requested and the time.
• Your cookie choice and, only if you accept advertising cookies on our website, the data the TikTok pixel collects (Section 12).
• When your browser loads fonts, images or a script library, Google Fonts, Framer (images on our public website) and jsDelivr receive your IP address and browser details (Section 7).

3.4 People who contact us through in-platform chat, support tickets or email

• Your name, email address, the messages you send us and any files you attach.
• We no longer use WhatsApp. Messages exchanged before 22 September 2026 (with the phone number and WhatsApp profile name they came from, and any answers to our former automated questions for campaign enquiries) are kept for up to 12 months and then deleted.

3.5 Sensitive data

We do not ask for sensitive data such as health, religion or ethnic origin. Videos and briefs can nevertheless reveal such details; please do not include them unless they are necessary for the project. We do not infer sensitive characteristics about creators, and we do not use face or voice templates to identify anyone.

4. Where we get your data

• From you: forms, uploads, in-platform chat, support tickets and email.
• From sign-in providers: if you choose "Continue with Google", Google gives us your name, email address and profile picture. Where TikTok account linking is enabled and you choose to use it, TikTok gives us the basic account information you authorise.
• From TikTok's public data: the list of your public videos, from which we calculate statistics such as median views and engagement, and embeds of public videos shown in our portals.
• Profiles prepared before sign-up: we do not currently do this, but if our team prepares a draft creator profile from information a creator has made public (such as a public TikTok handle) or has sent us, before the creator signs up, the following applies. We tell the creator about the profile and this policy at our first contact, and in any case within 30 days after we collect the data. If the creator does not sign up, we delete the profile within 90 days after collection. If we hold such a profile about you, you can ask us to delete it at any time (Section 5).
• From brands: team member email addresses a brand invites, and reviews and ratings a brand gives a creator.
• From other creators: a referral code, if another creator invited you.
• From Stripe: payment status and transaction references for card payments.
• From our team: application decisions, quality ratings, strikes and conduct notes.

5. Purposes & legal bases

The table below lists each activity, the people it concerns, the data used, where it comes from, whether you must provide it (and what happens if you don't), the legal basis, who receives it and how long we keep it. "Contract" means the processing is necessary to perform our contract with you or to take steps you ask for before entering into it.

Promotion of the MabrookUGC platform: under Section 8.4 of the Creator Terms, MabrookUGC may use videos delivered through the platform, including the creator's name, image and voice as they appear in them, on its own website, social media accounts, sales materials and advertising of the MabrookUGC platform, including paid ads promoting MabrookUGC. We do not sell or license these videos to third parties under this right. We do not use a video before the brand's campaign is public unless the brand agrees, and a brand can ask in writing for a reasonable delay, for example for a confidential launch. We remove a video from our own channels on a lawful takedown request, including a valid request based on your data protection rights where the law gives you one, or where a safety or legal reason applies; sales materials already shared cannot be recalled. Videos delivered under Orders that stay under an earlier version of the Creator Terms are used only as that version allowed.

6. Creator profiles: who sees what

Creator profiles are not public on the open web and are not indexed by search engines. Only brands approved by MabrookUGC can browse creators. Note, however, that profile photo and portfolio video files are stored in public storage: anyone who has the exact link to such a file can open it (Section 11).

1. Creator list: approved brands see your name, profile photo, city, country, niche, gender, follower count or range, rating, Spark-verified badge, TikTok handle, join date, price and TikTok performance statistics.
2. Full profile: when a brand opens your profile, it also sees your bio, engagement, portfolio videos, reviews and whether you have an advertising permit on file (shown only as "permit on file (self-declared)", not the permit itself).
3. Project: when you work on a brand's project, that brand sees your messages in the project chat and receives the videos you deliver.
4. Product shipping: only after a brand selects you for a project where it ships you a product, that brand receives your shipping address.

Brands never see your email address, phone number, birth year (brands can filter by age range but never see your birth year), permit file, permit number or permit expiry date, or bank details.

Each brand is an independent controller for the creator data it receives and must follow Section 18 of the Brand Terms, which, among other things, forbids building advertising audiences from creator data, facial recognition, inferring sensitive characteristics, selling creator lists, cloning a creator's likeness and using creator data to train AI models. If you think a brand has misused your data, tell us at support@mabrookugc.com.

7. Who receives your data

A processor handles data on our instructions. An independent controller decides for itself how it uses the data it receives, under its own privacy notice.

We do not sell personal data and do not rent creator lists.

8. International transfers

Your data is stored in India (Supabase on Amazon Web Services, Mumbai region) and is accessed by our team from the UAE. Our providers also process data in the USA (Vercel, Resend, Anthropic, Stripe, Meta, Google and Apple) and in other countries where they operate; Vercel serves pages from a global edge network. Brands that receive creator data are located in the UAE, Saudi Arabia and other GCC countries. For people in Saudi Arabia, this means their data is transferred outside the Kingdom.

