Privacy Policy
Effective date: May 25, 2026 | Last updated: May 25, 2026
1. Who We Are and Scope
Vouchstone LLC ("Vouchstone," "we," "us") is a California limited liability company located at 2000 Walnut Ave, Fremont, California 94538, United States. This Privacy Policy explains how we handle personal information when you visit vouchstone.ai, contact us, book a call, register for an account, or use our hosted platform, APIs and support (together, the "Services").
Our two roles. For account, billing, website and marketing information, we decide how information is used and act as the controller (or "business" under California law). For personal information contained in Customer Data that our customers upload or connect to the Services, we act as a processor (or "service provider") on the customer's behalf under our Data Processing Addendum. If your information is in a customer's workspace, please contact that customer about it; we will assist them in responding.
Self-hosted deployments. When a customer runs Vouchstone software in its own infrastructure, including under a perpetual licence in its own VPC or an air-gapped environment, we do not receive or access the data processed in that environment unless the customer shares it with us, for example in a support request.
2. Information We Collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact details | Name, business email, phone, company, job title | You, when you register, contact us or book a call |
| Account and credentials | Username, hashed password, SSO identifiers, MFA settings, role, seat assignment | You or your organization's administrator |
| Commercial and billing | Plan, seats, token usage, invoices, billing address, tax ID | You; our payment processing (we do not store full card numbers) |
| Communications | Contact-form messages, support tickets, call notes, survey responses | You |
| Usage and log data | Features used, API calls, agent runs, token consumption, timestamps, errors, audit-ledger entries | Automatically, from your use of the Services |
| Device and network | IP address, browser type, operating system, device identifiers, approximate location from IP | Automatically; cookies and similar technologies |
| Customer Data | Documents, code, schemas, business records and connector data that may include personal information about your employees, customers or others | Our customers (we act as processor) |
We do not intentionally collect sensitive personal information about website visitors or account holders. Customers may process sensitive data (such as health or financial data) in Customer Data under their own responsibility and our agreements with them.
3. How We Use Information
- Provide the Services: create and administer accounts, authenticate users, run agents and pipelines, and deliver support.
- Billing: calculate seats, token allowances and overage, invoice and collect payment, and prevent payment fraud.
- Security and integrity: monitor for abuse, enforce our Acceptable Use Policy, keep audit logs, and investigate incidents.
- Improve the Services: analyse aggregated or de-identified usage to fix bugs and improve features. We do not use Customer Data to train general-purpose AI models.
- Communications: send service, security and billing notices, respond to enquiries and, where permitted, send product updates you may opt out of at any time.
- Legal: comply with law, respond to lawful requests, and establish, exercise or defend legal claims.
4. Legal Bases (where GDPR-style laws apply)
Our Services are not directed to individuals in the European Economic Area or the United Kingdom. Where such laws nonetheless apply, we rely on: performance of a contract (providing the Services); legitimate interests (security, service improvement and business communications, balanced against your rights); legal obligation (tax, accounting and legal requests); and consent (non-essential cookies and certain marketing), which you may withdraw at any time.
5. How We Share Information
We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under California law. We disclose personal information only to:
- Service providers and sub-processors that help us run the Services, such as cloud hosting (Amazon Web Services) and AI model inference (large language model providers such as Anthropic and OpenAI), under contracts that restrict their use of the data. Our current list is published at vouchstone.ai/legal/subprocessors.
- Connected systems you choose. When you or your administrator enable a connector, data flows to and from that system as you direct.
- Your organization. If your account is provided by your employer, its administrators can access your account information and activity.
- Legal and safety. Where required by law or legal process, or to protect the rights, safety and property of Vouchstone, our customers or others.
- Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to confidentiality obligations and this Policy.
- With your consent or at your direction.
6. AI Model Providers
The hosted Services route certain processing to third-party large language models. Our model routing may use any of the providers named on our sub-processor list, currently Anthropic and OpenAI, and we will add others there before using them. We send only the data necessary for the requested task, over encrypted connections, under terms that prohibit the provider from using it to train its models.
