Privacy
How we handle personal data
This page sets out what Hire UGC Talent stores about you, why, who gets to see it and for how long. It describes what the site actually does. Last updated 13 September 2026.
The short version
- We store what you enter yourself: your account, profile, submissions, messages and applications. It is used to run the service, not for advertising.
- No advertising cookies, no analytics service and no tracking pixels. The cookies keep you logged in and remember who referred you.
- When a company measures sales through a tracking link we store the order number, amount and time, never the customer's name, address or email. Clicks are stored without IP addresses.
- You can ask at any time what we hold about you, and have it corrected or deleted. Email info@ugcguiden.se.
Who is responsible
The controller for Hire UGC Talent is Megasocial AB, Swedish company registration number 556794-7527. Send questions about personal data to info@ugcguiden.se.
What we store and why
Account and profile
What: Email address and password (the password is only stored encrypted by our login service), username, display name, and what you add to your profile: picture, bio, city, industries, prices, links to social media and videos you embed. If you sign up for the newsletter we store that choice and when you made it.
Why: So you can log in, show your profile to companies and other members, and take on jobs. The profile is public: it is what companies look at.
Legal basis: contract (Article 6(1)(b) GDPR). The newsletter: consent (Article 6(1)(a)), which you can withdraw at any time.
How long: for as long as the account exists. The newsletter until you unsubscribe.
The training
What: Which courses you take, which lessons you mark as done, assignments and final tests you submit, the editors' assessment, which cohort you are in and commitments you make to the cohort.
Why: To show where you are in the training, assess submissions and verify you. Commitments are visible to the others in your cohort; that is the point of them.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: for as long as the account exists
Forum and messages
What: Threads and replies you post in the forum, and messages between you and other members or companies.
Why: The forum is public. Messages are only visible to the people in the conversation. When you get a new message we send an email saying that someone has written, never what. You can turn the emails off under Edit profile.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: For as long as the account exists. Forum replies that others have answered may be de-identified instead of deleted, so that the threads still make sense.
Jobs and applications
What: Jobs that companies publish, applications you send, the company's decision, reviews after delivered jobs and the merit score calculated from lessons, jobs, reviews, films and response time.
Why: So companies and creators can find each other. The company sees your application and your profile. The merit score is shown on your profile.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: for as long as the account exists
Companies and enquiries
What: The company's name, registration number, website and contact person, which accounts belong to the company, and what is written in the enquiry form: contact person, email, phone, need, budget and timeline.
Why: To review and approve companies and to answer enquiries.
Legal basis: contract (Article 6(1)(b) GDPR). Enquiries from people without an account: legitimate interest (Article 6(1)(f)).
How long: Companies for as long as they have an account. Enquiries that lead nowhere are deleted no later than two years after the matter is closed.
The talent register
What: Name, email, city, industries, links and what you write about yourself when you sign up without an account, and whether you want the newsletter.
Why: So we can get in touch when a job suits you. Signing up lets us contact you about jobs, not send you a newsletter; that requires you to have ticked the box.
Legal basis: consent (Article 6(1)(a)), which you can withdraw at any time.
How long: Until you ask us to remove you, and no longer than two years after you signed up.
Tracking and commission
What: Tracking links and discount codes linked to a creator and a company. Clicks are counted per day using a fingerprint of the browser, language and date that changes every day: no IP address is stored and no visitor can be followed from one day to the next. From the company's checkout we only store orders carrying a creator's code, and only the order number, amount, currency and time. Disputes and payouts are stored with their reasoning.
Why: To calculate the creator's commission and our fee, and so both sides see the same figures.
Legal basis: contract (Article 6(1)(b) GDPR). Records behind payouts and invoices: legal obligation (Article 6(1)(c)), the Swedish Accounting Act.
How long: For as long as the tracking link exists. Anything behind a payout or invoice is kept for seven years after the end of the financial year, as Swedish accounting law requires.
Referrals
What: If you arrived through someone's referral link, we store who referred you when you create an account.
Why: So the person who referred you gets the credit.
Legal basis: legitimate interest (Article 6(1)(f))
How long: for as long as the account exists
The Claude connector
What: Draft jobs that a company's Claude saves with us, with the company's name, website, industry and market if Claude sends them. Companies with their own connector address can also have our search find creators for them. We then store the creators' names, published email addresses, links to their public profiles, link page and website, follower counts where shown, and the page where the address was found, and invite them to the company's job.
Why: So companies can write jobs with Claude, and so we can offer jobs to creators who have published a contact address themselves. The invitation process is described in Swedish on ugcguiden.se/inbjudan/.
Legal basis: contract (Article 6(1)(b) GDPR) (drafts), legitimate interest (Article 6(1)(f)) (invitations).
How long: Drafts for fourteen days if nobody uses them. Creators who have not been invited within 30 days are deleted, others 24 months after the most recent invitation. Anyone who declines, reports the email as spam or whose address bounces is deleted immediately, and we keep only a fingerprint of the address so it is not added again.
Who gets access
What you publish on your profile and in the forum is public. Companies see applications to their own jobs. A company using the creator search sees the names and public profiles of those found, never their addresses. The editors see what they need to assess submissions, review companies and mediate disputes. We do not sell data or hand it to advertisers.
We use these providers, which process data on our behalf:
- Supabase: database, login and uploaded images, stored in Stockholm.
- Cloudflare: hosts the site and protects it against automated traffic.
- Resend: sends the emails: notifications, password links and invitations.
- Loopia: our email, where anything you write to info@ugcguiden.se arrives.
- Telegram: the editors get a notification when an account or company registers and when a creator and a company message each other. The notification contains names and usernames, never the content of a message.
Some providers may process data outside the EU/EEA. Such transfers are to rely on the European Commission's standard contractual clauses or an adequacy decision.
When a company connects its own Claude, what they write there is handled by Anthropic under the company's own agreement with Anthropic. What we receive from Claude is handled under this policy.
Cookies
The site sets three cookies, all needed for it to work:
ug_at: keeps you logged in, valid for at most an hour and renewed automatically.ug_rt: renews your login, valid for 30 days.ug_ref: remembers who referred you, for 30 days, only if you arrived through a referral link.
Cloudflare may also set a technical cookie that tells people apart from automated traffic. The fonts are served by us, so nothing is fetched from Google. Videos from YouTube, Instagram and Facebook only load when you click them, and then that service's own terms and cookies apply.
Your rights
You have the right to know what data we hold about you and get a copy, to have incorrect data corrected, to have data deleted, to restrict how we use it, to object to processing based on legitimate interest, and to receive what you have provided in a portable format. You can withdraw consent at any time.
You can change most things yourself under Edit profile. For everything else, including deleting your whole account, email info@ugcguiden.se. We reply within a month.
If you are not happy with how we handle your data you can complain to the Swedish data protection authority, IMY, or to the authority where you live.
Security
Access is controlled in the database, row by row: you can reach your own data and what is public, not other people's. Your login is kept in cookies that scripts in the browser cannot read. Links and keys that grant access to something are stored only as fingerprints, so a leak of the database does not give access to them.
Changes
If we make a significant change to how we handle data we update this page and the date at the top. If the change affects you as an account holder we will tell you before it takes effect.