Rights management
Tuesday’s ad review. Your team wants the customer clip that did well last week. Someone asks who gave permission, and the answer is a DM thread nobody can find.
Clear the rights before the post sells anything.
Three ways to capture creator consent and four tracked statuses with expiry. A signed evidence record sits behind every decision.
No code. On Shopify, the Free plan needs no card.
What you get
Every post carries its permission before it sells anything. You keep the creator’s yes in their own words, dated, ready for anyone who asks.
How it works
Every post carries its consent: how it was given, when it expires and the record behind it, so a campaign can only pull content that is cleared.
01
Three decision sources, one ledger
Consent arrives as a hashtag reply to your public comment, or through a consent form. You can also record a decision yourself. Each decision lands in the same ledger, with its source recorded.
Capture paths · last 30 days
31
Hashtag
organic
18
Registration
link · v3
3
Manual
offline doc
Recent activity
- 09:14pending
Hashtag ingest · @sky.b
system
- 09:14awaiting
Awaiting signature · v3
system
- 09:42approved
Signed · 2-year licence
@sky.b
- 12:08cleared
Reviewed · brand-safe
judge_ana
- 28drevoked
Revoked via email
creator
- 28dhidden
Removed from 4 surfaces
system
02
Statuses that expire on their own
Pending, approved, rejected and revoked, plus a computed Expired state when the licence window closes. You set one licence term for your account, or none. The ledger flags what is about to lapse.
The main line
Post ingested, no consent yet. Hidden from widgets by default.
Creator signed. confirmation_from_user: true. Surfaces in widgets and exports.
Approval is the only gate. There is no separate “published” toggle to forget.
Where it can fork
- pending →rejected
Creator declined. Post hidden permanently. Logged for audit + analytics.
- approved →revoked
Creator pulled consent after the fact. Idukki removes the post from every surface within minutes.
- approved →expired
Default 2 years from signature. Triggers a renewal-request flow before the deadline.
03
An audit row you can hand to legal
Creator handle, channel, email, timestamp, comment, consent document and expiry date on every record. Export it as a signed PDF or CSV for a legal request.
How Idukki works
One post, collected to attributed
Collect
Rights
Tag
Display
Measure
Result: 3 orders, $74.28 attributed to one post.
04
Rights state travels with the post
The content queue shows the rights state on every tile, so a post without consent never reaches a widget by accident, and a revoked one drops out everywhere at once.
Content
Everything collected, moderated and tagged before it reaches a widget
- ReelWROGN Men Silver-Toned Watch@sky.bApproved
- VideoAirlift Overcoat Brown@ines.wearsPending
- PhotoJute Tote Bag@marcus.kApproved
- ShortTennis Cardigan Spring/Summer@lena.jRequested
- ReviewBodycon Sunscreen SPF 50Google ReviewsNot needed
- PhotoHeldWhite Sweater Green Stripes@ayo.runsHeld
How it works, from switched on to paying for itself.
- Step 1
Post lands in the queue
From hashtag ingestion, manual upload or a competition entry, every UGC post starts in pending state.
- Step 2
Request consent
A public comment with your approval hashtag, a consent form link, or your own recorded decision.
- Step 3
Decision recorded
Approved, rejected or revoked, with the decision source, the reviewer and the consent document attached.
- Step 4
Expiry tracked
One term per account, or none. The ledger computes Expired and shows what is about to lapse.
“Idukki is truly an all-in-one solution for brands looking to leverage UGC effectively. We would highly recommend it to any business aiming to enhance customer trust and engagement through authentic content.”
Three limits to know.
The in-app rights manager covers the brand workflow. An ad network or DSP can read clearance status through the Rights API, in private beta. Signed rights.granted and rights.revoked webhooks are live.
- 01
Consent wording is in English
The consent statement on the form is in English today. Per-region templates are not built.
- 02
GDPR right-to-be-forgotten is operator-driven
Revocations propagate to every widget at once; full creator data deletion is a per-business operator action.
- 03
Evidence is signed, history is not chained
Each clearance exports as a signed PDF or CSV (beta). The signature shows an export was not changed. The history rows are not hash-chained.
The questions to ask before you switch it on.
What counts as consent in Idukki?
A hashtag reply or entry under your campaign terms. Or a submitted consent form, or a decision you record. Each is stored as a decision_source on the record, with its timestamp.
How long does a licence last?
You set one term for your account. Pick 30, 60, 90, 180 or 365 days, or up to ten years. With no term set, a grant does not expire. The ledger computes Expired when a term ends.
Can I revoke rights after approval?
Yes. A revoked post drops out of rights-gated collections and your Klaviyo feed. The revocation is logged with who made it.
Is this GDPR and CCPA compliant?
It keeps the records those laws ask for. Every decision is logged with its source. The evidence exports as a signed PDF or CSV.
Which plans include rights management?
Rights management and rights requests start on Starter ($45/mo). The plans are on /pricing.
Unsure whether a post is cleared?
Bring one campaign and we will walk the consent path with you, end to end.