Privacy policy

Vouch Tech, LLC ("Vouch Tech," "we," "us," or "our"), a Delaware limited liability company, operates a peer-to-peer outreach platform (the "Service") that helps volunteers identify which of their personal contacts appear on a campaign, political organization, or nonprofit client's outreach list, and lets the volunteer send personalized messages from their own email account to those contacts.

This Privacy Policy describes how we collect, use, share, and protect information when you use the Service. By using the Service, you agree to the terms of this Privacy Policy.

1. Who This Policy Applies To

This Policy applies to:

• Volunteers ("Users") who create a Vouch Tech account, connect their Google account, and use the Service to identify and contact people in their own address book.
• Clients — campaigns, political organizations, and nonprofit organizations — who engage Vouch Tech to facilitate peer-to-peer outreach by their volunteers.
• Contacts — individuals in a Volunteer's address book whose information is processed through the Service.

If you are a Contact and want to understand or limit how your information is processed, see Section 10 (Your Choices) and Section 11 (Contact Us).

2. Information We Collect

2.1 Information You Provide Directly

Account information: your name and email address (provided by Google when you sign in), and the Client(s) you are volunteering for.

Communications: the content of personalized message drafts you compose through the Service, and any messages you send to our support team. (Once you send a message from your Gmail account, the sent message itself is not visible to or stored by Vouch Tech.)

How we authenticate you. You sign in to Vouch Tech using "Sign in with Google." Vouch Tech does not create or store a password for you — Google handles authentication and confirms your identity to us each time you sign in. You can revoke Vouch Tech's access at any time from your Google account permissions.

2.2 Google User Data (Accessed via Google OAuth)

When you connect your Google account, you grant the Service permission to access certain Google user data. Specifically:

• Google Contacts (contacts.readonly and contacts.other.readonly or equivalent): names and email addresses from your Google Contacts and "Other contacts."
• Basic profile (openid, email, profile): your name, email address, and Google account identifier, used to identify your account and confirm the connection.

Vouch Tech does not request access to your Gmail. The Service does not read your Gmail inbox or sent mail, and the Service does not send email on your behalf. When you are ready to send a personalized message, the Service generates the message text and opens a pre-filled compose window in your Gmail account (or copies the message text to your clipboard). You review and send the message yourself, from your own Gmail account, using Gmail's standard send action. Vouch Tech never sends mail on your behalf and never sees the message after you send it.

You can revoke Vouch Tech's access to your Google Contacts at any time from your Google account permissions.

2.3 Client-Provided Information

Clients upload outreach lists (for example, voter files, donor lists, or volunteer-prospect lists) for the purpose of matching against Volunteer contact information. These lists typically contain names, email addresses, and other contact identifiers. We process this information solely on behalf of the Client and in accordance with our agreement with that Client.

2.4 Information Collected Automatically

Usage data: pages and features used, actions taken, timestamps, and similar interaction data.

Device and log data: IP address, browser type, operating system, device identifiers, referring URLs, and error logs.

Cookies and similar technologies: we use strictly necessary and analytics cookies. See Section 8 for details.

2.5 Information We Do Not Collect

We do not access, store, read, or transmit:

• Any content or metadata from your Gmail account, including inbox messages, sent mail, drafts, labels, headers, or send history.
• Your Google Calendar, Drive, Photos, or any other Google service.
• Any Google Workspace data beyond what is listed in Section 2.2.
• Information about how often you communicate with, or how recently you have communicated with, any of your contacts. We do not analyze your email history to prioritize or rank your contacts.

3. How We Use Information

We use the information described above only for the following purposes:

We do not use Google user data for advertising, to train generalized artificial intelligence or machine learning models, to build profiles of Contacts for resale, or for any purpose unrelated to providing the user-facing features of the Service.

3.1 Compliance with Google API Services User Data Policy (Limited Use)

Vouch Tech's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide or improve user-facing features that are prominent in the Service's user experience.
• We do not transfer Google user data to third parties except (i) as necessary to provide or improve the Service, (ii) for security purposes, (iii) to comply with applicable law, or (iv) as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Google user data to serve advertisements.
• We do not allow humans to read Google user data unless (i) we have your affirmative agreement for specific messages, (ii) it is necessary for security purposes (such as investigating abuse), (iii) it is necessary to comply with applicable law, or (iv) the data has been aggregated and de-identified and is used for internal operations.

