Privacy Policy

1. Who we are

UGC Max is provided by EGYCAD SMART SOLUTIONS ("we," "us," or "our"). We are responsible for the personal information we process to operate the UGC Max app and related services described in this policy. UGC Max helps you turn briefs about products, apps, websites, and services into AI-generated ad angles, scripts, and videos. You can optionally include product photos or app or website screenshots. A workflow stores shared inputs and selling angles that you can reuse to create multiple ad versions.

This policy applies to your use of those services. Our Terms of Use explain the rules for using UGC Max.

2. Information we collect

• Account information. Your name, email address, account identifier, and sign-in method. If you sign in using another service, we receive the profile information it provides, which may include your name and profile photo.
• Content you provide. Descriptions and links for products, apps, websites, or services; images (including product photos and app or website screenshots); workflow names; shared language and country settings; per-version creative instructions and video-format choices; and other information you submit. Uploaded files may also contain personal information.
• Generated content and workflow records. Selling angles, automatically generated scripts, video ad versions and previews, generation instructions, workflow and version history, and related dates and settings. Scripts are stored to create videos and support retries, even though they are not displayed in the app.
• Subscriptions and allowance. We process your Firebase account identifier, subscription status, purchase and renewal dates, and generation usage to provide paid access and shared allowances. RevenueCat verifies purchase information. Apple or Google processes mobile purchases; when web checkout launches, Paddle processes web purchases as reseller and Merchant of Record, including billing contact details, payment information, tax information, receipts, refunds, and fraud checks. We do not receive your full payment card details.
• Device and usage information. Information such as your IP address, sign-in activity, and service errors that we and our service providers process to deliver and protect the service. We use Google Analytics for Firebase to measure screens viewed, feature usage, generation outcomes observed by the app, and purchase and export activity. Analytics may include app-instance identifiers, your account identifier when signed in, device and app information, subscription tier, selected creative settings, and product prices and currency. We do not include your name, email address, descriptions, images, scripts, prompts, links, or report text in analytics events. Advertising-ID collection and advertising personalization are disabled.
• Optional notifications. If you opt in and grant device permission, Firebase Cloud Messaging processes a device token, platform, app version, last-seen time, and enabled status to notify you when generation completes or fails. Messages contain generic text and workflow/job identifiers, never descriptions, prompts, images, or generated content. You can turn this off under Account without affecting generation. Tokens are removed on sign-out and account deletion.
• Preferences and communications. Settings such as your chosen language, target country, and playback preferences, plus information you provide when contacting us. A country selected for your content is a creative setting, not precise device location.

3. How we use information

We use information to create and authenticate your account; generate, store, display, and export your content; remember your preferences; understand usage and improve the app; respond to support and privacy requests; investigate failures; prevent misuse; enforce service limits and our terms; and meet legal obligations.

We do not sell your personal information or share it for cross-context behavioral advertising.

4. AI generation

Before your first generation, we ask you to explicitly consent to sending your images (including product photos and app or website screenshots), descriptions, URLs and retrieved website content, and generation instructions to external AI providers, including OpenRouter, text model providers such as MiniMax and Google, and video model providers such as Alibaba and ByteDance. This processing produces your requested ideas, scripts, and videos. The configured models and providers may change; material changes to this consent require acceptance of a new policy version.

Consent is required for generation, but not browsing, account creation, drafting, or local editing. We store the accepted policy version, acceptance time, and provider summary with your account. You can withdraw consent under Account → Privacy & notifications. Withdrawal blocks future generation and leaves existing workflows accessible. It cannot recall data already sent or stop processing already underway. Analytics records only whether consent was accepted or withdrawn, never consent text or workflow content.

We keep your instructions and generated results as part of your workflow and to resolve problems. Service providers may also retain or use submitted content under their own terms and privacy policies. Their practices, including whether content may be used for AI training, can vary.

Only submit information you are authorized to share. Avoid including sensitive personal information or confidential material that is unnecessary for your video.

5. When we share information

• Service providers. We share information with companies that help us manage accounts, store content, create the content you request, and operate the service. They receive information needed to perform those services.
• Analytics services. Google receives the analytics information described above to provide usage measurement and reporting through Google Analytics for Firebase.
• Purchase services. RevenueCat receives your account identifier and purchase information to verify subscriptions and restores. Apple or Google handles store payments under its own privacy policy. Paddle handles web payments under its Privacy Policy; RevenueCat links purchase status to your account so allowances work across devices. We do not send your briefs, images, or generated videos to billing providers for checkout.
• Your chosen destinations. When you export or share a video, the apps, platforms, and people you choose receive that content under their own privacy practices.
• Linked websites. If you import images from a linked website, that website and related services may receive your IP address and information about the visit under their own privacy policies.
• Legal and business needs. Information may be disclosed when required by law, to protect rights or safety, to investigate fraud or abuse, or as part of a merger, acquisition, or transfer of the service, subject to applicable legal protections.

