Plain-English summary. We collect what we need to run the marketplace: your account details, your profile and résumé, and the vouch requests you send. We share your application materials with the referrer you choose to contact — that is the point of the product. We do not sell your data. You can export or delete your account at any time.
1. Who is responsible
Sulphoor LLC operates Vochure and is the controller of the personal information described here. Contact: privacy@vochure.com.
2. What we collect
Information you give us:
- Account details — name, email address, and password (stored hashed, never in plain text).
- Seeker profile — bio, skills, and any résumé you upload.
- Referrer profile — employer, job title, LinkedIn URL, and bio, plus what you need to verify employment.
- Vouch requests — the message you send and the referrer's response or notes.
Information collected automatically: basic log and device data such as IP address, browser type, and pages viewed, used for security, debugging, and aggregate usage measurement.
Payment information: card details are collected and stored by Stripe, not by us. We retain only a Stripe customer identifier and your subscription status.
3. Why we use it
- To operate your account and authenticate you.
- To show relevant roles and route your vouch requests to the right referrer.
- To process subscription payments and manage entitlements.
- To send transactional email — request received, approved, or declined.
- To detect abuse, fraud, scraping, and attempts to bypass access controls.
- To comply with legal obligations.
Where the GDPR applies, our legal bases are performance of a contract (running the Service), legitimate interests (security and improvement), consent (optional communications), and legal obligation.
4. What we share, and with whom
With referrers you choose to contact. When you submit a vouch request, the referrer sees your name, profile, résumé, and message. This is the core function of the Service. We do not disclose your materials to referrers you have not contacted.
With service providers who process data on our behalf under contract: Supabase (database and authentication), Vercel (hosting), Stripe (payments), and Resend (transactional email).
For legal reasons — where we are required by law, or where disclosure is reasonably necessary to protect the rights and safety of our users or the public.
In a business transfer — if Vochure is acquired or merged, information may transfer as part of that transaction. We will give notice before your information becomes subject to a materially different policy.
We do not sell your personal information, and we do not share it with recruiters, data brokers, or advertisers.
5. Identity protection on the free tier
Employer names and referrer identities are withheld from free accounts. This is enforced in our database with row-level security, not merely hidden in the interface — the protected fields are not sent to a free user's browser at all. Attempting to circumvent this is a breach of our Terms of Service.
6. How long we keep it
We keep account information for as long as your account is open. If you delete your account we remove your profile and résumé within 30 days, except where we must retain records for legal, tax, accounting, or fraud-prevention purposes. Vouch requests may be retained in the counterparty's history in a limited form, since they form part of another user's record.
7. Your rights
Depending on where you live, you may have the right to access, correct, export, delete, or restrict processing of your personal information, to object to certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and to not be discriminated against for exercising them.
Exercise any of these by emailing privacy@vochure.com. We will respond within the period required by applicable law. EU and UK users may also complain to their local data protection authority.
8. Security
We use encryption in transit, hashed passwords, row-level access controls in the database, and least-privilege service credentials. No system is perfectly secure, but if a breach affects your personal information we will notify you and any regulator as required by law.
9. International transfers
We are based in the United States and our providers may process data there and elsewhere. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
10. Cookies
We use cookies that are strictly necessary to keep you signed in and to secure the Service. We do not use advertising or cross-site tracking cookies. Blocking essential cookies will prevent sign-in from working.
11. Children
Vochure is not directed at anyone under 18 and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.
12. Changes
We will post any update here and revise the effective date. If a change is material we will give reasonable notice before it takes effect.
Note
This policy is a good-faith description of our current practices, written for an early-stage product. It has not been reviewed by a licensed attorney. Have counsel review it before relying on it commercially, particularly regarding GDPR and CCPA/CPRA obligations.