Draft, pending legal review

Privacy policy

Last updated: [DATE]. Vouch is operated by [COMPANY NAME], [ADDRESS] (“we”). Contact: [SUPPORT EMAIL].

The short version

Vouch never reads your email without your consent. Before it looks at anything, it asks you to choose what it may read. It works on your device: the message, its subject and its recipients never leave your computer. To check the sender’s company, it sends only the sender’s company domain and display name to our check service.

Your choice: Full check or Sender only

  • Full check: Vouch reads the open email (sender, subject, text, and the authentication results your mail provider adds) on your device, to spot risky requests such as changed bank details.
  • Sender only: Vouch reads only the sender’s name and address. It never reads the subject, the message or the rest of the conversation.
  • Until you choose, Vouch reads nothing. You can switch, or withdraw consent by removing Vouch, at any time.

What stays on your device

  • The message body, subject, recipients and headers.
  • Your list of trusted senders and your monthly check count.
  • The sender’s exact address, which is compared on your device with addresses the company publishes.

What our check service receives

  • The sender’s domain (for example company.com) and display name (for example “Ana Silva”). Shared addresses such as info@ send no name.
  • Your Pro licence key, if you have one, to confirm your plan.
  • Pro, Full check only: when a signature is only an image, Vouch reads the text in that image on your device (on-device text recognition) to find the website and phone shown. The image is never sent anywhere.
  • Standard request data processed by our host, Cloudflare (IP address, time).

The service looks the domain and name up in public sources: domain registries (RDAP and WHOIS), DNS, the Internet Archive, the sender’s own website, and a web search provider (Serper, which returns Google results). Results are cached by domain and search phrase, never linked to you, and expire within 30 days. We don’t keep logs of who checked what.

Payments

Payments are handled by Stripe. We never see your card details. Stripe shares your email address, billing country and subscription status with us so we can provide Pro and send invoices.

Legal basis and your rights

We process data to provide the service you asked for (contract) and for our legitimate interest in preventing fraud. Under the GDPR you can ask to access, correct, export or delete your data, and complain to your data protection authority (in Portugal, the CNPD). Write to [SUPPORT EMAIL].

Processors

  • Cloudflare (hosting, cache)
  • Serper (web search)
  • Stripe (payments)