Privacy policy

Vouched operates this platform and decides how your personal data is handled. Under the Data Privacy Act of 2012 (RA 10173) that makes us the personal information controller.

If you want anything on this page explained or acted on, contact us and a person will answer. We do not route privacy requests to a bot.

Account details: your name, email and password. Without these there is no account.

Waitlist details, if you join the waitlist: your name, email and the answers you give on the form, such as your handle, platforms, audience size, niche, company or budget. We use them to choose who to invite, and email you about your spot: a confirmation when you first join, and an invitation when a spot opens. Only if you tick the box for it, we also send occasional news about Vouched; ask us and we stop.

Identity documents: a government ID and, for creators, a payout account whose name matches it. This exists because brands are handing money to strangers, and because we cannot send a payout to a name we never checked.

Social account data: your handles, follower counts, view counts and audience geography. Where a platform lets us read it, we measure it ourselves from your public profile or, if you connect the account, from the platform directly. Where neither is possible we label the figure as declared rather than passing your own number off as measured. See section 04 for connected accounts.

Work and payment records: submissions, approvals, earnings and payouts. These are financial records and are kept even after an account closes.

Business details, for brands: registration numbers, TIN, contact person, and any certificates you upload. This exists so creators can trust that a funded campaign is a real business.

Technical data: IP address and device information in server logs, used for security and abuse prevention.

App notifications: if you use the Vouched app and allow notifications, a token for your device so we can send them. It is deleted when the app unregisters it, when your device stops accepting notifications, or when you close your account.

What you ask our AI features to work on, only if you turned them on: see section 12.

Government IDs are sensitive personal information under RA 10173, which means we need your consent and a higher standard of care. We collect them only for identity and payout verification, never for marketing, and we never sell them.

You can connect a social account (TikTok, YouTube, Instagram and others as we add them) so we can read the performance of the posts you submit. Connecting is always your choice. Nothing is connected by default, and you can use Vouched without connecting anything.

When you connect an account, we ask that platform only for what a campaign actually needs: your account identity, and for the specific posts you submit to a campaign, their performance figures such as view counts. For YouTube we also read your channel's subscriber count and where its views come from, which is what verifies the channel as yours (see below). We do not read your private messages, we do not post on your behalf, and we do not browse content you did not submit.

We use this to check that a post you submitted is really yours, and to count the views a brand is paying for. That is the entire purpose. It is not used for advertising, it is not sold, and it is not shared with brands as raw platform data; a brand sees the verified figures for the campaign they funded, not access to your account.

Every reading is stored with its source and the time it was taken, so if you ever disagree with a number you can see exactly what we read and when, and dispute it.

YouTube. When you connect a YouTube channel, Vouched uses YouTube API Services. By connecting, you agree to be bound by the YouTube Terms of Service (www.youtube.com/t/terms). Google's own handling of your data is covered by the Google Privacy Policy (www.google.com/policies/privacy).

What we read from YouTube: your channel's ID and @handle, its subscriber count, and the countries its views came from over the last 90 days; and, for each post you submit to a campaign, its views, engaged views, watch time, average view duration, likes, comments, shares and subscribers gained. The access is read-only, and we never ask for your earnings.

How it is used and who sees it: your @handle and subscriber count verify the channel as yours and appear on your creator profile, and the country split shows brands where your audience is. The brand running a campaign you post for sees that post's figures, except engaged views, which Vouched uses for its own quality checks and does not show to brands. Nothing read from YouTube is sold or used for advertising.

You can disconnect an account at any time from your Vouched settings. For YouTube, disconnecting revokes our access with Google and deletes everything we read through the connection, including the figures on your posts. You can also remove Vouched's access on Google's security settings page (security.google.com/settings/security/permissions); when you do, we delete what we read through YouTube within 30 days.

Figures a payment was based on are not deleted by a disconnect, because they never came through the connection: payouts are counted from the platform's public view counts, which stay on the record as the evidence behind a payment that was made.

Data received from a connected platform is kept only while the account stays connected. We confirm with the platform at least every 30 days that your permission still stands, and delete what we read when it does not. It is handled under the same protections as everything else on this page.

Questions or complaints about how we handle data from a connected account go to our contact page (www.vouched.ph/contact), where a person answers.

Brands you work with see your creator profile, your verified metrics and the work you submit to them. They do not see your ID, your payout details or your address.

Your team lead, if you join a team, sees the work you do and what your payouts were, because that is what their commission is calculated from. They do not see your ID or payout details.

