Your data should not be a mystery.
This notice explains what Vouch collects, why we use it, who receives it, how long we keep it and the choices you have. It applies to vouchfor.uk, Vouch accounts, reviews, venue claims, surveys, emails, maps, points and prize draws.
Effective 25 August 2026
Who is responsible
Vouch is the controller of the personal information covered by this notice. Vouch operates from London, United Kingdom.
For privacy questions or to exercise a right, email [email protected]. Put “Privacy” in the subject line. We may ask for proportionate information to confirm your identity before acting on a request.
What we collect
- Account data: email address, public handle, neighbourhood, account status and role.
- Reviews: venue, score, written take, price band, occasion, selected attributes, submission time, confirmation status and any photographs you submit.
- Visit evidence: a receipt or booking confirmation supplied to confirm a visit. This is private and is not published.
- Rewards and draws: points, badges, eligibility records, draw month and neighbourhood; for the free entry route, your name and email address; and, if you win, the contact and fulfilment details needed to provide the voucher.
- Venue claims: contact name, role, business email, optional phone number and corrections or notes.
- Quiz and research: answers you submit and an email address only if you choose to leave one for results and Vouch updates.
- Correspondence: messages, preferences, unsubscribe status and records of support or privacy requests.
- Technical data: IP address, browser and device information, request time, pages requested, security events, session identifiers and neighbourhood preference.
We do not ask for special category information. Please do not place health, religious, political or other sensitive personal information in a public review.
Where it comes from
Most information comes directly from you. Venue listing information may also come from public registers, venue websites, venue social accounts, delivery platforms, mapping sources, food publications and corrections supplied by venues or readers. Where a business is run by a sole trader, some public business information may also be personal information.
Why we use it
| Purpose | Lawful basis |
|---|---|
| Create and operate accounts, send sign-in links, publish reviews, keep profiles and award points. | Performance of our agreement with you and steps you ask us to take before entering it. |
| Run the free entry route, monthly draw and voucher fulfilment. | Performance of the draw terms; legitimate interests in running and documenting a fair draw; and legal obligations where applicable. |
| Confirm visits, moderate content, prevent spam, investigate abuse and protect the service. | Legitimate interests in trustworthy reviews, security, fraud prevention and protecting users and venues. |
| Check and administer venue claims and listing corrections. | Steps requested by the claimant and legitimate interests in keeping listings accurate and enabling a fair right of reply. |
| Send the newsletter, quiz results and promotional Vouch emails. | Your consent. You can unsubscribe at any time without affecting your account or reviews. |
| Answer enquiries, handle rights requests and establish, exercise or defend legal claims. | Legitimate interests and legal obligations. |
| Operate, troubleshoot and improve the website and understand aggregate use. | Legitimate interests in running a reliable service. We do not currently use behavioural advertising or non-essential analytics cookies. |
Where we rely on legitimate interests, we consider the need for the processing, its effect on people and whether a less intrusive method is available. You may object; see section 10.
What is public
Your handle, reviews, scores, selected venue attributes, review date, confirmation label, points, badges and leaderboard position may be public. A winner may be announced by handle. Your email address, private visit evidence, session data, draw chances and venue-claim contact details are not published.
A signed-out review is published as anonymous unless it is later claimed. Search engines and other people may copy public material, so removing it from Vouch may not remove every copy elsewhere.
Who receives information
- Cloudflare provides website delivery, security, serverless processing and the D1 database.
- Brevo sends transactional and newsletter email and holds subscribed email contacts.
- Google provides business email and, on relevant pages, Google Maps and Google Fonts. Loading those resources discloses technical request data to Google.
- Professional advisers, insurers, regulators, courts, law enforcement or another party to a transaction may receive information where reasonably necessary and lawful.
We do not sell personal information. We do not give venues private reviewer details merely because they disagree with a review.
International transfers
Some providers operate from or use infrastructure outside the United Kingdom. Where personal information is subject to a restricted transfer, we use an available UK GDPR mechanism appropriate to that transfer, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses, together with any required transfer assessment. Contact us if you want more information about the safeguard relevant to your data.
How long we keep it
- Accounts, public reviews, points and badges: while the account or public record remains active. If an account is closed, we normally remove account identifiers within 30 days and anonymise its reviews unless deletion is required or an exception applies.
- Magic links and sessions: links stop working after 30 minutes; sessions stop working after 30 days. Expired security records are kept only as long as reasonably needed for security and troubleshooting.
- Visit evidence: normally up to 90 days after confirmation, or longer where a review is disputed or abuse is investigated.
- Venue claims: while the claim or claimed listing is active, then normally up to six years where needed for agreements or disputes. Uncompleted claims are normally removed after 12 months.
- Quiz responses: normally 12 months. Newsletter contact data remains until you unsubscribe; we may retain a minimal suppression record so we respect the opt-out.
- Draw and winner records: normally six years after the draw to demonstrate its administration and resolve legal, tax or regulatory questions.
- Service and security logs: for the period reasonably necessary to operate, secure and diagnose the service, according to the relevant provider settings.
We may retain information for longer where law requires it, a legal claim is active, or preserving evidence is reasonably necessary. We delete or de-identify it when the purpose ends.
Cookies and browser storage
| Name | Purpose | Duration |
|---|---|---|
vouch_session | Secure sign-in and account authentication. HttpOnly, Secure and SameSite=Lax. | 30 days |
vouch_patch | Remembers whether you last browsed Peckham or Hackney. | 1 year |
vouchPageViews | Session storage used only to alternate the Vouch interface colours during the current browser tab session. | Until the tab session ends |
These technologies provide requested authentication or interface functions. We do not currently set advertising cookies. Google Maps and Fonts may use or access their own technologies when their content loads; Google controls those technologies. If we introduce non-essential analytics or advertising technologies, we will ask for consent before using them where the law requires it.
Your rights
Depending on the circumstances, you may ask us to:
- give you a copy of your personal information;
- correct inaccurate or incomplete information;
- delete information;
- restrict how we use it;
- provide information you supplied in a portable format;
- stop processing based on legitimate interests; or
- stop direct marketing at any time.
You may withdraw consent at any time. Withdrawal does not make earlier processing unlawful. These rights are not absolute; if an exception applies, we will explain it. We normally respond within one month.
Automated processing and moderation
Vouch automatically calculates points, standings and draw chances from published rules. We may also use automated limits or signals to identify spam or low-quality submissions. These processes do not make decisions that produce legal or similarly significant effects. You can ask us to review a moderation or account decision.
Photographs and location information
We strip embedded location metadata from uploaded photographs before storage or publication. Please upload only images you are entitled to share and avoid including people who would not reasonably expect to appear. Receipts and booking confirmations are used privately to confirm a visit and are not published.
Children
Accounts, reviews, points and prize draws are intended for people aged 18 or over. We do not knowingly collect account or draw information from children. If you believe a child has supplied personal information, contact us so we can investigate and remove it where appropriate.
Security
We use measures appropriate to the risk, including encrypted HTTPS connections, restricted administrative access, hashed sign-in and session tokens, short-lived magic links, private verification evidence and service-provider security controls. No online service can guarantee absolute security; please tell us promptly if you believe your account or information has been compromised.
Complaints and changes
Please contact us first so we can try to put things right. You may also complain to the Information Commissioner’s Office, the UK data protection regulator.
We may update this notice when the service or law changes. Material changes will be highlighted on this page and, where appropriate, communicated directly.