Privacy Policy

1. Introduction

Vouch (also referred to as "Vouch Decks," "we," "our," or "us") operates the website located at getmyvouch.com and all related sub-domains, applications, and services (collectively, the "Service"). This Privacy Policy describes the types of information we collect from users of the Service ("you" or "User"), how we use that information, the circumstances under which we may disclose it, and the choices available to you.

By accessing or using the Service you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, you must discontinue use of the Service immediately.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration Data: Email address and password (hashed and salted; we never store plaintext passwords).
• Profile & Portfolio Data: Display name, biography, headshot/photo, social-media handles, brand collaboration names, UGC video links, pricing packages, and testimonials.
• Brand Account Data: Company name, contact name, contact email, company website, industry, and company size.
• Payment & Billing Data: When you subscribe to a paid plan, payment-card details and billing address are collected and processed directly by our payment processor, Stripe, Inc. We do not store full card numbers on our servers; we receive only a tokenized reference and last-four digits for display purposes.
• Support Communications: Any emails, messages, or feedback you send to us.

2.2 Information Collected Through Third-Party Platform Connections

When you choose to connect a social-media account (e.g., Instagram, TikTok) to verify your creator profile, we collect:

• Platform user ID and username
• Public profile information (follower count, post/media count, biography)
• OAuth access tokens (encrypted at rest) solely to maintain the connection and sync publicly available metrics

We access only publicly available data and data explicitly authorized by you through the platform's OAuth consent screen. We do not read your direct messages, private posts, or contacts on any connected platform.

2.3 Information Collected Automatically

• Log & Device Data: IP address, browser type and version, operating system, device identifiers, referring/exit URLs, and timestamps.
• Usage Data: Pages and portfolios viewed, interactions (clicks, video plays), time spent, and navigation patterns.
• Cookies & Similar Technologies: Session identifiers and preference cookies (see Section 8).

3. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area ("EEA") or the United Kingdom ("UK"), we process your personal data on the following legal bases under the General Data Protection Regulation ("GDPR") and the UK GDPR:

• Performance of a Contract: Processing necessary to deliver the Service you signed up for (e.g., maintaining your account, publishing your portfolio).
• Legitimate Interests: Analytics, fraud prevention, product improvement, and direct marketing (where not overridden by your rights).
• Consent: Connecting third-party social accounts, receiving optional marketing emails. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal Obligation: Tax record-keeping, responding to lawful government requests.

4. How We Use Your Information

• Provide, operate, and maintain the Service, including generating and hosting your Vouch Deck portfolio.
• Process subscriptions, payments, and refunds.
• Authenticate your identity and connected social-media accounts.
• Display aggregated creator metrics to brand users browsing the creator marketplace.
• Send transactional emails (account confirmations, password resets, billing receipts).
• Send optional product updates and marketing communications (only with your consent where required by law; you may opt out at any time).
• Analyze usage trends and improve features, performance, and user experience.
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Comply with applicable legal obligations and enforce our Terms of Service.

5. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

• Service Providers & Sub-Processors: We share data with third-party vendors who perform services on our behalf (hosting, payment processing, analytics, email delivery). Each vendor is contractually obligated to process data only as instructed and to maintain reasonable security measures. Key sub-processors include:
  • Stripe, Inc. – payment processing
  • Cloud hosting infrastructure – database and file storage
  • Meta Platforms, Inc. – Instagram API integration
• Publicly Published Portfolios: Information you choose to include in your published Vouch Deck (name, bio, headshot, videos, social handles, testimonials) is publicly accessible by design. Brand users on our platform may view your profile and aggregated metrics.
• Brand Marketplace: If you are a creator, certain profile information and publicly available social metrics may be visible to registered brand users searching the creator directory.
• With Your Consent: When you explicitly direct us to share information (e.g., accepting a testimonial request).
• Legal Requirements: When disclosure is required by applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Vouch, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, in which case your data may be transferred to the successor entity.

