Template notice: This is a starter privacy policy. Replace legal-specific language with text reviewed by your privacy counsel before publishing in production.

Privacy Policy

Last updated: 2026-06-15

1. Who we are

Vouch ("Vouch," "we," "us") operates the compliance operations platform available at vouchtraining.io. We are a US-based company providing software that lets HR and compliance teams generate training, run a confidential reporting channel, manage investigations, track vendor compliance, and produce audit-ready records.

2. What we collect

We collect:

Account data: name, email, hashed password, role within your workspace.
Workspace data: organization name, billing contact, plan, workspace settings.
Content you upload: policy documents, course content, learner attestations. This is your data; we process it on your behalf.
Usage data: log of which pages you view, which features you use, timestamps, IP address, user-agent. Used for security and product improvement.
Billing data: processed by Stripe under their privacy policy. We retain only the Stripe customer ID and subscription metadata, not card numbers.

3. Why we collect it

To deliver the Vouch platform (provide accounts, generate courses, record attestations).
To bill you (Stripe).
To detect and respond to security incidents.
To send transactional email about your account and content.
To improve the product, in aggregate, never by analyzing individual customer data without consent.

4. AI processing

When you generate a course or run a coverage check, the content of your uploaded policies and generated course is sent to Anthropic PBC for inference. Anthropic does not retain or train on this data under our enterprise agreement. See our Trust page for the full AI handling disclosure.

5. Sharing your data

We share data with:

Subprocessors necessary to operate the service (Anthropic, Railway, Stripe, Resend, Upstash). See the Trust page for the full list.
Authorized people in your own workspace, per the role-based access controls you configure.
Law enforcement, only when legally compelled and after notifying you when permitted.

We do not sell your personal data. We do not share it with advertisers.

6. Your rights

You can request access to your personal data, correction of inaccurate data, and deletion of your data, in accordance with applicable law (GDPR, CCPA/CPRA, etc.). To exercise a right, email privacy@vouchtraining.io. For California residents, the "Do Not Sell or Share My Personal Information" right applies — we do not sell or share, so this right is satisfied by default.

7. Retention

Account and workspace data is retained for the lifetime of your account. After account deletion, personal data is purged within 30 days, except where we are legally required to retain billing records. Audit-pack data and signed attestations are retained on the schedule you configure as the workspace admin; we recommend at least 7 years for HIPAA / harassment compliance.

8. Cookies

We use a small number of strictly-necessary cookies for authentication and session management. We do not use third-party advertising or analytics cookies.

9. Contact

Privacy questions: privacy@vouchtraining.io.

Effective 2026-06-15. We will give 30 days notice of material changes by email to workspace admins.