Privacy Notice
Last updated: 22 June 2026
This Privacy Notice explains how VLAYER LABS LTD ('Vouch PRO', 'we', 'us', 'our') collects, uses, shares, and protects your personal data when you use the Vouch PRO platform. Please read it carefully before creating an Account.
| Data Controller | VLAYER LABS LTD |
| Registered address | 101 New Cavendish Street, 1st Floor South, London, United Kingdom, W1W 6XH |
| Company number | 15480811 |
| Data Protection contact | privacy@vlayer.xyz |
| UK ICO registration | ZC177705 |
| Date of last update | 22 June 2026 |
VLAYER LABS LTD has not appointed a Data Protection Officer. Privacy queries sent to the address above will be routed to the appropriate person.
1. About This Notice
This Privacy Notice applies to:
- individuals who create an account on the Vouch PRO platform ("Clippers");
- visitors to our website at https://getvouch.pro.
It does not apply to personal data we process as a data processor on behalf of Brand customers (that processing is governed by the Data Processing Agreement forming part of the Cooperation Agreement with each Brand).
We act as a data controller in respect of the personal data described in this Notice. When we share your data with a Brand in connection with a Campaign, we consider the Brand to be an independent data controller from the point of receipt. Where we use third-party sub-processors, they act on our instructions. This Notice is drafted to comply with UK GDPR and the UK Data Protection Act 2018 ("DPA 2018"), and with EU GDPR (Regulation (EU) 2016/679), given that our Clippers include individuals habitually resident in the European Economic Area. It also aims to address the expectations of clippers from other jurisdictions (including the United States, though no US-specific statutory regime applies to Vouch PRO at this time).
2. Personal Data We Collect and How We Collect It
2.1 Data You Provide Directly
| Category of Personal Data | Examples / Details |
|---|---|
| Account identity data | Email address (primary identifier); name (if provided during registration or profile setup) |
| Social Media Account identifiers | Handles, usernames, and profile identifiers on Instagram, X (Twitter), TikTok, YouTube, and other platforms you connect |
| Profile and account data | Profile creation dates; account type; account status indicators derived from connected Social Media Accounts |
| Payment information | Preferred payment method; payment account details collected via and processed by our third-party Payment Provider; we do not store full payment credentials ourselves |
| Communications | Content of messages you send us through support channels, feedback forms, or email |
2.2 Data Collected Automatically or via Verification Technology
| Category | Details |
|---|---|
| Social Media performance data | View counts, likes, comments, shares, saves, watch time, reach, impressions, and other engagement metrics as made available by the relevant platform's API or data layer |
| Audience demographics | Aggregate audience data including age range distribution, gender breakdown, geographic location (country/region level), and language preferences — as reported by the connected social media platform's analytics tools |
| Content metadata | URLs, post dates, post types, captions, and other metadata relating to Content you submit in connection with a Campaign |
| Cryptographic proof artefacts | Digital proofs (zero-knowledge or TLS-based attestations) generated by the Verification Technology attesting to Social Media Account ownership and the authenticity of performance data |
| Technical and device data | IP address, browser type, device identifiers, operating system, referring URLs, and session activity logs — collected through standard web analytics |
Important: We do not access the content of private messages on any Social Media Account. We access only the data you explicitly authorise us to retrieve when connecting a Social Media Account.
2.3 Data from Third Parties
We may receive data about you from:
- Social Media Platforms: technical account identifiers, profile data, and analytics data returned via API or web proof flows when you connect a Social Media Account;
- Payment Providers: transaction status and confirmation information;
- Brands: confirmation of Campaign participation, acceptance, or rejection decisions;
- Identity verification providers (if applicable in future): results of identity checks.
3. Purposes and Legal Bases for Processing
| Purpose | Categories of Data Used | Legal Basis |
|---|---|---|
| Account registration and authentication | Email address, name | Performance of a contract (UK GDPR Art. 6(1)(b)) |
| Social Media Account linking and cryptographic verification | Handles, performance data, audience demographics, cryptographic proof artefacts | Performance of a contract (Art. 6(1)(b)); your explicit consent where processing demographic data |
| Campaign matching, participation, and performance tracking | All social data; content metadata; KPI metrics | Performance of a contract (Art. 6(1)(b)) |
| Sharing data with Brands for Campaign reporting | Handles, content links, performance stats, demographic data, proofs | Legitimate interests (Art. 6(1)(f)) — sharing results of campaigns a Clipper has chosen to join; and/or consent |
| Processing Rewards / payment facilitation | Payment method, transaction confirmations | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) — e.g., anti-money laundering |
| Platform analytics, security, and fraud prevention | Technical and device data; account activity logs | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Any data required by law | Legal obligation (Art. 6(1)(c)) |
4. Who We Share Your Personal Data With
4.1 Brands
When you apply to and participate in a Campaign, we share the following data with the relevant Brand, for the purpose of administering the Campaign and verifying your eligibility:
- your social media handle(s) and profile identifiers on the relevant platforms;
- links to Content you have submitted in connection with the Campaign;
- content performance statistics (views, engagement rate, reach, impressions, etc.);
- audience demographic data (aggregate age, gender, location distributions);
- cryptographic proof artefacts generated by the Verification Technology, attesting to the above.
Brands are independent data controllers in respect of any personal data we share with them in connection with a Campaign. Brands are required, under their Cooperation Agreement with Vouch PRO, to use shared personal data only for the purpose of managing the Campaign and to comply with applicable data protection law.
