Privacy Policy
Version 2026-11-08 · Effective November 8, 2026
This policy explains what personal information Négus Group Inc., doing business as VouchSafe ("VouchSafe", "we", "us") handles, why, and the choices you have. It covers our website, the free offline checker and the hosted VouchSafe service.
Two roles
- Inside a workspace (the trusted directory, cases, messages checked, callbacks and the audit log), the business that owns the workspace decides what goes in and why. We process that information on its behalf as a service provider or processor, under our Data Processing Addendum. If your information is in a business's workspace, please contact that business first; we'll help it respond.
- For account, billing, website and partner-inquiry information, we decide how it's used, and this policy applies to us directly.
What we collect
When a business uses the service
- Account details: names, work email addresses and roles of the people in a workspace. Passwords are stored only as scrypt hashes.
- Directory entries: names, email domains, phone numbers and the last four digits of bank accounts for the contacts a business trusts.
- Messages checked: the sender, subject, text and authentication headers of messages staff choose to check, and any case opened from them.
- Callbacks: the number called or texted, the time, the outcome and who placed it. One-time codes are stored only as keyed hashes.
- Ledger data, only if a business connects QuickBooks Online or Xero: supplier names and bank details.
- Audit log: every action, who took it and when. Failed sign-ins and acceptance of our Terms also record the IP address they came from.
When you visit the website or contact us
- We don't use advertising or analytics cookies, and we don't track you across other sites. The app sets one sign-in cookie, and the app may remember your light or dark theme in your browser's local storage.
- Our hosting provider keeps standard server logs, such as IP address, time and page requested, for 7 to 30 days depending on our plan with them.
- If you send the partner inquiry form or email us, we keep what you send: your name, work email, organization, role and message.
The free offline checker
The checker at /solo/ runs in your browser. What you paste into it isn't sent to us.
Why we use it
- To provide the service a business has signed up for, including placing the callbacks it asks for and keeping its audit trail (performance of a contract).
- To secure the service, prevent abuse and fix problems (our legitimate interests in running a safe service).
- To bill, support and communicate with customers, and to reply to inquiries (contract and legitimate interests).
- To meet legal obligations, such as tax records and lawful requests (legal obligation).
We don't sell personal information, we don't "share" it for cross-context behavioral advertising as California law defines those terms, and we don't use it for advertising.
Text messages and calls
When a business asks us to, we send one-time verification codes by text message or automated voice call to people who have agreed to receive them, either on our consent form or by telling the business directly. We record when and how that agreement was given. Message frequency varies; message and data rates may apply. Reply STOP to any text to opt out, or HELP for help. See our text message terms.
No mobile information will be sold or shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are never shared with any third party, except the providers that deliver the messages (Twilio) as described below.
Who we share it with
- Render (render.com) hosts our servers and stores our encrypted data disk in its Virginia (US East) region.
- Twilio sends text and voice callbacks. It receives the recipient's number and the message containing the code. This doesn't apply when a business uses its own Twilio account, in which case that business's Twilio account handles it.
- Stripe processes card payments for our plans. It receives the paying administrator's name, email and card details directly; we never see or store the full card number.
- QuickBooks Online and Xero, only when a business connects them.
- Authorities, only in response to valid legal process. For information inside a workspace, we'll tell the business first unless the law forbids it, and we'll push back on requests that are overly broad.
- A buyer or successor, if VouchSafe is involved in a merger or acquisition, subject to this policy.
How long we keep it
- Workspace content is kept while the workspace is open, and deleted from our live systems within 30 days after it's closed. Copies in our hosting provider's encrypted daily snapshots then expire on its rotation schedule.
- Account and billing records are kept while the account is open and for up to 7 years afterwards where tax or accounting law requires.
- Partner inquiries are kept for up to 24 months.
- Server logs expire after 7 to 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent where we rely on it. California residents have the right to know, delete and correct personal information, and to not be discriminated against for using these rights. People in the European Economic Area, the United Kingdom and Switzerland can also complain to their local data protection authority.
To use these rights, email [email protected]. We'll verify your request, for example by replying to the email address on file, and respond within 30 days, or within the time the law that applies to you requires. If your information is in a business's workspace, we'll pass your request to that business, which decides how to respond.
International transfers
VouchSafe is based in the United States, our data is stored in Virginia, and we and our service providers process information in the United States. If you're outside the United States, your information is transferred there. Where the law requires a transfer mechanism, such as for data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, as set out in our Data Processing Addendum.
Security
See our Security page for how we protect information and what we haven't done yet.
Children
VouchSafe is a business service and isn't directed at children under 16. We don't knowingly collect their information.
Changes
We'll post changes here with a new version number. For material changes, we'll email workspace admins at least 30 days before they take effect.
Contact
Négus Group Inc., doing business as VouchSafe, 1142 Florida Street, #5, San Francisco, CA 94110, [email protected]. Privacy questions and requests go to the same address.