Privacy Policy

This Privacy Policy explains how Cinnamon Technology Limited, trading as MakeUGC ("MakeUGC", "we", "our" or "us"), a company registered in England and Wales under company number 15351712 with its registered office at Silverstream House, 45 Fitzroy Street, London, England, W1T 6EB, collects, uses, discloses, transfers and safeguards personal information ("Personal Information" or "Personal Data") obtained from individuals who access or use our websites, software, applications, APIs, integrations and associated digital platforms (collectively, the "Services").

MakeUGC is the controller of Personal Information relating to visitors, Account holders, Trial users, subscribers, prospects and business contacts. Where you upload personal data of other people into the Services (for example, Likeness Material to create a Custom Avatar or Custom Voice, customer lists or product reviews), you are the controller of that data and MakeUGC acts as your processor under the Data Processing Addendum (see Section 15). Enterprise customers under a signed agreement are governed by that agreement where it conflicts with this Policy.

This Policy forms part of our Terms of Service. Capitalised terms not defined here have the meaning given in the Terms of Service. By using the Services you acknowledge that you have read this Policy. Where we rely on consent, we will ask for it separately.

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

• Account and identity information: name, email address, telephone number, company name, job title, country, username, password (hashed), profile photo and any identity or business verification documents we request to prevent fraud or Trial Abuse.
• Billing information: billing address, VAT or tax number, payment method details (processed by our payment processors; we store only the card brand, last four digits, expiry and a processor token), transaction history, invoices, refund and chargeback records.
• Content you submit (Input): scripts, prompts, product descriptions, URLs, brand assets, images, video, audio, voice samples, photographs, documents, ad accounts you connect, and any Personal Information contained in them. Input may include Likeness Material of you or of third parties (see Section 4).
• Communications: the contents of emails, support tickets, live chat, WhatsApp or other messages, sales and onboarding calls (which may be recorded or transcribed with notice), feedback, survey responses and reviews.
• Done-For-You and managed services: briefs, creative direction, target audiences, performance results and any other information you share so that we can produce content for you.
• Referral and affiliate information: referrer identity, payout details and promotional usage.

1.2 Information Collected Automatically

• Technical information: IP address, approximate location derived from IP, browser type and version, operating system, device type and identifiers, screen resolution, language, time zone, referring and exit URLs, access times, pages viewed, links clicked and crash logs.
• Usage data: features used, generations requested, models selected, Avatars and Voices chosen, Credits consumed, templates used, projects created, downloads, exports, API and MCP calls, session duration and navigation patterns.
• Output metadata: prompts, settings, timestamps, model identifiers, watermarks and identifiers embedded in Output, and the Output itself.
• Fraud and security signals: device fingerprints, payment-method fingerprints, VPN and proxy detection, email-domain reputation, velocity data and other signals used to detect multiple accounts, Trial Abuse, chargeback fraud and unauthorised access.
• Cookies and similar technologies: see Section 6.

1.3 Information from Third Parties

• Social and sign-in providers: when you sign in with Google or another provider, or interact with us on LinkedIn, X, YouTube, Instagram, TikTok or similar platforms, we receive your name, email, profile image, public profile data and interaction data, subject to those platforms' policies.
• Connected platforms: where you connect Shopify, Meta, TikTok, Google or other ad or commerce accounts, we receive the store, catalogue, ad account, campaign and performance data you authorise.
• Data enrichment and lead sources: business contact data from public sources, data providers and partners for B2B marketing.
• Payment processors and fraud-prevention providers: payment outcome, risk scores and dispute information.
• Affiliates, resellers and agencies: where they create or manage your Account.

1.4 Aggregated and De-identified Data

We create aggregated statistics and de-identified datasets (including de-identified Output and advertising performance datasets) that cannot reasonably be used to identify you. We may use, retain, license and disclose such data for any purpose, indefinitely, and commit not to attempt to re-identify it.