These transfers rely on our providers' data processing terms and the contractual safeguards they contain. We are completing our assessment under the Saudi Regulation on Personal Data Transfer outside the Kingdom and under the UAE PDPL's transfer rules, and will update this section with the outcome. We do not ask you to consent to transfers in place of these safeguards.

9. How long we keep data

Project closure means the date on which all content under a project order has been approved or deemed accepted and all related payments and refunds have been settled, or the project has been cancelled and settled (as defined in Section 18 of the Brand Terms). The Spark licence period is the period during which a brand may run a creator's post as Spark Ads: 30 days from the day the creator provides the Spark code, or a longer period recorded on the order (Section 7 of the Brand Terms and Section 8 of the Creator Terms). For Dark UGC, the rights in the delivered video pass to the brand once the order is paid in full. For orders under earlier versions of those terms, the licence term recorded under that version applies.

We apply these retention periods through scheduled deletion jobs where available and otherwise through a documented monthly manual review.

Legal hold: we keep data longer than stated above only where it is needed for a specific claim, investigation or legal requirement, with documented approval, limited to the data concerned and only until the hold is released.

10. Your rights

10.1 What you can ask

• to be informed about how we process your data (this policy);
• to access your data and receive a copy;
• to correct inaccurate or incomplete data;
• to have your data deleted, subject to the records we must keep (Section 9);
• to restrict or object to processing, including direct marketing;
• to receive your data in a structured, machine-readable format where the applicable law provides for it;
• to withdraw consent at any time where we rely on consent, without affecting processing already carried out;
• to ask for a person to review a decision (see Section 14 — we make no decisions with legal effect solely by automated means).

10.2 How to exercise them

Email support@mabrookugc.com with the subject line "Privacy request". To ask us to remove a video from MabrookUGC's own channels, use the subject line "Takedown request". Anyone can change their cookie choice via "Cookie settings".

10.3 Identity checks

Our checks are proportionate. Usually we ask you to write from the email address on your account or to confirm the request while logged in. We do not ask for copies of identity documents by default.

10.4 Deadlines

• Saudi Arabia: within 30 days. We extend this by up to a further 30 days only where the Saudi rules allow it, for example because the request is complex or we have received a large number of requests, and we tell you before the first 30 days end, explaining why.
• UAE: within the period set by the UAE PDPL and its implementing rules.
• EU / UK (only if those laws apply): within one month, extendable only as those laws allow.
• Our service target for everyone: 30 days.

If we cannot meet a request in full, for example because the law requires us to keep a record, we tell you why. Requests about how a brand uses your data should go to that brand; we will cooperate with it and can help you reach it.

10.5 Complaints

You can complain to the UAE Data Office or, if the Saudi PDPL applies to you, to SDAIA through the complaint channels it publishes, or to another data protection authority that is competent for you. You are welcome to contact us first, but you do not have to.

11. Security

• Data is encrypted in transit between your device and our services.
• Passwords are stored only in hashed form by our authentication provider.
• Payout details (beneficiary name, IBAN and postal address) are encrypted by a dedicated function before they are stored. They are never visible to brands and cannot be sent through the platform chat.
• Revealing payout details inside our team requires an administrator account with two-factor authentication, and every reveal is logged.
• Administrator access to personal data in our database requires two-factor authentication; this is enforced by the database's access rules.
• Delivered project videos, permit certificates, voice notes and brief documents are kept in private storage and opened only through short-lived links.
• Profile photos and portfolio videos are stored in public storage: anyone who has the exact link to such a file can open it. The links are long and random, and creator profiles are not listed or indexed on the open web, but these files are not private.
• Database access rules (row-level security) separate accounts, so that each brand and each creator can reach only the data their role allows.

No system is completely secure. If you notice something that looks wrong, please tell us at support@mabrookugc.com.

12. Cookies & similar technologies

We use cookies and browser storage (localStorage). The website (www.mabrookugc.com) may use an advertising cookie, but only after you accept. Our brand and creator portals contain no advertising tags at all.

12.1 How your choice works

• On your first visit a banner offers Accept and Reject as equal choices. Before you choose, and if you reject, the TikTok pixel is not loaded and nothing is sent to TikTok.
• If you accept, the TikTok pixel receives your IP address, browser details, TikTok cookie identifiers, the page address and events such as page views. We do not use TikTok's advanced matching or Events API, and we do not send your name, email address or phone number to TikTok.
• You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of our website pages, or with the button below. On withdrawal we stop loading the pixel and delete the TikTok cookies set on our domain. Withdrawal does not affect data already sent; you can ask TikTok about that data.
• We record each choice (grant, refusal, withdrawal) with a random ID that is not linked to your account, together with the notice version, language and page, as evidence of your choice.