4. How We Handle Matched Contact Data (Important)

This section describes how we handle Contact information — the most sensitive data in the Service — in plain terms.

4.1 How Messages Are Sent

The Service helps you compose personalized messages, but you send those messages yourself, from your own Gmail account. Specifically, when you are ready to send a message to a Matched Contact, the Service either (i) opens a Gmail compose window pre-filled with the recipient's address, subject, and message body, which you review and send using Gmail's standard send action, or (ii) copies the message text to your clipboard for you to paste into a Gmail compose window manually.

The Service does not send messages on your behalf, does not access Gmail's send functionality, and does not have any visibility into the messages you ultimately send. Once you send a message, the entire transaction is between you and the recipient through Gmail; Vouch Tech is not involved in the delivery and does not receive a copy.

4.2 Matching

When you sync your contacts, we compare them against the Client's outreach list to identify overlaps ("Matches"). Matching takes place on our servers in the United States. Contacts that do not match are not retained beyond what is necessary to perform the match.

4.3 Retention of Matches

We retain Matches associated with your account for the shorter of:

• the duration of the applicable Client engagement (typically a campaign or fundraising cycle); or
• 90 days from the date of the most recent Match,

after which Matches are deleted from active systems. You can delete your Matches at any time from your account dashboard, and you can disconnect your Google account at any time, which will cause us to delete all Google-derived data associated with your account within 30 days (subject to backup-retention practices described in Section 7).

4.4 What Clients See and Don't See

Clients do not receive the identities of your Matches. A Client will not see the names or email addresses of Contacts in your address book, whether or not those Contacts appear on the Client's list.

Clients receive only the following:

• Aggregate metrics: total Volunteers active, total Matches, total messages composed, click-through rates on links, and similar campaign-level statistics.
• Volunteer-level activity: for each Volunteer affiliated with that Client, the number of Matches identified, messages composed, and links clicked — without Contact identities.
• Cohort and outcome reporting: for example, "of the people contacted via the Service, X% took an action on the Client's website." This is computed via Vouch-side match-back (see Section 4.5) or trackable links (see Section 4.6).

4.5 Match-Back Measurement

To measure outcomes, a Client may provide us with a list of people who took an action on the Client's own properties (for example, donated, signed up to volunteer, or RSVP'd). We compare that list against the list of Contacts to whom a message was composed through the Service and return to the Client an aggregate count (for example, "178 of the 1,230 people contacted converted within 30 days"). Individual Contact identities are not disclosed to the Client through this process.

4.6 Trackable Links

Personalized messages composed through the Service may include trackable links (using standard URL parameters such as UTM tags or unique identifiers). When a Contact clicks a link, the Client's analytics will record the click and any subsequent actions the Contact takes on the Client's own properties. At that point, the Contact's interaction with the Client is governed by the Client's own privacy policy. Vouch Tech does not transmit a Contact's identity to the Client; the Client only learns who interacted with their site when the Contact themselves takes an action there.

5. How We Share Information

We share information only as described below.

5.1 With Clients

As described in Section 4.3, we share aggregate metrics, Volunteer-level activity, and cohort/outcome reporting with the Client you are volunteering for. We do not share Contact identities with Clients.

5.2 With Service Providers

We share information with vendors who help us operate the Service — for example, cloud hosting (Amazon Web Services / Google Cloud, U.S. regions), error monitoring, customer support tooling, and analytics. These providers are bound by contractual obligations to handle information only on our instructions and consistent with this Policy.

5.3 For Legal and Safety Reasons

We may disclose information if we believe in good faith that disclosure is necessary to (i) comply with applicable law, legal process, or a binding government request; (ii) enforce our Terms of Service; (iii) detect, prevent, or address fraud, security, or technical issues; or (iv) protect the rights, property, or safety of Vouch Tech, our Users, or others.

5.4 Corporate Transactions

If Vouch Tech is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections and notice consistent with this Policy.

5.5 With Your Consent

We may share information for other purposes with your consent or at your direction.