2. HOW WE USE YOUR INFORMATION AND OUR LEGAL BASES

Under UK GDPR and EU GDPR we must have a lawful basis for each use. The table sets out each purpose and the basis we rely on.

Where we rely on legitimate interests we have assessed that our interests are not overridden by your rights. You may object at any time (Section 10). We do not make decisions producing legal or similarly significant effects on you based solely on automated processing, except automated fraud and Trial Abuse detection, which you may contest by contacting help@makeugc.ai for human review.

3. USE OF AI, MODEL TRAINING, OUTPUT AND OPTING OUT

3.1 How the Services use AI. The Services generate Output using our own systems together with third-party generative AI models and inference providers. Your Input and the resulting Output are transmitted to those providers to generate Output. Our current categories of providers are listed in Section 5.3 and the sub-processor list in the Data Processing Addendum.

3.2 Training and improvement. We use Input, Output, prompts, settings, usage data and your feedback (including ratings, regenerations, edits and performance results you share) to train, fine-tune, evaluate and improve our models, classifiers, templates, Avatars, Voices and recommendation systems, and may permit our model providers to do so under contract. This may include human review of a sample of Content by our staff or contractors under confidentiality obligations.

3.3 Use of Output. Under Section 3.3 of the Terms of Service you grant MakeUGC a licence to use Output generated on the platform, including for marketing, showcases, templates, model training and licensing to third parties. Where Output contains Personal Information (for example, your voice, your face or a named person), we rely on that licence together with the legal bases above, and on your warranty that you obtained any necessary consent from the people depicted. We will not use a Custom Avatar or Custom Voice to generate new content for other customers or for our own marketing without your separate written consent.

3.4 Opting out of training. You may opt out of your Personal Information being used to train our AI models by emailing help@makeugc.ai from your Account email with the subject "Training opt-out". The opt-out applies prospectively to Personal Information only; it does not apply to de-identified data, to Output already incorporated into models or datasets, to usage data, or to the Output licence in the Terms of Service. Opting out may reduce personalisation and quality. Enterprise customers may negotiate contractual exclusions.

3.5 Synthetic content. Output depicting people is synthetic. We embed visible or invisible watermarks, content credentials or identifiers in some Output to support provenance, abuse investigation and compliance with the EU AI Act and platform policies, and we may retain the associated metadata.

4. AVATARS, VOICES AND BIOMETRIC DATA

4.1 What we process. Creating a Custom Avatar or Custom Voice requires us to process photographs, video, audio and voice samples and to derive facial geometry, body and movement models and voiceprints. In some jurisdictions these derived identifiers are biometric data or special-category data (UK GDPR and GDPR Article 9; Illinois BIPA; Texas CUBI; Washington MHMDA; CCPA sensitive personal information).

4.2 Your own likeness. Where you upload your own Likeness Material, we process it on the basis of your explicit consent, which you give when you start the Custom Avatar or Custom Voice flow and which you may withdraw by deleting the Avatar or Voice from your Account or contacting us. Withdrawal does not affect processing already carried out or Output already generated.

4.3 Third-party likeness. Where you upload Likeness Material of another person (an employee, a creator, a client or a model), you are the controller and must obtain that person's written, informed consent, including to biometric processing, before uploading. We process it as your processor. We may require you to produce evidence of consent at any time.

4.4 Retention of biometric identifiers. Derived biometric identifiers are retained for as long as the Custom Avatar or Custom Voice exists in your Account, and are deleted within 30 days of you deleting the Avatar or Voice or closing your Account, except where retention is required to investigate abuse or comply with law. The underlying Output remains subject to the Output licence.

4.5 Stock Avatars and Voices. Stock Avatars and Voices are created from licensed actors and voice artists or are fully synthetic. We hold the releases from those individuals. You may not use a stock Avatar or Voice to impersonate the underlying person.