4.2 Sub-Processors
We share controller-side personal data only with the following categories of recipients, under appropriate contracts:
- Cloud infrastructure providers that host our systems.
- Security, anti-fraud and content-delivery providers.
- Software bug-tracking and crash-reporting providers.
We do not sell personal data, and we do not use personal data to serve targeted advertising.
4.3 Other Disclosures
We may also disclose your personal data to:
- law enforcement, regulators, or courts where required by applicable law;
- professional advisers (legal, financial, audit) under obligations of confidentiality;
- a buyer or successor in the event of a merger, acquisition, or sale of our business (you will be notified in advance).
5. Data Retention
We retain your personal data for as long as your Account is active and for a period of up to 3 years after Account closure or last activity, whichever is later, unless a longer period is required by law.
| Data Category | Retention Period |
|---|---|
| Account identity data (email, name) | Duration of Account + 3 years post-closure |
| Social Media Account identifiers and linked handles | Duration of Account + 3 years post-closure, or until you disconnect the relevant account |
| Performance and audience demographic data | Duration of Campaign + 3 years, or 3 years post-Account-closure |
| Cryptographic proof artefacts | Duration of Campaign + 3 years |
| Payment information | Retained by Payment Provider per their terms; we retain transaction records for 7 years for accounting/legal purposes |
| Technical and device logs | Up to 12 months |
| Support communications | 3 years from last communication |
On expiry of the retention period, personal data is securely deleted or anonymised. Anonymised data (which can no longer identify you) may be retained indefinitely for aggregate analytics.
6. International Data Transfers
Vouch PRO is incorporated and primarily operates in the United Kingdom. We aim to process your personal data within the EEA/UK where possible. However, certain sub-processors listed in Section 4.2 (including Neon, Vercel, Clerk, Airbyte, Metabase, and Elastic) may process data on servers located in the United States or other third countries.
Where personal data is transferred outside the EEA or UK, we ensure one or more of the following safeguards is in place:
- an adequacy decision by the UK Secretary of State or the European Commission in respect of the destination country (e.g., the UK-US Data Bridge or the EU-US Data Privacy Framework for US transfers where applicable);
- Standard Contractual Clauses (SCCs) — the European Commission's 2021 SCCs for EEA-to-third-country transfers, or the UK International Data Transfer Agreement (UK IDTA) or UK Addendum to SCCs for UK-to-third-country transfers;
- where required, supplementary technical and organisational measures (e.g., encryption in transit and at rest) to address the results of a transfer impact assessment.
You may request details of the specific safeguards in place for any particular transfer by contacting us at privacy@vlayer.xyz.
7. Your Rights
| Right | What it means |
|---|---|
| Access | You can request a copy of the personal data we hold about you. |
| Rectification | You can ask us to correct inaccurate or incomplete personal data. |
| Erasure ('right to be forgotten') | You can ask us to delete your personal data in certain circumstances (e.g., where it is no longer necessary for the purpose for which it was collected). |
| Restriction of processing | You can ask us to restrict processing of your personal data in certain circumstances (e.g., if you contest its accuracy). |
| Data portability | You can ask us to provide your personal data in a machine-readable format or transfer it to another controller, where processing is based on consent or contract and carried out by automated means. |
| Objection | You can object to processing based on legitimate interests; we will stop unless we have compelling legitimate grounds. You can also object at any time to direct marketing. |
| Withdrawal of consent | Where processing is based on your consent (e.g., sharing demographic data with Brands), you can withdraw consent at any time without affecting the lawfulness of prior processing. |
| Rights in automated decision-making | We do not currently make solely automated decisions about you that produce significant legal or similarly significant effects. If this changes, we will update this Notice. |
If you are an EEA resident, you have the right to lodge a complaint with your national supervisory authority. In the UK, the supervisory authority is the Information Commissioner's Office (ICO): www.ico.org.uk.
8. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:
- encryption of data in transit (TLS) and at rest;
- access controls and role-based permissions;
- regular security testing and vulnerability assessments;
- incident response and breach notification procedures compliant with Article 33 UK GDPR / EU GDPR (notification to the ICO / competent supervisory authority within 72 hours of becoming aware of a breach; notification to affected individuals where required).
No method of electronic transmission or storage is completely secure. While we take all reasonable steps, we cannot guarantee absolute security.
9. Cookies and Tracking Technologies
We might use cookies and similar technologies on our website and platform for:
- essential functionality (session management, authentication);
- performance analytics (understanding how users interact with the Platform);
- security purposes (fraud detection, bot prevention).
We do not use cookies for behavioural advertising. Should cookies and similar technologies be used, you will be able to manage your cookie preferences through the cookie settings banner displayed on your first visit to the Platform.
10. Children
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 18 without verified parental consent, we will take steps to delete it promptly. If you believe we hold data relating to a child, please contact us at privacy@vlayer.xyz.
11. Links to Third-Party Sites
The Platform may contain links to third-party websites (including social media platforms). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy notices before providing any personal data to them.
12. Changes to This Notice
We may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. Where we make material changes, we will notify you by email (to the address associated with your Account) or via a prominent notice on the Platform, at least 30 days before the changes take effect. The updated Notice will be effective from the 'Effective Date' shown at the top.
13. Contact Us
For any questions, concerns, or to exercise your rights, please contact:
VLAYER LABS LTD
101 New Cavendish Street, 1st Floor South, London, United Kingdom, W1W 6XH
Email: support@vlayer.xyz
Website: https://getvouch.pro