No UGC strategy without a rights log

It is a single table (Notion, Airtable, sheet, or DAM fields) where each row is one asset with explicit permission scope.

It is not a screenshot folder, a Slack thread, or “Instagram said we can embed it.”

Platform embed rights ≠ marketing rights ≠ paid whitelisting ≠ email reuse. Your log must separate them.

Regulatory context: 2027 compliance checklist for FTC, UK fake reviews, and UGC rights.

Minimum viable columns

Optional but valuable: whitelisting_ad_account, music_cleared, minor_present.

Workflow: nothing publishes without a row

1. 1Post enters moderation via Idukki feeds (connection docs).
2. 2Moderator creates pending row; attaches permission evidence.
3. 3Client approver sets channels_allowed and status=approved.
4. 4Only then map to widget or export to ESP.

For holiday-adjacent SKU decisions, extend the matrix from which customer posts belong in holiday ads.

TikTok and haul content

Short-form hauls need explicit PDP and paid flags—steps we outlined in TikTok holiday haul PDP rights. Log sound rights separately; platform “commercial sound” libraries do not cover all whitelisting.

Revocation and takedown SLAs

When a creator revokes:

• Set status=revoked immediately
• Remove from galleries within agreed SLA (we recommend <24h web, <4h paid)
• Document takedown timestamp for legal

Idukki help center covers bulk hide by asset ID; your log is still the system of record.

Integrations: do not duplicate truth

Pick one master:

• Log master — Export approved IDs nightly to gallery allowlists
• DAM master — Log becomes metadata fields on assets

Avoid a third shadow list in email tools. If Klaviyo uses a static image, the row must say channels_allowed includes email.

Agency and brand shared access

Agencies need write access to pending rows, not unilateral approve—client approver stays in-house unless contract says otherwise. Fold the log into 48-hour onboarding deliverables.

Audits that catch gaps before lawyers do

Monthly:

• Sample 20 live gallery tiles → trace to approved row
• Sample 10 paid creatives → channels_allowed includes paid
• Any row with minor_present=Y → legal second sign-off

Quarterly: align with review authenticity policies if you syndicate stars—multi-source reviews markup.

Strategy artifacts that depend on the log

Without the log, these are fiction:

• UGC roadmap one-pager (2027 social proof roadmap)
• Creator whitelisting budget
• AI synthetic backfill rules (customer modules stay clean—synthetic vs customer placement)
• Incrementality holdouts (you need stable asset sets—holdout tests)

Reporting upward

Board-friendly metrics from the log itself:

• % hero SKUs with ≥N approved assets
• Median approval time
• Revocation count
• Backlog age 90th percentile

Outcome case studies belong on resources—do not invent lift in board slides.

Tooling choices: spreadsheet vs DAM vs app-native

Spreadsheets win for the first 90 days because legal approvers already live in email and Slack. Move to DAM or PM tools when:

• Asset count exceeds ~500 approved rows
• Multiple locales need parallel approvers
• You integrate with PIM for SKU lifecycle (discontinued variants must auto-flag gallery tiles)

Idukki’s moderation queue is the intake, not the ledger of record, unless you export approvals nightly into your master. Teams that confuse the two lose audit trails when moderators rotate. Export formats and webhook options are documented in Idukki docs.

Training creators and customers without slowing capture

Permission friction is real. Reduce it with:

• One-link form post-purchase (Klaviyo or SMS) that pre-fills order SKU
• DM templates that state channels in plain language (“OK for website and email, not TV”)
• Creator SOWs that mirror the same channels_allowed enums as the log—no bespoke legalese per campaign

When creators ask why you need paperwork, point them to the same consumer-protection trends summarized in our 2026 in review: UGC, reviews, and shoppable video piece: regulators are watching social proof, not just ads.

Store evidence links (Drive, Notion, or DAM) in the row itself—future you will not remember which Slack thread granted paid rights.

Bottom line

UGC strategy is permissions operations. Build the log before the widget, enforce publish gates, and treat revocation as normal. Everything else—galleries, email, paid, Easter sprints—is just reading from the same source of truth.