Vouch Privacy Policy

Who we are, and our role with your data

This privacy policy (“Policy”) describes how Vouch collects, processes, and protects your personal data. In this Policy, “Vouch”, “we”, “our” and “us” each mean Vouch SG Pte. Ltd. At Vouch, we provide hospitality vendors (e.g. hotels, hostels, rentals, real estate owners, etc.) (“Customer(s)”) with a Software-as-a-Service cloud-based solution allowing Customers to manage their hospitality-related services, including online check-in and check-out, managing guests’ requests and queries, and offering personalised guest experiences (“Service(s)”).

This Policy applies to:

• Visitors to our website, including representatives of prospects and potential business partners requesting a demo through our website;
• Authorised users, employees or contractors, using and accessing the Services on behalf of a Customer (“Authorised User(s)”); and
• Data used to improve our Services and to provide you with the best possible user and customer experience. This includes using AI-powered analytics tools to analyse usage patterns, product performance, and service outcomes.

This Policy does not cover personal data we process in our role as a data processor where we process personal data on behalf of the Customer. Such processing is governed by the Customer’s privacy notice and by our data processing agreement with the Customer. For example, when you use the Services at a Customer’s hotel, hostel or any rental accommodation (“Property”) (i.e. for messaging, check-in, making requests, interacting with a guest chatbot etc.) the Customer decides what data is collected, why, and how long it is kept. Vouch only processes the data on the Customer’s instructions, as its processor, a data intermediary, under Singapore’s Personal Data Protection Act (“PDPA”). If you are a Property guest and have questions about your personal data, please contact the Property with which you made your reservation, for any questions or requests regarding their processing of your personal data.

There is a narrower set of data that we handle for our own purposes, as an independent controller (an “organisation” under the PDPA). This Policy is about that data.

What we collect, why we use it and legal basis for processing

This section covers the data for which Vouch is the data controller.

The operational and usage data we control is the data we generate to run the platform and the records of how admin users and website visitors use it. Operational data can occasionally contain a little guest data (e.g. where a guest’s details appear in an error log or diagnostic trace).

Please note that the actual processing operation per each purpose of use and legal basis detailed in the table above may differ, and we are only responsible for the personal data we collect and process as the controller of the personal data. Such processing operation usually includes a set of operations made by automated means, such as collection, storage, use, disclosure by transmission, erasure, or destruction.

In addition, we may use certain personal data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity thefts, and any other misuse of our Services, and to enforce our terms of use and other policies, as well as to protect the security or integrity of our databases and Services, and to take precautions or defend against legal liability and claims. Such processing is based on our legitimate interests.

Any personal data you provide is made at your free will and consent (where required under applicable data protection laws), and you acknowledge that you are not under any statutory obligation to provide personal data to Vouch. However, if you will not provide us with certain personal data, we will not be able to fulfill certain services.

How we collect personal data

Depending on the nature of your interaction with Vouch, we may collect personal data as follows:

• Automatically: We may use cookies or similar tracking technologies to gather some information automatically when you interact with our website or Services.
• Provided by you voluntarily: We will collect personal data you provide us with.
• Provided by third parties: Such as third party data aggregators, referrals, etc.

Our role as processor of guest data and what guests should know

Vouch is a processor of our Customers’ guests’ data. We process it only on each Customer’s instructions and under our agreement with the Customer. As a processor, Vouch follows the Customers’ instructions and lawfulness.

Where a Customer switches on certain features, the platform may handle more sensitive information:

• Contactless Check-in: May involve images of identity documents and a biometric check that compares a live image of the guest against the photo in their identity document to confirm they are the same person; and
• Payments: Handled by the Customer’s chosen payment provider.

If you are a guest and want to access, correct or delete your data, or ask how it is used, please contact the Property you stayed with.

Aggregated and anonymised insights

We may create aggregated and anonymised information from the data that passes through our services, information that has been combined or stripped of identifiers so that it does not reasonably identify you. Where we do, we may use it to operate, secure, monitor, analyse, benchmark and improve our services and our business, and to develop new features and products.

Because we treat this information as no longer identifying any individual, it sits outside our data processing agreements with our Customers.

How we share data

To run our services we rely on trusted third parties (“sub-processors”) that help us manage our business operations or provide our Services. The categories are:

• Cloud infrastructure and databases (e.g. Amazon Web Services, MongoDB Atlas);
• AI infrastructure and providers (e.g. Google Vertex AI / Gemini, Pinecone);
• Communications (e.g. Twilio, Meta WhatsApp Business, Mailgun); and
• Operational tooling (e.g. Sentry for error monitoring).

Services may also contain links to third-party content. Vouch does not control these parties’ privacy practices, which are not covered by this Policy.

We may share personal data with corporate affiliates and subsidiaries for internal business purposes, to provide requested products or services or in connection with actual or proposed control changes (including sales, mergers, consolidations, asset sales, or bankruptcy). We may also share data to comply with legal obligations such as but not limited to: responding to subpoenas, court orders, legal processes, law-enforcement requests, legal claims, government enquiries or assisting in internal and external audit investigations.

Vouch does not disclose your personal data in direct exchange for money or some other form of payment, except in connection with a merger, acquisition, financing or similar corporate transaction.

