Privacy
How we handle personal data
This page sets out what Reels by You stores about you, why, who gets to see it and for how long. It describes what the site actually does. Last updated 17 September 2026.
The short version
- We store what you enter yourself: your account, profile, submissions, messages and applications. It is used to run the service, not for advertising.
- No advertising cookies, no analytics service and no tracking pixels. The cookies keep you logged in and remember who referred you.
- When a company measures sales through a tracking link we store the order number, amount and time, never the customer's name, address or email. Clicks are stored without IP addresses.
- You can ask at any time what we hold about you, and have it corrected or deleted. Email info@ugcguiden.se.
Who is responsible
The controller for Reels by You is Megasocial AB, Swedish company registration number 556794-7527. Send questions about personal data to info@ugcguiden.se.
What we store and why
Account and profile
What: Email address and password (the password is only stored encrypted by our login service), username, display name, and what you add to your profile: picture, bio, city, industries, prices, links to social media and videos you embed. If you sign up for the newsletter we store that choice and when you made it.
Why: So you can log in, show your profile to companies and other members, and take on jobs. The profile is public: it is what companies look at.
Legal basis: contract (Article 6(1)(b) GDPR). The newsletter: consent (Article 6(1)(a)), which you can withdraw at any time.
How long: for as long as the account exists. The newsletter until you unsubscribe.
The training
What: Which courses you take, which lessons you mark as done, assignments and final tests you submit, the editors' assessment, which cohort you are in and commitments you make to the cohort.
Why: To show where you are in the training, assess submissions and verify you. Commitments are visible to the others in your cohort; that is the point of them.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: for as long as the account exists
Forum and messages
What: Threads and replies you post in the forum, and messages between you and other members or companies.
Why: The forum is public. Messages are only visible to the people in the conversation. When you get a new message we send an email saying that someone has written, never what. You can turn the emails off under Edit profile.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: For as long as the account exists. Forum replies that others have answered may be de-identified instead of deleted, so that the threads still make sense.
Jobs and applications
What: Jobs that companies publish, applications you send, the company's decision, reviews after delivered jobs and the merit score calculated from lessons, jobs, reviews, films and response time.
Why: So companies and creators can find each other. The company sees your application and your profile. The merit score is shown on your profile.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: for as long as the account exists
Companies and enquiries
What: The company's name, registration number, website and contact person, which accounts belong to the company, and what is written in the enquiry form: contact person, email, phone, need, budget and timeline.
Why: To review and approve companies and to answer enquiries.
Legal basis: contract (Article 6(1)(b) GDPR). Enquiries from people without an account: legitimate interest (Article 6(1)(f)).
How long: Companies for as long as they have an account. Enquiries that lead nowhere are deleted no later than two years after the matter is closed.
The talent register
What: Name, email, city, industries, links and what you write about yourself when you sign up without an account, and whether you want the newsletter.
Why: So we can get in touch when a job suits you. Signing up lets us contact you about jobs, not send you a newsletter; that requires you to have ticked the box.
Legal basis: consent (Article 6(1)(a)), which you can withdraw at any time.
How long: Until you ask us to remove you, and no longer than two years after you signed up.
Tracking and commission
What: Tracking links and discount codes linked to a creator and a company. Clicks are counted per day using a fingerprint of the browser, language and date that changes every day: no IP address is stored and no visitor can be followed from one day to the next. From the company's checkout we only store orders carrying a creator's code, and only the order number, amount, currency and time. Disputes and payouts are stored with their reasoning.
Why: To calculate the creator's commission and our fee, and so both sides see the same figures.
Legal basis: contract (Article 6(1)(b) GDPR). Records behind payouts and invoices: legal obligation (Article 6(1)(c)), the Swedish Accounting Act.
How long: For as long as the tracking link exists. Anything behind a payout or invoice is kept for seven years after the end of the financial year, as Swedish accounting law requires.
Referrals
What: If you arrived through someone's referral link, we store who referred you when you create an account.
Why: So the person who referred you gets the credit.
Legal basis: legitimate interest (Article 6(1)(f))
How long: for as long as the account exists
The Claude connector
What: Draft jobs that a company's Claude saves with us, with the company's name, website, industry and market if Claude sends them. Companies with their own connector address can also have our search find creators for them. We then store the creators' names, published email addresses, links to their public profiles, link page and website, follower counts where shown, and the page where the address was found, and invite them to the company's job.
Why: So companies can write jobs with Claude, and so we can offer jobs to creators who have published a contact address themselves. The invitation process is described in Swedish on ugcguiden.se/inbjudan/.
Legal basis: contract (Article 6(1)(b) GDPR) (drafts), legitimate interest (Article 6(1)(f)) (invitations).
How long: Drafts for fourteen days if nobody uses them. Creators who have not been invited within 30 days are deleted, others 24 months after the most recent invitation. Anyone who declines, reports the email as spam or whose address bounces is deleted immediately, and we keep only a fingerprint of the address so it is not added again.
