Vouch — Consumer Loyalty & Rewards

1. Introduction

VOUCH ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

VOUCH is operated by V Patch Marketing Agency [WE PATCH IT SOLUTIONS CO. L.L.C.].

2. Program Nature, Invoices, and Redemptions

VOUCH is a Consumer Loyalty and Market Research platform. The service is designed for private consumers participating in registered sales promotions—not for professional media services, paid commercial advertising production, or standalone paid social campaigns sold as professional media placement services.

Members participate as private consumers sharing genuine personal experiences of products they have personally purchased. Optional public posts reflect customer satisfaction and are not offered or priced as professional creative or media placement services.

“Redemptions” means cashback rebates on verified personal expenditures only, evidenced by a valid Tax Invoice (TRN receipt). Redemptions are not wages, talent fees, or compensation for professional advertising or media services.

A valid Tax Invoice (TRN receipt) is mandatory for every redemption. The invoice demonstrates that you are a paying customer with a genuine purchase; your optional public sharing of satisfaction is a personal consumer expression and review right, not a commercial advertisement sold to brands.

Redemptions are provided as rebates for verified personal expenditures only. You acknowledge that any public sharing you choose to make is an expression of personal consumer satisfaction within a registered sales promotion, and not independent commercial advertising services.

3. Information We Collect

Personal Information

When you register with VOUCH, we collect information including: name, email address, phone number, location, and banking information used for redemption payouts (IBAN).

Identification Information

For KYC (Know Your Customer) compliance, we collect and encrypt your Emirates ID information. This data is encrypted at rest using AES-256-GCM encryption and never stored in plain text.

Social Media Data

We collect information from your connected social media accounts (Instagram, TikTok, YouTube, Facebook, and Snapchat) only for the purpose of verifying completed loyalty requirements. Access tokens are encrypted and stored securely.

TikTok Login Kit

When you connect TikTok through VOUCH, you authorize TikTok Login Kit. We receive only the profile data you approve under the requested scope (typically your TikTok display name, avatar, and basic account identifier). We use this solely to link your account, verify loyalty requirements, and show your connected handle inside VOUCH. We do not post to TikTok on your behalf. You can disconnect TikTok at any time in VOUCH under Social Profiles or revoke access in your TikTok account settings. TikTok's own privacy policy governs data TikTok collects during login: https://www.tiktok.com/legal/privacy-policy

YouTube (Google OAuth)

When you connect YouTube through VOUCH, you authorize Google OAuth with read-only YouTube access. We receive your channel name, channel identifier, and public statistics (such as subscriber count) to link your account and verify loyalty requirements. We do not upload videos or modify your channel. Disconnect in VOUCH Social Profiles or revoke access in your Google Account permissions. Google's privacy policy applies: https://policies.google.com/privacy

Sharing of Google User Data

VOUCH accesses Google user data only after you connect YouTube in Social Profiles. The Google user data we receive is limited to your YouTube channel name, channel identifier, public subscriber count, and encrypted OAuth tokens needed to maintain read-only access. We store this data encrypted on our servers. We do not sell, rent, or transfer Google user data to advertising platforms, data brokers, credit agencies, or information resellers.

Google user data may be shared, transferred, or disclosed only to the following parties and solely for the purposes described:

WE PATCH IT SOLUTIONS CO. L.L.C. (operator of VOUCH): employees and contracted support personnel who need access to operate the platform, investigate abuse, or respond to your support requests.
Supabase (cloud database host): stores encrypted YouTube OAuth tokens and linked channel profile fields on our behalf under data-processing terms.
Vercel (application hosting): hosts the VOUCH API and member web app; Google user data passes through our secured infrastructure only to provide the connected features you see in the app.
Participating brand partners: when you submit a loyalty requirement tied to an offer, we may disclose your connected YouTube channel name and public subscriber count to that brand solely to verify eligibility — not your OAuth tokens or private Google account details.
Legal and safety authorities: only if required by applicable law or to protect against fraud, abuse, or security incidents.