For the avoidance of doubt, Vouch may share personal data in additional manners, pursuant to your explicit approval, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous. We may transfer, share, or otherwise use non-personal and non-identifiable data at our sole discretion and without the need for further approval.

Where data is processed, and international transfers

We are headquartered in Singapore and some of our sub-processors process and store personal data in other regions, including within the European Union, the United States and other locations as reasonably necessary for the proper performance and delivery of our Services, or as may be required by applicable laws.

As a result, any information you provide us may be transferred to and processed in countries other than the country from which you accessed our website or Services. We will take appropriate measures in line with industry standards to ensure that your personal data receives an adequate level of data protection upon its transfer. Where data protection law requires it, cross-border transfers are covered by appropriate safeguards — for example the European Commission’s Standard Contractual Clauses (with the UK Addendum) for transfers subject to European data protection law, and, for transfers subject to Singapore’s PDPA, contractual obligations requiring a comparable standard of protection.

How long we keep data

We retain personal data we collect as long as it remains necessary for the purposes set forth above, all in accordance with applicable laws, or until an individual expresses a preference to opt-out.

Other circumstances in which we will retain your personal data for longer periods of time include:

• Where we are required to do so in accordance with legal, regulatory, tax, or accounting requirements;
• For us to have an accurate record of your dealings with us in the event of any complaints or challenges; or
• If we reasonably believe there is a prospect of litigation relating to your personal data.

Please note that except as required by applicable law, we may at our sole discretion, delete or amend information from our systems, without notice to you, once we deem it is no longer necessary for such purposes.

How we protect data

Vouch uses reasonable measures to protect information from loss, theft, misuse, and unauthorised access, disclosure, alteration and destruction. Vouch maintains administrative, physical and technical security measures and utilises commercially reasonable practices to protect your data.

No method of transmission or storage is completely secure. If a data breach affecting personal data for which Vouch is the controller occurs, we will assess it and, where required by applicable law (e.g. in Singapore, under the PDPA’s Data Breach Notification Obligation), notify the relevant authority and the affected individuals.

Note that we cannot be held responsible for unauthorised or unintended access beyond our control, and we make no warranty, express, implied, or otherwise, that we will always be able to prevent such access.

Your rights

Where the data protection law that applies to you gives you these rights, you may be able to enquire whether Vouch processes your personal data, request access, and ask for correction, amendment, or deletion of inaccurate information.

You hold the following rights:

• Access: Receive a copy of your held personal data and verify lawful processing.
• Rectification: Request correction of incomplete or inaccurate data.
• Erasure: Request deletion of personal data where there is no good reason for continued processing.
• Object: Object to processing where Vouch relies on legitimate interest and your particular situation impacts your fundamental rights and freedoms.
• Restriction: Request suspension of personal data processing in specific scenarios.
• Withdraw consent and opt out: Opt out of certain personal data uses and disclosures.
• Lodge a complaint: Contact the applicable data protection authority directly.

To opt out of marketing emails, click the “unsubscribe” link within the communication. To opt out of other personal data processing or raise objections, contact privacy@vouch-technologies.com. Withdrawing consent may affect your ability to access Vouch services.

You may contact Vouch’s data protection officer at privacy@vouch-technologies.com (Attn: Data Protection Officer) to review, access, change, correct, update, withdraw consent to, or provide feedback on personal data use. If we decline to take action on your request, we will inform you without undue delay as required by applicable law. Where applicable, you also have the right to appeal our decision.

Please note that you may exercise your rights only with respect to personal data that Vouch processes as a “controller”. If you are a guest, or otherwise use an application provided by one of our Customers and powered by Vouch, Vouch processes your personal data for those purposes as a “processor”. In such cases, please contact the Property with which you made your reservation, for any questions or requests regarding their processing of your personal data.

Cookies, pixel tags, and similar technologies

We use cookies, pixel tags and other similar technologies to collect information automatically. Cookies are small text files stored in browser preferences. Most browsers allow blocking or deletion, though this may impair service functionality. Note that, certain cookies used for strict operation and security purposes are considered as “strictly necessary” and cannot be disabled.

Cookies can be used for various purposes, including allowing you to navigate between pages efficiently, for statistical purposes, for operation and security purposes, as well as for advertising purposes.

Children

Our Services are not intended to be used independently by children. In the ordinary course of providing check-in, guest registration, and related guest services to our Customers, our Services may process personal data relating to minors who are travelling as accompanying guests or are otherwise included in a reservation.

Where we process such personal data on behalf of a Customer, the Customer is responsible for ensuring that the processing is lawful, that only necessary personal data is provided through the Services, and that any required parental, guardian, or other legally valid authorisation has been obtained where applicable.

Changes to this Policy

We reserve the right to amend this Policy from time to time, at our sole discretion. The most recent version of this Policy will always be posted on the website and the update date will be reflected in the “Last Updated” heading. We will provide notice to you if these changes are material, and, where required by applicable law, we will obtain your consent. Any amendments to the Policy will become effective immediately, unless we notify otherwise. We recommend you review this Policy periodically to ensure that you understand our most updated privacy practices.

Contact us

For any question, inquiry or concern related to this Policy or the processing of your personal data, you may contact us at privacy@vouch-technologies.com or by mail to:

Language

This Policy is provided in English. We may make translations available for convenience. If there is any conflict or inconsistency between the English version and a translation version, the English version shall prevail.