Our processors: Supabase for the database and file storage, Vercel for hosting, Resend to deliver our emails, Sentry to record errors in the app so we can fix them, PostHog to count visits to our pages (only if you accept analytics), Cloudflare Turnstile to tell people from bots on the sign-in, signup, waitlist and contact forms, Google to read a YouTube channel you connect, Expo to deliver app notifications, Monid to read public TikTok profiles, Jina AI to read a public web page we are asked to read, the AI providers in section 12 (only if you turned AI features on), and payment providers to actually move money. Sentry is set up not to collect your name, email address, IP address, cookies or anything you typed into a form, and personal links, email addresses and phone numbers are blanked out of what it does receive, including the address of the page where an error happened. Each is bound to process data only on our instructions, except the AI providers in section 12, whose own terms let them use what they receive to improve their models; that is why those features wait for your consent. The full list, with what each receives and where, is at www.vouched.ph/subprocessors.

Government agencies where the law requires it, such as a lawful order or a BIR or AMLA obligation.

We do not sell personal data. There is no version of this business where that becomes acceptable.

Our database and website run in Singapore, and several processors work in the United States, so your data crosses borders. If you turn AI features on, what they work on is also sent to providers in China, Singapore and the United States (section 12). RA 10173 allows this and holds us responsible for it regardless of where it sits, which is the standard we work to.

Account and profile data: while your account is open, then one year.

Financial records including payouts and receipts: ten years, because tax and anti-money-laundering rules require it. This is why closing an account does not erase what you were paid.

Notices we send business accounts under the data processing agreement, such as a new subprocessor: the account name and the email address each went to, kept for five years from the notice as proof it was given, even if the account closes or is erased in that time.

Identity documents: while the account is open, then five years, then deleted.

Waitlist details: until you ask us to delete them.

Server logs: twelve months.

You can ask what we hold about you and get a copy in a portable form. You can correct anything wrong. You can object to processing, and you can ask us to delete data we no longer have a lawful reason to keep.

You can withdraw consent at any time. Where we still have a legal duty to keep something, such as a payout record, we tell you which duty rather than refusing without explanation.

You can complain to the National Privacy Commission. We would rather you told us first so we can fix it, but that route is yours regardless.

We answer requests within fifteen working days.

Access to your rows is enforced in the database itself, not only in the app, so a bug in a page cannot expose another person's data. Payout details, identity documents and financial records are restricted further.

If a breach puts you at real risk, we notify you and the National Privacy Commission within 72 hours of knowing. We would tell you anyway.

We use cookies that are necessary to keep you signed in. These cannot be turned off without breaking sign-in.

Analytics wait for your answer. When you first visit, a banner asks whether we may count your visits; Accept and Reject are side by side, and rejecting changes nothing else about the site. Until you accept, no analytics code runs. We keep your answer in your browser so we do not ask on every page, and you can change it at any time from the Cookie settings link in the site footer.

Sentry runs whatever you answer, because it is how we find out the site is broken for you. It is set up as section 05 describes. It also times about one in ten page loads, with the page address scrubbed the same way, so we can find slow pages; that is never used to count or profile visitors.

If you accept, we count visits with PostHog, set to use no cookies. It records which pages are visited, with your browser, operating system, device type and screen size. It does not record your screen or what you type, it never links visits to your account, and personal links, email addresses and phone numbers are blanked from page addresses before they are sent. Like any website, PostHog receives your IP address and browser details with each visit; it uses them only to count unique visitors for the day, and is set to discard the IP address rather than store it. PostHog processes this in the United States as our processor. Any analytics tool we add later will be named here first.

You must be at least 18 to earn money on Vouched. We do not knowingly collect data from minors, and we delete it if we find it.

Some features draft text for you: briefs, proposals, openers, summaries of disputes and appeals, and reads of a brand's public website. To do that they send the text involved, which can include what you wrote and the names in it, to outside AI providers: DeepSeek in China; Alibaba Cloud (Singapore) and Zhipu AI (China), directly or through OpenRouter in the United States, which passes it to the model that answers; and Google (United States), through OpenRouter.

Those providers' published terms allow them to use what they receive to improve their models. So these features are off until you turn them on in your settings, and nothing is sent to them for you before that. You can turn them off at any time, and from then on nothing more is sent. Features that need AI simply stay unavailable while it is off; everything else works the same.

When our staff ask for an AI summary of a dispute or an appeal, it runs only if everyone on both sides has turned AI features on; otherwise a person reads the case without it.

Separately, we use the same providers on content that is already public: the titles, captions, public comments and spoken lines of public posts we read for research. That never includes anything you sent us privately.

Vouched does not train any AI model on your data and does not sell it. What the providers above may do with what they receive is set by their own terms, which is why these features wait for your yes.