6. Data Security

We implement industry-standard administrative, technical, and physical safeguards designed to protect your personal information, including:

• Encryption in transit (TLS 1.2+) and encryption at rest for sensitive data fields (e.g., OAuth tokens).
• Row-level security policies on database tables ensuring users can only access their own data.
• Secure password hashing (bcrypt).
• Role-based access controls for internal systems.

Despite these measures, no system is completely secure. We cannot guarantee the absolute security of your information and disclaim liability for unauthorized access that occurs despite our reasonable security measures.

7. Data Retention

• Active Accounts: We retain your personal information for as long as your account remains active and as reasonably necessary to provide the Service.
• After Deletion: Upon account deletion, we will remove or anonymize your personal data within 30 days, except where retention is required for legal, tax, audit, or fraud-prevention purposes (up to 7 years for financial records).
• OAuth Tokens: Platform access tokens are deleted immediately upon disconnection of the linked account or upon account deletion.
• Analytics Data: Aggregated, non-identifiable analytics data may be retained indefinitely for product-improvement purposes.

8. Cookies & Tracking Technologies

We use cookies and similar technologies for the following purposes:

Analytics and advertising cookies are off by default and load only after you accept them in our cookie banner; you can withdraw consent at any time by clearing cookies or re-opening the banner. You can also control cookies through your browser settings. Disabling strictly necessary cookies may impair the functionality of the Service. We do not currently respond to "Do Not Track" browser signals due to the lack of an industry standard.

9. Your Rights & Choices

9.1 All Users

• Access & Portability: Request a copy of the personal data we hold about you in a structured, machine-readable format.
• Correction: Update inaccurate or incomplete personal data via your account settings or by contacting us.
• Deletion: Request deletion of your account and associated personal data.
• Disconnect Platforms: Revoke connected social-media accounts at any time from your account settings, which immediately deletes stored tokens.
• Marketing Opt-Out: Unsubscribe from marketing emails using the link in any such email or by contacting us.

9.2 EEA / UK Residents (GDPR)

In addition to the rights above, you may: object to processing based on legitimate interests; request restriction of processing; withdraw consent at any time; and lodge a complaint with your local Data Protection Authority.

9.3 California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act and the California Privacy Rights Act, California residents have the right to:

• Know what personal information we collect, use, disclose, and sell (we do not sell personal information).
• Request deletion of personal information.
• Opt out of the "sale" or "sharing" of personal information — not applicable as we do not sell or share data for cross-context behavioral advertising.
• Non-discrimination for exercising privacy rights.

To submit a verifiable consumer request, email privacy@getmyvouch.com. We will respond within 45 days.

9.4 Other U.S. State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with consumer privacy statutes may exercise substantially similar rights as described above. Contact us using the details in Section 14 to submit a request.

10. International Data Transfers

Vouch is operated from the United States. If you are located outside the United States, your information will be transferred to, stored, and processed in the United States and potentially other countries where our service providers maintain facilities. By using the Service, you consent to the transfer of your data to the United States and other jurisdictions that may not provide the same level of data protection as your home country. Where required (e.g., transfers from the EEA/UK), we rely on Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

11. Children's Privacy

The Service is not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data without verifiable parental consent, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact us at privacy@getmyvouch.com.

12. Third-Party Links & Services

The Service may contain links to or embed content from third-party websites and services (e.g., YouTube, TikTok, Instagram). This Privacy Policy applies solely to information collected by us. We have no control over, and assume no responsibility for, the privacy practices of third parties. We encourage you to review their privacy policies before providing them with any personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where required by law, by sending you an email notification or displaying a prominent notice within the Service at least 30 days prior to the changes taking effect. Your continued use of the Service after the effective date of the revised Privacy Policy constitutes your acceptance of the updated terms.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

For EEA/UK data-protection inquiries, you may also contact your local supervisory authority.