Privacy policy

This policy covers Vouched Cloud, the hosted service at vouchedhq.com ("we", "us"). Vouched is also open-source software: if you run your own copy, you're the operator of that copy and this policy doesn't apply to it.

What we collect

• Your account: your name, email address and sign-in method, handled by our sign-in provider, Clerk.
• Websites you add: each site's name and domain, and the Search Console and Google Analytics properties you link to it.
• Google data you connect: covered in detail in the next section.
• API keys: we store only a one-way hash of each key, never the key itself.
• Usage records: which tools were called and when, the cost of each paid market-data call, and daily call counts, used for quotas, billing and preventing abuse.
• Billing: your plan, subscription status, payment-provider customer id and wallet transactions. Card details go straight to our payment provider, Dodo Payments, and never reach us.
• Team invites: the email address of each person you invite.
• Emails we send you: we keep a copy of account and billing emails, to answer support questions and check they're delivered.
• Technical data: our hosting provider, Cloudflare, processes IP addresses and request details to deliver and protect the service.

Google user data

When you connect Google, you choose which access to grant. We request read-only access, and only what each feature needs:

• Search Console (webmasters.readonly): search performance, URL indexing status and sitemaps for the properties you own.
• Google Analytics (analytics.readonly): reports for your GA4 properties, and the list of those properties so you can pick one.
• Your Google email address (openid email): to show which Google account is connected.

How we use it. Only to answer the requests you, or the AI assistant you connect with your API key, make through Vouched. We fetch it when you ask for it and return it to you.

How long we keep it.

• Your Google access tokens are stored until you disconnect Google or delete your account.
• Search Console responses are cached for between 1 and 6 hours, so repeated identical questions don't re-query Google.
• Google Analytics responses aren't stored.
• When a Search Console result is too large to return at once, the full result is kept for 7 days so your assistant can download it, then deleted.
• We don't keep any other copy of your Google data.

What we never do with it. We don't sell it. We don't use it for advertising. We don't use it to develop, improve or train AI or machine-learning models. We don't share it with anyone except to deliver it to you. People at Vouched don't read it, unless you ask us to (for example, to help with a support request), or it's needed for security or to comply with the law.

Limited Use. Vouched's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access. Disconnect Google anytime from Settings in your dashboard, which deletes the stored tokens. You can also revoke access from your Google Account permissions page.

Your AI assistant

Results go to the MCP client you connect with your API key, such as Claude or Cursor. Once there, that client's provider handles them under its own privacy policy, which you choose and control.

Who we share data with

Only the service providers that run parts of Vouched, each for its own purpose:

• Cloudflare: hosting, database and file storage.
• Clerk: sign-in and account management.
• Dodo Payments: payments, as our merchant of record.
• xmit.sh (sending through Amazon SES): account and billing emails.
• DataForSEO: paid market data. It receives the keywords, domains and URLs your requests ask about, never your Google data.
• Google Fonts: loads the fonts on our pages, so Google sees your IP address when you visit.

We don't sell personal data. We may disclose data where the law requires it.

Cookies

We use only the cookies needed to keep you signed in, set by us and Clerk. No advertising or analytics trackers.

Retention and deletion

We keep account data while your account is open. To delete your account and its data, email hello@vouchedhq.com. We'll do it within 30 days, except records we must keep by law, such as billing records.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it, by emailing hello@vouchedhq.com. Depending on where you live, you may also be able to complain to a data protection authority.

Security

Everything is served over HTTPS. API keys and invite links are stored only as one-way hashes. Google access is read-only and limited to what each feature needs.

Children

Vouched isn't meant for anyone under 16, and we don't knowingly collect their data.

Changes

If we change this policy, we'll update the date above. For significant changes, we'll also email account holders before they take effect.

Contact

Questions about privacy: hello@vouchedhq.com.