Vouch Legal

CPRA Notice For California Residents

This California Privacy Rights Act (“CPRA”) Online Privacy Notice and Notice at the Time of Collection (“CPRA Notice”) is applicable to the personal and sensitive information collected by Vouch and its affiliates (collectively, “Vouch”), about California residents (defined by the CPRA as “Consumers”) to the extent the personal information is subject to the CPRA; in addition to other applicable policies, practices, and privacy notices (such as our Online Privacy Notice) that may relate to specific business relationships you have with Vouch or to certain products or services.

Pursuant to the CPRA, we act as a “Service Provider” with respect to the personal and sensitive information that we receive from Customers.

This CPRA Notice does not apply to Consumers’ personal information exempted from the CPRA, such as deidentified or aggregated Consumer information or personal information collected pursuant to sector-specific privacy laws such as: (1) the federal Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations or the California Financial Information Privacy Act (“FIPA”); or (2) certain medical and health information covered by HIPAA (if and where applicable). Vouch Employees, who are California residents, should refer to Vouch’s internal policies, including Vouch’s Employee CPRA Privacy Policy and Notice at Time of Collection with respect to the privacy of employee data.

Categories of Information We Collect, Use, Disclose, or Share

California law indicates that “Businesses” should disclose for California residents whether certain categories of information are collected, used, or disclosed for an organization’s “business purpose”, made available to third-parties in exchange for valuable consideration (“sold”) or “shared” for purposes of cross-context behavioral advertising (as those terms are defined under California law). You can find a list of the categories of information we collect and how we share the information below. In the preceding twelve (12) months, we have collected the following categories of personal information. Note that not all categories may be collected about every individual:

Personal Information We Collect

‍

CPRA Privacy Rights

The CPRA provides California residents with specific rights regarding their personal information; this section describes these CPRA rights and explains how to exercise them.

Access

You may request confirmation on whether we are processing your personal information and request access to the personal information we have about you, including related information, or a copy of that information, by following the instructions (in the Submitting Requests section below). Once we receive your request and confirm your identity, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third-parties with whom we share that personal information.
• If we disclosed your personal information for a business purpose, two separate lists disclosing:
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
  

In certain circumstances, you may request portability of your personal information. If required by law, we will grant you reasonable access to the personal information we have about you.

Deletion

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive your request and confirm your identity (see Submitting Requests), we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us, or our Service Providers, to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another Consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act.
• Enable solely internal uses that are reasonably aligned with Consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
• Comply with our data retention obligations under applicable law.
• Comply with our reporting obligations under applicable law.
• Comply with our obligation to preserve information in the event of a lawsuit, regulatory inquiry, or other similar legal matter.

We will delete or de-identify personal information not subject to one of these exceptions from our records and will direct our Service Providers to take similar action.

Correction

You may request correction of any inaccuracies in your personal information. Note that we rely on you to update and correct your personal information. Account holders may modify or delete certain information in their account profile by logging into their account. If you’re unable to update or correct your personal information, please submit a request by following the instructions in the Submitting Requests section below.

Opt Out of Targeted Advertising

You have the right to know about and opt out of any type of targeted or cross-behavioral advertising. We share information with Service Providers and Contractors with which we have a contractual agreement and do not sell to a third-party for cross-context behavioral advertising purposes. You may opt out of targeted advertising by clicking the “Do Not Share My Personal Information” link on our homepage and we won’t disclose your personal information for these purposes.

Opt Out of Automated Decision-Making Technology

We do not profile or use any form of automated processing on your personal information in furtherance of decisions that produce legal or similarly significant effects within the meaning of applicable US privacy law.

Submitting Requests and Verification of Your Identity

We will not discriminate against you for exercising any of your CPRA privacy rights described above, however your experience of our products and services may be different because we cannot deliver them in the same manner had you not exercised your rights. To the extent that your personal information is in-scope for CPRA’s privacy rights, you have the right to request that we exercise your rights. In some cases, we may limit or deny your request if the law permits or requires us to do so, or if we are unable to adequately verify your identity.

Please note that to protect your information we must be able to verify your identity before we can process your request to exercise any of the foregoing privacy rights. We may conduct the verification process by email or phone, and we may ask you to provide information such as your name, contact information, and any additional relevant information based on your relationship with us.

In some circumstances, certain individuals may designate an authorized agent to submit requests to exercise certain privacy rights on their behalf. To do so, you must provide that authorized agent written and signed permission to submit the request on your behalf and verify your own identity directly with us. Note that we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

You may make such a request via one of the methods outlined below:

        Through Your Account

        Call Us: (415) 488-6728

        E-mail Us: vouchprivacy@vouch.us

        Write to Us:
        Vouch, Inc.
        Attn: Legal Department
        250 Montgomery Street, Suite 700
        San Francisco, CA 94104

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact: vouchprivacy@vouch.us.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable Consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Changes to This CPRA Notice

We reserve the right to amend this CPRA Notice at our discretion and at any time in order to address future developments of Vouch, the Services, the CPRA or implementing regulations, or changes in industry or legal trends. We will post the revised CPRA Notice on this page, and otherwise comply with any requirements of CPRA regarding changes to this CPRA Notice. You can determine when the CPRA Notice was revised by referring to the “Last Updated” legend on the top of this page. Any changes will become effective upon the posting of the revised CPRA Notice on the Website. By continuing to use our Services following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this CPRA Notice, in whole or part, you can choose to discontinue your use of our Services.

Contact Information

If you have any questions or comments about this CPRA Notice, or Vouch’s privacy notices or practices, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us via one of the methods outlined below:

        Call Us: (415) 488-6728

        E-mail Us: vouchprivacy@vouch.us

        Write to Us:
        Vouch, Inc.
        Attn: Legal Department
        250 Montgomery Street, Suite 700
        San Francisco, CA 94104

List of Affiliates

This CPRA Notice is being provided on behalf of Vouch and its affiliates (including the following as of May 2023), to the extent required by the CPRA and implementing regulations:

Vouch Financial Services, LLC
Vouch Risk Management Services, LLC
Vouch International, LLC
Vouch US Insurance Services Holdings, LLC
Vouch Insurance Services, LLC
Vouch Specialty Insurance Services, LLC
Vouch Technology Holdings, LLC
Vouch US Insurance Carrier Holdings, LLC
Vouch Insurance Company