4.6 Prohibited processing. We do not knowingly create Avatars or Voices of minors, of public figures without consent, or for sexual, political-disinformation or deceptive purposes, and we remove such content when identified.

5. DISCLOSURE OF PERSONAL INFORMATION

5.1 Service providers and sub-processors. We share Personal Information with vendors who process it on our behalf under written contracts: cloud hosting and storage (Amazon Web Services, Google Cloud), AI model and inference providers, payment processors (Stripe and others), fraud-prevention and identity-verification providers, email, SMS and messaging delivery, customer-support and live-chat tools, CRM and sales-engagement tools, analytics and product-telemetry tools, session-replay tools, affiliate-tracking platforms, accounting and tax advisers, and legal advisers. Our current sub-processor list is in the Data Processing Addendum and available on request.

5.2 AI model providers. Input and Output are transmitted to third-party model providers to generate Output. These providers may be located outside the UK and EU. Where contractually possible we prohibit them from using your Content to train their models; some providers process Content on a zero-retention basis and others retain it for abuse monitoring for limited periods.

5.3 Connected platforms. Where you connect Shopify, Meta, TikTok, Google, Amazon or other platforms, or publish Output to them, we share the data necessary to complete the integration, and those platforms process it under their own policies.

5.4 Data partners and licensees. Consistent with Section 3.3 of the Terms of Service, we may license Output, Input embodied in Output, and datasets derived from them (including communications, usage and performance data in de-identified form) to third parties such as AI developers, research organisations and data partners. Where such data includes identifiable Personal Information we rely on your warranty that necessary consents were obtained and on the legal bases in Section 2.

5.5 Showcases and marketing. Output and your company name and logo may be displayed publicly in galleries, templates, case studies, advertisements and sales materials.

5.6 Business transfers. In connection with any financing, due diligence, merger, acquisition, reorganisation, sale of all or part of our business or assets, or insolvency, Personal Information may be disclosed to prospective and actual counterparties and their advisers under confidentiality obligations, and transferred to the successor.

5.7 Affiliates and group companies. Personal Information may be shared with our Affiliates for the purposes in this Policy.

5.8 Legal, safety and enforcement. We disclose Personal Information where required by law, court order, subpoena or regulatory request; to enforce our Terms and investigate violations; to detect and prevent fraud, Trial Abuse and chargeback abuse (including sharing with payment networks and fraud consortia); to respond to likeness, copyright or abuse complaints, including disclosing Account details to a complainant or law enforcement where lawful; and to protect the rights, property or safety of MakeUGC, our Users or the public.

5.9 Organisation administrators. If your Account is part of a business workspace, the administrator may access your Account data and Content.

5.10 With your direction. We share Personal Information with third parties when you direct us to, for example by sharing a project link or inviting a collaborator.

5.11 Sale and sharing. We do not sell Personal Information for money. Under certain US state laws, use of advertising cookies and licensing of datasets may be treated as a "sale" or "sharing"; Section 11 explains how to opt out.

6. COOKIES AND TRACKING TECHNOLOGIES

We and our partners use cookies, pixels, SDKs, local storage and similar technologies for: (a) strictly necessary purposes, such as authentication, security, fraud prevention, load balancing and remembering your settings, which do not require consent; (b) analytics and performance, to understand how the Services are used; (c) functionality, such as live chat and session replay; and (d) advertising and attribution, including Meta, Google, TikTok, LinkedIn and affiliate-tracking pixels that measure the effectiveness of our campaigns and attribute sign-ups to referrers.

Where required by PECR, the ePrivacy Directive or local law, we obtain your consent through our cookie banner before setting non-essential cookies, and you may withdraw it at any time via the cookie settings link in the footer. You may also control cookies through your browser; disabling them may impair the Services. We honour Global Privacy Control signals where legally required. We do not currently respond to other "Do Not Track" signals.

