Data protection
Subprocessors
The outside companies that process personal data so Vouched can run, what each one receives, and where it does that work. Each processes data only on our instructions, except the AI providers marked below, whose own terms let them use what they receive to improve their models. They receive what you write, or data about you, only if you turned AI features on; they also receive public posts we research, which are public already.
Last updated 6 October 2026
| Company | What for | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Everything in your account, including identity documents and payout details | Singapore |
| Vercel | Hosting and running the website | Requests to the site, including IP address, and data passing through it | Singapore (functions); global network for static pages |
| Resend (Plus Five Five, Inc.) | Sending email | Your email address and the content of emails we send you | United States |
| Sentry (Functional Software, Inc.) | Recording errors so we can fix them | Error details, scrubbed of names, emails, IP addresses, cookies, form input, personal links and phone numbers | United States |
| PostHog, Inc. | Counting page visits, only after you accept analytics | Pages visited, browser and device type; IP address received and discarded | United States |
| Cloudflare, Inc. (Turnstile) | Telling people from bots on sign-in, signup, the waitlist and the contact form | Browser signals and IP address during the check | Global network |
| Google (YouTube API Services) | Reading the YouTube channel and posts you connect | The YouTube data described in section 04 of the privacy policy | United States |
| Expo (650 Industries, Inc.) | Delivering notifications to the Vouched app | Your device's push token and the notification text | United States |
| Monid | Reading public TikTok profiles and post counts | Public handles and public post figures | Not published by the provider |
| Jina AI (Elastic N.V.) | Reading a public web page we are asked to read, such as a brand's website | The page address and its public content | Not published by the provider since its acquisition |
| Oracle Cloud | Runs the render worker that fixes audio and prepares deliveries | Creators' raw footage and the finished files delivered to brands | Singapore |
| PayMongo | Payments for Creator Pro (one-off and renewing) and brand wallet top-ups | The payer's name, email and payment details, entered on PayMongo's own pages | Philippines |
| OpenRouter, Inc.Your data only with AI consent | Routes AI drafting requests to the model maker that answers them | The text the feature works on, which can include what you wrote and names in it | United States |
| Google (Gemini, through OpenRouter)Your data only with AI consent | AI drafting and independent grading of AI output | The text the feature works on, which can include what you wrote and names in it | United States |
| DeepSeekYour data only with AI consent | AI drafting: briefs, proposals, openers, summaries | The text the feature works on, which can include what you wrote and names in it | China |
| Alibaba Cloud Model Studio (Qwen), if that slot is pointed at itYour data only with AI consent | AI drafting and independent grading of AI output | The text the feature works on, which can include what you wrote and names in it | Singapore |
| Zhipu AI (GLM), directly or through OpenRouterYour data only with AI consent | AI drafting, used when the others are unavailable | The text the feature works on, which can include what you wrote and names in it | China |
Business users are told at least 14 days before a new subprocessor is added, as the data processing agreement says. How we handle your own data is in the privacy policy.