Rights management

Every post you ship has a signature behind it.

Four ways consent reaches Idukki — auto-DM response, hashtag entry, a registration link, or a manual offline upload — and every approval lands in the same signed ledger. Revoke at any time and the post drops from every surface within minutes.

Auto-DM response — templated, multi-language, 38% conversion
Hashtag entry — branded tag implies consent (where lawful)
Registration link — standalone consent form, no DM needed
Manual capture — offline doc + signature attached
One-click revoke + audit log per collection (JSON / signed PDF)

Open rights report See the API tier

Rights ledger · #SummerWithLumen

124 signed

Capture paths · last 30 days

72
Auto-DM
58% replied
31
Hashtag
organic
18
Registration
link · v3
3
Manual
offline doc

Recent activity

09:14
Hashtag ingest · @sky.b
system
pending
09:14
Auto-DM sent · EN · v3
system
awaiting
09:42
Signed · 2-year licence
@sky.b
approved
12:08
Reviewed · brand-safe
judge_ana
cleared
28d
Revoked via email
creator
revoked
28d
Removed from 4 surfaces
system
hidden

38% DM conv. 28 locales JSON · signed PDF

The flow

From post landing to signature, on autopilot.

Rights are not a checkbox at the end of moderation — they’re the loop your moderation runs on. Every post enters pending, every approval has a signed creator behind it, every revocation reaches every widget.

Step 1
Post lands in the queue
From hashtag ingestion, manual upload, or a competition entry — every UGC post starts in pending state.
Step 2
Auto-DM the creator
Templated rights-request in your brand voice. Multi-language template library. Falls back to a registration link if DMs are off.
decision_source: hashtag
Step 3
Creator signs
Form pre-fills with the creator handle and the post URL. They add name, email, optional comment, and confirm rights.
Step 4
Status flips to approved
confirmation_from_user: true. Audit log records the timestamp, decision_source and any custom fields. Slack pings your team.
Step 5
Expires automatically
Default expiry is 2 years from signature. Renewal request fires before expiry; revocations propagate to every widget.

States

Five states. One state machine.

The rights status is the source of truth for whether a post is visible in any widget anywhere. There is no separate “published” toggle to forget.

pending
Post ingested, no consent yet. Hidden from widgets by default.
approved
Creator signed. confirmation_from_user: true. Surfaces in widgets and exports.
rejected
Creator declined. Post hidden permanently. Logged for audit + analytics.
revoked
Creator pulled consent after the fact. Idukki removes the post from every surface within minutes.
expired
Default 2 years from signature. Triggers a renewal-request flow before the deadline.

Decision source

Three ways consent reaches us.

Every approved record carries a decision_source so you know how that licence was captured — and so a regulator review never has to ask.

manual
Your team uploaded the asset and captured consent offline. Doc + signature attached to S3.
registration
Creator signed a standalone rights-registration link — same template, no DM in the loop.
hashtag
Auto-DM fired after hashtag ingestion. Creator clicked through and signed inside the Idukki flow.

Built into every widget

One status. Every surface. Zero accidents.

Galleries, stories, video walls, the AI Shopper, link-in-bio — they all read from the same rights status. When a creator revokes, the post is gone from every place at once.

Hidden until approved

pending posts never reach a widget. No accidental drafts on the homepage.

Slack on every approval

Your moderation channel sees the decision the moment it lands.

Audit log per collection

Export the rights trail for any collection as JSON. Filter by creator, time or decision source.

Honest about limits

Three things this tier doesn’t do.

The in-app rights manager covers the brand workflow. If you’re running rights for an ad network or DSP, the Rights API tier adds tamper-evident audit chains, per-region templates and webhook events.

Multi-language templates ship in English first
28 locales planned via the Rights API; the in-app templates are currently English-only.
GDPR right-to-be-forgotten is operator-driven
Revocations propagate instantly; full creator data deletion is a per-business operator action today.
Audit export is JSON-first
Signed-PDF and W3C VC exports live in the Rights API tier — see /rights-api.

4-min setup1,400+ brands37 KB runtime5.0 G2

Stop renting six tools. Ship one.

Spin up your first widget in 4 minutes. Migrate from Bazaarvoice, EmbedSocial, Tolstoy or Videowise in a day. Your CFO will love us. Your CRO already does.

Start 14-day free trial Book a 30-min demo