Activity log
What: Which pages are viewed and which actions are taken on the site, for example that someone applied for a job or uploaded a video, with time, path, whether it worked, approximate device (mobile or computer) and which site you came from. Form contents are never stored. No IP address is stored. If you are logged in, the row is linked to your account. If you are not, you get a code calculated from the IP address and browser together with a random value that changes every day and is then deleted. The code cannot be reversed and cannot follow you from one day to the next.
Why: To see where the site causes trouble and make it easier to use. Only the editors can see the log.
Legal basis: legitimate interest (Article 6(1)(f))
How long: 90 days.
Video deliveries and tax details
What: Videos that creators deliver to companies: the original file, a watermarked preview and the final file, with file name, size and any @ tag the creator chose to burn in. A video from a phone can carry the place where it was recorded. The location and other metadata are removed from the preview and the final file, and the original is deleted 30 days after processing. For the 900 SEK limit we store the fee the company set for each job, and whether the creator has Swedish F-tax (with the registration number, which for a sole trader is the personal identity number) or which umbrella company she invoices through.
Why: So the company can review and download the video it ordered, and so nobody is paid above the limit where the company would become an employer without the tax being handled.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: The preview and final file for as long as the delivery exists, the original for 30 days after processing. Tax details until you change them or delete your account.
Products shipped to creators
What: When a job means the company ships its product: name, street address, postcode, city, country and, if you choose, phone number, which the creator adds after accepting the job. The company can add the tracking for the parcel. We also store when the parcel was shipped and when it arrived.
Why: So the company can ship the product to be filmed. On the site only the company in the job can see the address, not the editors and not other companies, and it never appears in messages or emails.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: The address is deleted when the creator confirms the parcel has arrived, at the latest 60 days after the company marks it as shipped, and 180 days after it was added if nothing is shipped. The dates the parcel was shipped and arrived are kept for as long as the job exists.
Following brands and ratings
What: Which brands you follow. Ratings from one to five, whether you would work with the other party again and an optional comment, which the creator and the company leave about each other once a video has been paid for.
Why: You are notified when a brand you follow posts a job or an update. Ratings help creators and companies choose each other. A creator's rating of a company is shown on the company's page without a name: who wrote it is stored but never shown. A company's rating of a creator is shown with the company's name.
Legal basis: contract (Article 6(1)(b) GDPR)
How long: That you follow a brand until you unfollow it or delete your account. Ratings for as long as the job and the account exist.
The video as a work sample
A video a company has ordered here, approved and paid for is shown as a work sample on the creator's profile and on the home page, with the company's name below it. The creator's name is shown to logged-in visitors. That version is scaled down and without a watermark, and it stays with us: neither the creator nor the company can remove it or opt out of it being shown. The right to show it is set out in the terms, section 4.3. Videos that have not been approved and paid for are never shown. If a video concerns you and you want it removed, write to us and we will consider it against your rights under the GDPR.
Who gets access
What you publish on your profile and in the forum is public. Companies see applications to their own jobs and the videos delivered to them. A company using the creator search sees the names and public profiles of those found, never their addresses. The editors see what they need to assess submissions, review companies and mediate disputes. Tax details are seen only by the creator and the site administrator. We do not sell data or hand it to advertisers.
We use these providers, which process data on our behalf:
- Supabase: database, login and uploaded images, stored in Stockholm.
- Cloudflare: hosts the site, stores and processes delivered videos, and protects the site against automated traffic.
- Resend: sends the emails: notifications, password links and invitations.
- Loopia: our email, where anything you write to info@ugcguiden.se arrives.
Some providers may process data outside the EU/EEA. Such transfers are to rely on the European Commission's standard contractual clauses or an adequacy decision.
When a company connects its own Claude, what they write there is handled by Anthropic under the company's own agreement with Anthropic. What we receive from Claude is handled under this policy.
Cookies
The site sets three cookies, all needed for it to work:
ug_at: keeps you logged in, valid for at most an hour and renewed automatically.ug_rt: renews your login, valid for 30 days.ug_ref: remembers who referred you, for 30 days, only if you arrived through a referral link.
Cloudflare may also set a technical cookie that tells people apart from automated traffic. The fonts are served by us, so nothing is fetched from Google. Videos from YouTube, Instagram and Facebook only load when you click them, and then that service's own terms and cookies apply.
Your rights
You have the right to know what data we hold about you and get a copy, to have incorrect data corrected, to have data deleted, to restrict how we use it, to object to processing based on legitimate interest, and to receive what you have provided in a portable format. You can withdraw consent at any time.
You can change most things yourself under Edit profile. For everything else, including deleting your whole account, email info@ugcguiden.se. We reply within a month.
If you are not happy with how we handle your data you can complain to the Swedish data protection authority, IMY, or to the authority where you live.
Security
Access is controlled in the database, row by row: you can reach your own data and what is public, not other people's. Your login is kept in cookies that scripts in the browser cannot read. Links and keys that grant access to something are stored only as fingerprints, so a leak of the database does not give access to them.
Changes
If we make a significant change to how we handle data we update this page and the date at the top. If the change affects you as an account holder we will tell you before it takes effect.