Cookie settings

Loading our fonts from Google Fonts, some website images from Framer (framerusercontent.com) and a script library from jsDelivr sends your IP address and browser details to those providers (Section 7). Our stylesheet is loaded from css.mabrookugc.com, which is our own. Blocking essential storage in your browser may stop the portals from working.

13. Artificial intelligence (AI)

We use the Anthropic API (USA) for two features only:

1. Translation of in-platform chat and support messages for our team. An administrator can press a button in our internal admin tools to translate a single chat or support message into English. Only that message is sent, only when the button is pressed, and phone numbers, IBANs and email addresses are removed before it is sent. Purpose: so that our team can understand and answer you. Legal basis: contract (providing support and communication). If a message contains information about someone who is not a party to the conversation (for example a person named in it), we translate it only to handle that conversation and do not use that information for anything else (see the row "AI translation of messages" in Section 5).
2. Optional script and hook suggestions for brands. A brand can ask for suggestions. Only the text the brand types into the brief fields is sent; we ask brands not to include personal data in those fields, and no creator records are sent. Legal basis: contract (a feature the brand chooses to use).

• Retention by Anthropic: Anthropic keeps API inputs and outputs according to its commercial terms, usually for up to 30 days. We do not promise zero retention.
• No training: under Anthropic's commercial terms, this data is not used to train its models.
• Inputs are not training, and not likeness: entering data into prompts of AI models is different from training AI models and from generating synthetic likenesses. We do not use creators' videos, images or voices to train AI models, and we do not generate synthetic likenesses of creators.
• Human review: translations and suggestions are aids. A person reads them and decides what to do; they are never used to make decisions about you automatically.

14. Automated decisions & ranking

We make no decisions with legal or similarly significant effects about you based solely on automated processing.

• Ranking and filtering: creator lists are sorted and filtered using country, gender, age range, followers, price and performance statistics. Brands choose the filters; the order in which creators appear can affect how likely they are to be chosen.
• Tiers: creators may be placed in tiers based on their track record.
• Strikes: a creator with two or more strikes is automatically flagged for review by our team. There is no automatic ban; a person decides.
• Applications are reviewed by our team.

You can ask us how these features affect you and ask for a person to review any outcome.

15. Marketing messages

• We send promotional messages by email only with your consent. The consent box is unticked, optional and not a condition for opening an account.
• You can withdraw at any time with the unsubscribe link in any marketing email, by telling us in the in-platform chat or a support ticket, or by writing to support@mabrookugc.com. We then keep a minimal suppression record so that we do not contact you again.
• Service messages are separate and are not marketing: account and security messages, project updates and invitations to projects, payout and invoice notices, and notices of changes to our terms or this policy. We send them because they are part of the Services.

16. Children, minors & people in videos

• Adults only: accounts are for people aged 18 or older, who confirm this when they apply. If we learn that an account belongs to someone under 18, we close it and delete the data.
• No minors in content: no identifiable person under 18 may appear in content submitted through MabrookUGC. If such content is submitted, we remove it.
• Bystanders and co-performers: a creator must have the permission of every other identifiable person who appears in a video. A creator's acceptance of our terms does not cover anyone else. If you appear in a video without having agreed, contact us and we will look into it.

17. Personal data breaches

A personal data breach is a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

• UAE: we notify the UAE Data Office and affected individuals as the UAE PDPL requires.
• Saudi Arabia: where the threshold in the Saudi rules is met, we notify SDAIA within 72 hours of becoming aware of the breach, and notify affected individuals without undue delay where required.
• Other laws: we notify as those laws require.
• Brands: where we act as a brand's processor, we notify the brand without undue delay and at the latest within 24 hours of becoming aware, with a preliminary notice if the facts are not yet complete and updates after that. Brands must notify us within the same period of a breach affecting creator data.

We do not wait for an investigation to be complete before notifying where notice is required.

18. Changes, language & governing law

• Changes: we will tell you about changes that reduce your rights or add new purposes of processing by email or a clear notice in the Services at least 14 days before they apply to you. An updated policy does not by itself waive any right you have under mandatory law or authorise a new purpose of processing: where a new purpose needs your consent or another legal basis, we obtain that consent or establish that basis before the processing starts. Clarifications, and changes that do not reduce your rights, may apply at once. The version and publication date at the top show the current version. Earlier versions you accepted can be viewed in your MabrookUGC account under "Legal documents", or requested from support@mabrookugc.com.
• Language: this policy is published in English and Arabic. Both versions are intended to convey the same information. If you notice a difference, please tell us. Neither version is used to reduce the information given in the other or the rights you have under mandatory law.
• Governing law: this policy is governed by the laws of the United Arab Emirates. This does not remove any mandatory right you have under the Saudi PDPL or another law that applies to you, including the right to complain to SDAIA or another competent authority.

19. Contact

VM MEDIA LLC, trading as MabrookUGC
Sharjah Media City (Shams), Sharjah, United Arab Emirates
Licence No.: 2322072.01
Email: support@mabrookugc.com (subject line "Privacy request")