Checkout v2 privacy addendum, effective 6 August 2026
For checkout v2 Orders, CLOSYA processes the Brand's billing country, service-recipient country, declarations about any UAE establishment and where the service is received, and any VAT number supplied. This tax information is provided by the Brand and retained by CLOSYA to calculate the quote, apply the legally configured VAT treatment, issue records, prevent fraud and meet tax and accounting duties. It is not described as independently verified.
We also retain the exact Order quote, payment authorization and capture identifiers and statuses, Creator payout destination details, provider references, amounts, currencies, fees and timestamps. Stripe processes card details directly. Authorized CLOSYA personnel may access payout destination details only as needed to execute or reconcile a Creator transfer. A restricted per-Order destination copy is frozen when a payout is claimed; its full account identifier is redacted after that payout is recorded as paid, while limited ledger evidence may remain. Payment and payout providers receive the information necessary to perform their services. Retention follows applicable law and the approved retention and privacy policy, including where legal, tax, accounting, fraud-prevention or dispute records must survive account deletion.
This Privacy Policy explains how CLOSYA FZ-LLC (RAKEZ licence no. 47030623, Ras Al Khaimah, UAE), operating the UGC MATCH platform, collects, uses and protects your personal data.
1. Data controller
The data controller is CLOSYA FZ-LLC, Compass Building, Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. Contact: support@ugcmatch.io.
2. Data we collect
Account data (email, role, password hash); profile data you provide (name, bio, location, social handles, portfolio, company details); transaction data (orders, briefs, messages, deliverable metadata); Creator payout and bank-destination details; and technical data (log and usage information). CLOSYA stores Creator payout destinations under restricted access. When an authorized operator claims a payout, CLOSYA freezes a per-Order copy for execution and reconciliation; once that payout is recorded as paid, the full account identifier in that snapshot is redacted while limited ledger evidence, including the last four characters, may remain. Retention is subject to applicable law and the approved retention and privacy policy. We do not store full payment card details; card data is handled directly by Stripe.
3. How we use your data
To operate the Platform and your account; to process orders, payments and payouts; to enable messaging and notifications between Brands and Creators; to provide support; to prevent fraud and abuse; and to comply with legal obligations.
4. Service providers (processors)
We share data with trusted providers only as needed to run the Platform: Supabase (database, authentication, file storage), Stripe (card payments, refunds and disputes), and, only when a payout provider has been approved, that approved payout provider (payout execution and reconciliation), Resend (transactional email), Vercel (hosting), and Upstash (rate limiting). Each processes data under its own terms and security measures.
5. Sharing with other users
When you transact, the other party to an Order sees the information needed to complete it (e.g. your display name, brief, messages and deliverables). We do not sell your personal data.
6. Cookies
We use strictly necessary cookies for authentication and session management, and a preference cookie to remember your language (NEXT_LOCALE). We do not use advertising or cross-site tracking cookies.
7. Retention
We keep personal data for as long as your account is active and as required to provide the service, resolve disputes, and meet legal, tax and accounting obligations. You may request deletion (see your rights below).
8. Your rights
Subject to applicable law, you may request access to, correction, deletion or a copy of your personal data, and object to or restrict certain processing. To exercise these rights, contact support@ugcmatch.io.
9. International transfers and security
The Platform is operated from the UAE and uses providers that may process data in other regions; we rely on those providers’ safeguards. We apply reasonable technical and organisational measures (encryption in transit, access controls, row-level security) to protect your data, but no system is perfectly secure.
10. Children
The Platform is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes and contact
We may update this Policy; material changes will be notified through the Platform. Questions or requests: support@ugcmatch.io.