7. INTERNATIONAL DATA TRANSFERS

We are based in the United Kingdom. Our team, contractors and sub-processors operate in the United Kingdom, the European Union, the United States, Israel, Vietnam, India, the Philippines, Cyprus and other countries, and your Personal Information will be transferred to and processed in those countries, some of which do not provide the same level of data protection as the UK or EU.

Where we transfer Personal Information out of the UK or EEA we rely on: UK adequacy regulations and EU adequacy decisions (including for the EU and Israel); the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; the EU Standard Contractual Clauses; the UK Extension to the EU-US Data Privacy Framework and the EU-US Data Privacy Framework for certified US recipients; and, where none of the above applies, the derogations in Article 49 (including performance of a contract and your explicit consent). We carry out transfer risk assessments and apply supplementary measures where needed. You may request a copy of the relevant safeguards at privacy@makeugc.ai.

8. DATA RETENTION

We retain Personal Information only as long as necessary for the purposes in this Policy, to comply with legal, tax and accounting obligations, to resolve disputes and to enforce our agreements. Indicative periods:

When data is no longer required we securely delete or irreversibly anonymise it. Backups are overwritten on a rolling basis of up to 90 days.

9. SECURITY

We implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication for internal systems, network segmentation, logging and monitoring, vulnerability management, vendor due diligence, confidentiality obligations for staff and contractors, and an incident-response plan. No method of transmission or storage is completely secure and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for the security of devices you use to access the Services.

Where a personal data breach is likely to result in a risk to individuals, we will notify the Information Commissioner's Office (and other competent authorities) within 72 hours of becoming aware, and affected individuals or controller customers without undue delay, as required by law.

10. YOUR RIGHTS (UK AND EU)

If you are in the UK or EEA you have the right to: access your Personal Information and receive a copy; rectify inaccurate or incomplete data; erase data in certain circumstances; restrict processing in certain circumstances; object to processing based on legitimate interests, and to direct marketing at any time; data portability of data you provided, in a machine-readable format; withdraw consent at any time without affecting prior processing; and not to be subject to solely automated decisions with legal or similarly significant effects.

To exercise these rights email privacy@makeugc.ai or help@makeugc.ai from your Account email. We may ask you to verify your identity. We respond within one month, extendable by two further months for complex or numerous requests, and we will tell you if we extend. Requests are free unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse. These rights are not absolute: for example, we may retain data needed for legal obligations, fraud prevention, defence of claims, or where Output has been licensed under the Terms of Service.

You have the right to complain to the UK Information Commissioner's Office (ico.org.uk, +44 303 123 1113) or, in the EEA, to the supervisory authority of your residence, workplace or the place of the alleged infringement. We would appreciate the chance to address your concerns first.

11. UNITED STATES STATE PRIVACY RIGHTS

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Iowa, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or another state with a comprehensive privacy law, you may have the right to: confirm whether we process your personal information and access it; correct inaccuracies; delete it; obtain a portable copy; opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects; limit the use of sensitive personal information; and not be discriminated against for exercising your rights.

Categories collected and disclosed. In the preceding 12 months we collected the categories in Section 1 (identifiers, commercial information, internet activity, geolocation, audio and visual information, biometric information where you create a Custom Avatar or Voice, professional information and inferences). We disclosed them to the recipients in Section 5 for business purposes. We may "share" identifiers and internet activity with advertising partners for cross-context behavioural advertising, and may "sell" de-identified Output datasets in the sense used by some state laws.

How to exercise. Email privacy@makeugc.ai with the subject "US privacy request", or use the cookie settings link to opt out of targeted advertising. We honour Global Privacy Control. We will verify your identity by matching information to our records and may request additional information. You may designate an authorised agent with written permission. We respond within 45 days, extendable once by 45 days. If we deny a request you may appeal by replying to our decision; we will respond to the appeal within 45 days (60 days in some states), and you may contact your state Attorney General if the appeal is denied.