Models you choose. If you select a specific model provider, or connect your own API keys ("bring your own key"), data sent to that provider is processed under your own agreement with it. That provider is your service provider, not ours, and its privacy terms apply. Sovereign and self-hosted deployments can run entirely on customer-controlled models with no external calls.
7. Cookies and Similar Technologies
We use strictly necessary cookies for sign-in, security and load balancing, and, only with your consent where required, analytics cookies to understand how our website is used. See our Cookie Policy for details and how to change your choices. We honour Global Privacy Control (GPC) browser signals as an opt-out of any non-essential tracking.
8. Data Retention
| Data | Retention period |
|---|---|
| Account and profile information | For the life of the account, then deleted within 30 days after closure |
| Customer Data (hosted) | For the subscription term; available for export for 30 days after termination; then deleted from active systems within a further 30 days and from backups on their normal rotation (maximum 90 days) |
| Billing and tax records | 7 years, or longer where required by law |
| Security and audit logs | Up to 1 year, or as configured by the customer for its own audit ledger |
| Contact-form and sales enquiries | Up to 2 years after last contact |
| De-identified or aggregated data | May be kept indefinitely, as it no longer identifies anyone |
9. Security
We use encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access controls, multi-factor authentication for staff, logging and regular access reviews. No system is perfectly secure, but we work to protect your information and will notify affected customers and individuals of a breach as required by law. See our Security Overview.
10. International Transfers
We are based in the United States, and hosted Services data is stored in AWS data centres in the United States (us-east-1) unless an Order Form specifies otherwise. If you access the Services from another country, your information will be transferred to and processed in the United States. Where the law of your country requires it, we use appropriate safeguards, such as Standard Contractual Clauses included in our Data Processing Addendum.
11. Your Rights
Depending on where you live, you may have the right to:
- know or access the personal information we hold about you;
- correct inaccurate information;
- delete your information;
- receive a portable copy;
- object to or restrict certain processing, and opt out of marketing;
- withdraw consent where processing is based on consent;
- nominate another person to exercise your rights in case of death or incapacity (India).
To exercise a right, email privacy@vouchstone.ai. We will verify your request using information associated with your account and respond within the time required by law (generally 30 to 45 days). You may use an authorized agent where the law allows, and we may ask for proof of that authorization. We will not discriminate against you for exercising your rights. If we decline your request, you may appeal by replying to our decision, and you may also complain to your local data protection authority.
12. California Privacy Notice
This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).
- Categories collected in the last 12 months: identifiers; customer records; commercial information; internet or other electronic network activity; approximate geolocation derived from IP; professional or employment-related information (such as job title). Sources, purposes and recipients are described in Sections 2, 3 and 5.
- Sale and sharing: we do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing personal information of anyone under 16.
- Sensitive personal information: we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use.
- Retention: see Section 8.
- Your rights: to know, delete, correct, and to be free from discrimination for exercising your rights. Submit requests to privacy@vouchstone.ai.
13. India: Digital Personal Data Protection Act, 2023
Where the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules apply, we act as a data fiduciary for account information and as a data processor for Customer Data processed on behalf of our customers. You may exercise your rights to access, correction, erasure, grievance redressal and nomination, and withdraw consent, as easily as you gave it. Our Grievance Officer is:
Renu Gupta, Grievance Officer | Email: renu@vouchstone.ai | Vouchstone LLC, 2000 Walnut Ave, Fremont, California 94538, United States
We will acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.
14. Children
The Services are for business users aged 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact privacy@vouchstone.ai and we will delete it.
15. Changes to This Policy
We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify account holders by email or in the Services at least 30 days before the change takes effect.
16. Contact Us
Vouchstone LLC, 2000 Walnut Ave, Fremont, California 94538, United States
Privacy requests and questions: privacy@vouchstone.ai | Legal: legal@vouchstone.ai | India Grievance Officer: renu@vouchstone.ai