We do not use Google user data for advertising, retargeting, credit decisions, or AI model training. You may disconnect YouTube in VOUCH Social Profiles or revoke VOUCH in your Google Account permissions at any time. For Google's own policies see https://policies.google.com/privacy and https://developers.google.com/terms/api-services-user-data-policy.

Facebook Login

When you connect Facebook through VOUCH, you authorize Facebook Login (Meta). We may receive your public profile name, email (if granted), and information about Facebook Pages you manage, including Page name and follower count. We use this solely to link your account and verify loyalty program requirements. We do not post to Facebook on your behalf. Disconnect in VOUCH Social Profiles or revoke the app in Facebook Settings. Meta's policy applies to data Meta collects: https://www.facebook.com/privacy/policy

Snapchat Login Kit

When you connect Snapchat through VOUCH, you authorize Snapchat Login Kit. We receive only the profile data you approve (typically display name and a stable account identifier) to link your account and verify loyalty requirements. We do not post Snaps on your behalf. Disconnect in VOUCH Social Profiles or revoke access in Snapchat settings. Snapchat's privacy policy applies: https://values.snap.com/privacy/privacy-policy

Technical Information

We automatically collect certain technical information including IP address, device type, operating system, and usage analytics to improve our service and detect fraud.

4. How We Use Your Information

To provide and maintain our platform
To process redemptions, tax-invoice verification, and banking payouts
To verify your identity and comply with legal requirements
To detect and prevent fraud
To improve our services and user experience
To communicate with you about your account

5. Data Security

We implement comprehensive security measures to protect your information:

Encryption: Sensitive data (Emirates ID, passwords, OAuth tokens) are encrypted using AES-256-GCM
HTTPS/TLS: All data in transit is secured with TLS 1.3
Database Security: PostgreSQL databases are encrypted at rest and access-controlled
Jailbreak Detection: On mobile, we detect and disable sensitive operations on compromised devices
Authentication: Passwords are hashed using Argon2id; tokens use secure refresh rotation

6. Data Retention

We retain personal information only as long as necessary to provide VOUCH, meet legal obligations, and protect against fraud. Specific retention periods include:

Active account profile, KYC, wallet, and connected social data: retained while your account is active.
Deleted accounts: deactivated immediately; most personal data is permanently deleted after 45 days unless you restore your account within that window.
Receipt, KYC image, and submission records tied to verified redemptions: retained as needed for fraud investigation, dispute handling, and UAE regulatory compliance.
Transaction, payout, and audit logs: retained for compliance, accounting, and security purposes as required by law.
Push notification tokens and device analytics: removed or anonymized when no longer needed for app functionality.

When you delete your VOUCH account, we deactivate it immediately. Your data is retained for 45 days so you can restore your account if you return, then permanently deleted after the retention period unless we must keep specific records for fraud prevention, security, or legal compliance.

7. Regulatory Compliance

VOUCH is operated by V Patch Marketing Agency [WE PATCH IT SOLUTIONS CO. L.L.C.]. Data processing for VOUCH is handled in line with UAE digital marketing rules, including the NMA Advertiser Permit Guide (Decision No. 3 of 2025).

8. Your Rights

You have the right to:

Access your personal information
Request correction of inaccurate data
Request deletion of your account and associated data
Withdraw consent for optional data processing where applicable

To delete your account, open the VOUCH member app, go to Profile → Legal → Delete Account, or visit https://vouch.vpatch.ae/delete-account/ for the same steps and policy. You may also email info@vpatch.ae from your registered email address to request account deletion.

To exercise your privacy rights, contact info@vpatch.ae from your registered email address or use the in-app account deletion flow. We respond to verified requests within reasonable timeframes required by applicable law.

9. Third-Party Services

We use third-party services for:

Redemption payout processing and banking connections
Social media verification (Instagram, TikTok, YouTube, Facebook, and Snapchat APIs)
Cloud infrastructure (AWS, Google Cloud)
Analytics and error tracking

These third parties are contractually obligated to protect your data with the same level of security we provide.

10. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

V Patch Marketing Agency [WE PATCH IT SOLUTIONS CO. L.L.C.]

Dubai, United Arab Emirates

info@vpatch.ae

11. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Effective Date" at the top of this policy.