Notice of financial incentive. Referral credits and promotional discounts may constitute a financial incentive under California law; you may opt in by participating and withdraw at any time by emailing us.

Shine the Light. California residents may request a list of third parties to whom we disclosed personal information for their direct marketing; we do not do so.

12. OTHER JURISDICTIONS

Israel. If you are in Israel, we process your data in accordance with the Protection of Privacy Law 5741-1981 and its regulations. You have rights of access and rectification under that law, and you may contact our privacy contact to exercise them.

Brazil. If you are in Brazil, we process your data in accordance with the LGPD; you may exercise the rights in Article 18 by contacting us, and may complain to the ANPD.

Canada. If you are in Canada, we process your data in accordance with PIPEDA and applicable provincial law; you may withdraw consent and complain to the Office of the Privacy Commissioner.

Australia. If you are in Australia, we handle your data in accordance with the Privacy Act 1988 and the Australian Privacy Principles; you may complain to the OAIC.

Other countries. Where local law grants you rights not listed here, we will honour them on request to the extent they apply to us.

13. CHILDREN

The Services are intended for adults and businesses only. We do not knowingly collect Personal Information from anyone under 18, and we do not knowingly permit the creation of Avatars or Voices depicting minors. If you believe a person under 18 has provided us with Personal Information or appears in Content, contact help@makeugc.ai and we will delete it and terminate the associated Account.

14. MARKETING COMMUNICATIONS

We may send you marketing by email, in-app message, SMS, WhatsApp or telephone about our Services, features, offers and events, including onboarding sequences for new sign-ups, re-engagement and win-back campaigns, upsell offers, payment-recovery reminders and founder outreach. We rely on legitimate interests for business contacts and existing or trial customers (the "soft opt-in" under PECR), and on consent where required by law. You may opt out at any time via the unsubscribe link, by replying STOP to a message, or by emailing help@makeugc.ai. Opting out does not stop service messages necessary for your Account, such as billing, security, trial-expiry and legal notices.

15. MAKEUGC AS PROCESSOR AND THE DATA PROCESSING ADDENDUM

Where you upload Personal Information of third parties (including Likeness Material, customer lists, reviews, product data or ad-account data), you are the controller and we process it only on your documented instructions as set out in our Data Processing Addendum, which is incorporated into the Terms of Service. The Data Processing Addendum covers subject matter and duration, sub-processors and notification of changes, confidentiality, security, assistance with data-subject requests and impact assessments, breach notification, deletion or return at the end of the services, and audit rights. You are responsible for having a lawful basis, providing notices and obtaining consents (including explicit consent for biometric processing) before uploading such data, and for responding to the data subjects' rights requests; we will assist as the Data Processing Addendum provides.

16. THIRD-PARTY LINKS AND PLATFORMS

The Services may contain links to, or integrate with, third-party websites, platforms, payment processors and tools. We are not responsible for their privacy practices or content. Review their privacy policies before providing Personal Information. Output published to third-party platforms is governed by those platforms' policies.

17. CHANGES TO THIS POLICY

We may update this Policy at any time. We will post the revised Policy with a new Effective Date and, where the change materially affects how we use your Personal Information or is otherwise legally required, notify you by email or in-product notice before it takes effect. Continued use of the Services after the Effective Date constitutes acknowledgement of the revised Policy; where consent is required for a new use, we will ask for it.

18. CONTACT AND COMPLAINTS

• Controller: Cinnamon Technology Limited (trading as MakeUGC), company number 15351712
• Registered office: Silverstream House, 45 Fitzroy Street, London, England, W1T 6EB, United Kingdom
• Privacy contact: privacy@makeugc.ai
• General: help@makeugc.ai

We have not appointed a statutory Data Protection Officer; our privacy contact handles all data-protection enquiries. Where required under Article 27 GDPR we will appoint an EU representative and publish their details here. We aim to acknowledge privacy requests within 2 business days and resolve them within the statutory periods above.