Your workflows are private to your account within the app. Creating a workflow does not automatically publish it in the Explore gallery.

6. Device storage and permissions

The app saves information on your device to keep you signed in, remember your preferences, and display media. Photo access allows you to select product photos or app or website screenshots, and permission to save media allows you to export videos to your photo library. You can manage applicable permissions in your device settings; disabling a permission may prevent the related feature from working.

These legal pages do not use cookies or track you for advertising. Basic visit information may still be processed to deliver and protect the pages.

7. Retention and deletion

We keep account information while it is needed to provide your account and meet the purposes described here. Workflow content, including shared inputs, selling angles, per-version instructions and settings, generated scripts, videos, and generation history, is retained until the workflow is deleted. Deleting a workflow removes its shared content and all its ad versions, subject to necessary legal, security, and operational retention.

Delete your account in Account → Account actions → Delete account. After confirmation and a fresh sign-in, this removes workflows and all their ad versions, including shared briefs, uploaded images (including photos and screenshots), selling angles, generation instructions, scripts, videos, and version history, along with usage and billing data held in the app, request records, notification tokens, consent records, and Firebase sign-in access. Active generations must finish before deletion can begin. New account activity is blocked once deletion starts. You can also request deletion without the app using our account deletion request page. We verify the account owner before acting on external requests; never send us your password.

In-app cleanup normally completes during the request. Unexpired upload links or interrupted cleanup can delay completion; cleanup retries automatically every 15 minutes. Allow up to 24 hours for upload links and routine retries, and contact us if deletion is still pending. We aim to complete verified external requests within 30 days, subject to applicable legal deadlines; we will explain any extension or legal restriction.

We retain a minimal one-way hash of the deleted account identifier and deletion status/time to prevent late payment notifications or old credentials from recreating data. It contains no email, prompts, images, or videos and is retained while needed for this security purpose. App stores and payment processors may retain transaction records as required by tax, accounting, fraud prevention, or other laws. Where we are legally required to preserve records, they are limited to the necessary information and period and restricted from ordinary product use. Account deletion does not cancel a subscription; cancel separately through Apple, Google Play, or the Paddle customer portal, according to where you purchased, to prevent renewal.

Account-level use of the one-time free ad angle set and billing usage records are retained separately from workflows so deleting a workflow or reinstalling the app does not reset allowances. Limited information may be retained in backup copies or records needed to comply with law, resolve disputes, maintain security, or prevent abuse for as long as necessary for those purposes. Copies you export or share, and information retained independently by service providers, are subject to their own deletion processes. Uninstalling the app does not delete your account or workflows saved with the service.

8. Security and international processing

We use reasonable safeguards to protect your personal information against unauthorized access, loss, and misuse. No service can guarantee complete security. Protect your sign-in credentials and take care when sharing private content.

Our service providers may process information in countries other than your own. Data protection laws differ between countries. Where applicable law requires protections for international transfers, we rely on appropriate transfer mechanisms, such as contractual safeguards used by our providers.

9. Legal bases for processing

Where applicable data protection law requires a legal basis, we process information to perform our agreement with you, including providing accounts and generating content; for legitimate interests such as securing and maintaining the service; to meet legal obligations; or with your consent where required. You may withdraw consent at any time, without affecting processing that was lawful before withdrawal.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information; restrict or object to certain processing; withdraw consent; and complain to your local data protection authority. These rights can be subject to legal exceptions.

To make a request, contact us with the email address associated with your account and describe what you would like us to do. Do not send your password. We may request reasonable information to verify your identity and will respond within the period required by applicable law. We will not discriminate against you for exercising your privacy rights.

11. Children's privacy

UGC Max is intended for people aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action, including deletion where required.

12. Changes to this policy

We may update this policy as the service or legal requirements change. The date at the top identifies the latest revision. We will provide additional notice of material changes, and obtain consent when required by applicable law.

13. Contact us

For privacy questions, requests about your information, or account deletion, contact EgyCad at ugcmax@egycad.com. Include "UGC Max privacy" in your message and the email address associated with your account.

Using UGC Max in a browser

The web app uses browser storage to remember preferences, example catalog metadata, and your sign-in session. Private images and previews may be held in memory during your session. Selecting a photo does not upload it until you submit your brief. Signing out clears the web app’s in-memory media; files you download remain on your device. Browser data may be removed through your browser settings.

Web push notifications and automatic extraction of images from websites are not enabled in this version. The web app does not collect Firebase Analytics events in this release. Existing mobile-app analytics disclosures continue to apply to the mobile apps.