5.6 What We Do Not Do

• We do not sell personal information.
• We do not share Google user data with advertisers, data brokers, or any third party for advertising purposes.
• We do not use Google user data to train generalized AI/ML models.
• We do not disclose Contact identities to Clients.

6. Legal Bases (for Users in the EEA/UK, where applicable)

Although our Service is directed to U.S. users, where the GDPR or UK GDPR applies, we rely on the following legal bases: (i) performance of a contract to provide the Service to you; (ii) legitimate interests in operating, securing, and improving the Service, where not overridden by your rights; (iii) consent, where required (for example, for non-essential cookies); and (iv) compliance with legal obligations.

7. Data Retention

• Account data: retained while your account is active, and for a reasonable period afterward for legal, tax, and audit purposes.
• Google user data (Contacts): as described in Section 4.3. Non-matching contacts are not retained beyond what is necessary to perform the match. Matches are retained for the shorter of the Client engagement or 90 days.
• Message drafts composed in the Service: retained for up to 12 months for support and abuse-prevention purposes, then deleted or de-identified. Vouch Tech does not store or have access to messages once they are sent from your Gmail account.
• Logs and analytics: retained for up to 13 months.
• Backups: retained for up to 30 days; deletion requests are honored on production systems immediately and propagate through backups within that window.

8. Cookies and Similar Technologies

We use:

• Strictly necessary cookies for authentication, security, and core functionality.
• Analytics cookies to understand how the Service is used. You can disable these in your browser or via our cookie banner where applicable.

We do not use advertising or cross-site tracking cookies.

9. Security

We implement administrative, technical, and physical safeguards designed to protect information, including encryption in transit (TLS) and at rest, role-based access controls, secrets management, logging and monitoring, and periodic security reviews. No system is perfectly secure, and we cannot guarantee the absolute security of information.

10. Your Choices

10.1 If You Are a User

• Access, correct, or delete your account data through your account dashboard or by contacting us at the address below.
• Disconnect your Google account at any time, in the Service or at Google account permissions. Disconnection deletes Google-derived data within 30 days.
• Delete Matches at any time from your dashboard.
• Close your account by contacting us, at which point we delete or de-identify your data consistent with Section 7.
• Withdraw consent for non-essential processing where consent is the basis (for example, analytics cookies).

10.2 If You Are a Contact

If you are a Contact and you believe a Volunteer is using the Service to message you, you can:

• Reply to the Volunteer directly and ask them to remove you from their outreach.
• Contact us at privacy@getvouch.org and ask that we instruct the Volunteer to remove you, and that we suppress your information from future Matches.

For state-law rights, see Section 12.

10.3 Communication Preferences

Messages you receive through the Service are sent by individual Volunteers from their own Gmail accounts. Vouch Tech does not send any messages to Contacts; we only help Volunteers identify whom to contact and draft messages that the Volunteer then reviews and sends. To stop receiving messages from a particular Volunteer, reply to them directly. We are not able to control the sending behavior of individual Volunteers, but repeated reports about a Volunteer may result in our suspending that Volunteer's account.

11. Contact Us

For privacy or data-access questions, including questions about your Google account permissions, contact us at the email above.

12. U.S. State Privacy Rights

Depending on your state of residence, you may have the right to (i) know what personal information we collect, use, and share about you; (ii) access or obtain a copy of that information; (iii) correct inaccuracies; (iv) delete your information; (v) opt out of certain uses such as sale, sharing for cross-context behavioral advertising, or "targeted advertising" (we do not engage in these); (vi) opt out of profiling that produces legal or similarly significant effects (we do not engage in this); and (vii) appeal a denial of any of the foregoing.

To exercise these rights, contact us at the address above. We will verify your request consistent with applicable law. You may also designate an authorized agent to make a request on your behalf.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, please contact us at the address above and we will delete it.

14. International Users

The Service is operated in the United States, and information processed by us is stored and processed in the United States. If you access the Service from outside the United States, you understand and agree that your information will be transferred to, stored, and processed in the United States.

15. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice through the Service or by email before the changes take effect. The "Last Updated" date at the top of this Policy reflects the most recent revision.