Vouchr Privacy Notice
Version 1.2-draft · Last updated 30 October 2026
Draft, under legal review
This notice is a working draft. Some sections are still being reviewed and the wording may change before it is final.
Who we are and what this notice covers
Vouchr Ltd looks after your personal information and decides how it is used. We are the "controller" under UK data protection law. Our company number is 17450653 and our registered office is 63 Redwood Drive, Chorley, England, PR7 3BW.
This notice covers people who buy a voucher, people who are given one, businesses that sell vouchers on Vouchr (and the people who apply for them), and anyone who visits vouchr.co.uk. It is written in plain English. If anything is unclear, email us at contact.vouchr@gmail.com.
The business that issues your voucher is separate from us, and it looks after the information it receives. Section 3 explains what it sees.
1. What we collect and why
We collect only what we need to sell, deliver and look after vouchers. We do not send marketing emails, we do not use advertising or analytics tools, and we do not sell your information.
| Who | What we collect | Why we use it | Our lawful basis |
|---|---|---|---|
| Buyers | Your name and email; the voucher, amount and payment reference; when you accepted the terms and which version; the voucher's access code and QR code; any refund or use of the voucher. Card details are taken by Stripe on its own page and we never see them. | To sell and deliver your voucher, send your confirmation and updates, handle refunds and complaints, prevent fraud, and keep the records the law requires. | Contract; legal obligation (accounting records); legitimate interests (fraud prevention and security) |
| Gift recipients | Your name and email, and the message the buyer wrote. We get these from the buyer. | To send you the gift and let you use it. | Legitimate interests (carrying out the buyer's gift) |
| Businesses and applicants | The applicant's name and date of birth (used only to check they are 18 or over); the business's name, category, description, address, email, phone and website; logos; the agreement accepted; payout, invoice and debt records; reasons given when disputing a debt or asking for a change; notes we write about the business, such as review notes and reasons for a suspension. Bank details and identity checks are held by Stripe, not us. | To review applications, run the account, show buyers who they are buying from, collect money owed, and meet legal duties. | Contract; legal obligation; legitimate interests |
| People who sign in | Your email and password. Passwords are stored securely by our sign-in provider and we cannot read them. | To let you sign in and keep accounts secure. | Contract; legitimate interests |
| Support access | When our staff sign in as a business to help it, we record the time, the page, the IP address and the browser. | To keep that access safe and show what was done. | Legitimate interests (security) |
| Website visitors | Your IP address and basic request details in our hosting provider's logs. | To keep the site running and secure. | Legitimate interests |
- Who
- Buyers
- What we collect
- Your name and email; the voucher, amount and payment reference; when you accepted the terms and which version; the voucher's access code and QR code; any refund or use of the voucher. Card details are taken by Stripe on its own page and we never see them.
- Why we use it
- To sell and deliver your voucher, send your confirmation and updates, handle refunds and complaints, prevent fraud, and keep the records the law requires.
- Our lawful basis
- Contract; legal obligation (accounting records); legitimate interests (fraud prevention and security)
- Who
- Gift recipients
- What we collect
- Your name and email, and the message the buyer wrote. We get these from the buyer.
- Why we use it
- To send you the gift and let you use it.
- Our lawful basis
- Legitimate interests (carrying out the buyer's gift)
- Who
- Businesses and applicants
- What we collect
- The applicant's name and date of birth (used only to check they are 18 or over); the business's name, category, description, address, email, phone and website; logos; the agreement accepted; payout, invoice and debt records; reasons given when disputing a debt or asking for a change; notes we write about the business, such as review notes and reasons for a suspension. Bank details and identity checks are held by Stripe, not us.
- Why we use it
- To review applications, run the account, show buyers who they are buying from, collect money owed, and meet legal duties.
- Our lawful basis
- Contract; legal obligation; legitimate interests
- Who
- People who sign in
- What we collect
- Your email and password. Passwords are stored securely by our sign-in provider and we cannot read them.
- Why we use it
- To let you sign in and keep accounts secure.
- Our lawful basis
- Contract; legitimate interests
- Who
- Support access
- What we collect
- When our staff sign in as a business to help it, we record the time, the page, the IP address and the browser.
- Why we use it
- To keep that access safe and show what was done.
- Our lawful basis
- Legitimate interests (security)
- Who
- Website visitors
- What we collect
- Your IP address and basic request details in our hosting provider's logs.
- Why we use it
- To keep the site running and secure.
- Our lawful basis
- Legitimate interests
2. Who we share it with
We use a small number of companies to run Vouchr. They only use your information to provide their service to us.
| Company | What they do | What they receive |
|---|---|---|
| Supabase | Our database, sign-in system and logo storage | The information described in section 1 |
| Vercel | Hosts the website and runs our scheduled jobs | Visitors' IP addresses and request details |
| Stripe | Takes payments and checks identity and bank details of businesses | Buyer name and email; for gifts, the recipient's name, email and message; business contact details. Stripe also uses some information for its own purposes, such as preventing fraud, under its own privacy notice |
| Resend | Sends our emails | Names, email addresses, gift messages, and the voucher's access code and picture (with its QR code) in the emails we send |
| Our team's email inbox, where we receive notices about applications and change requests | Applicant and business details, and the reasons businesses give | |
| walletwallet.dev | Creates the phone wallet pass for a voucher | The voucher's QR token, the business name, value and expiry. No names |
- Company
- Supabase
- What they do
- Our database, sign-in system and logo storage
- What they receive
- The information described in section 1
- Company
- Vercel
- What they do
- Hosts the website and runs our scheduled jobs
- What they receive
- Visitors' IP addresses and request details
- Company
- Stripe
- What they do
- Takes payments and checks identity and bank details of businesses
- What they receive
- Buyer name and email; for gifts, the recipient's name, email and message; business contact details. Stripe also uses some information for its own purposes, such as preventing fraud, under its own privacy notice
- Company
- Resend
- What they do
- Sends our emails
- What they receive
- Names, email addresses, gift messages, and the voucher's access code and picture (with its QR code) in the emails we send
- Company
- What they do
- Our team's email inbox, where we receive notices about applications and change requests
- What they receive
- Applicant and business details, and the reasons businesses give
- Company
- walletwallet.dev
- What they do
- Creates the phone wallet pass for a voucher
- What they receive
- The voucher's QR token, the business name, value and expiry. No names
We also share information with the business you bought from (section 3), and where the law requires it, with the police, courts, regulators or tax authorities. If we ever sell or merge the business, we may pass information to the new owner, who must keep to this notice.
3. What businesses can see
When you buy a voucher, the business that issues it receives your payment directly, so it needs to see some of your information.
In its Vouchr dashboard, the business sees your name and email, the voucher you bought, when you accepted the terms and, for a gift, the recipient's name. In its own Stripe account, the business can also see your payment record, which holds the recipient's email address and the gift message.
The business is a separate controller of the information it receives. It may use it only to honour your voucher, look after you as a customer, handle complaints and meet its legal duties, and it must not use it to market to you unless the law allows it. If you want to see, correct or delete what a business holds about you, contact the business directly using the details on your voucher page.
Before you pay, we show you the business's name, address, email and phone number, so you know who you are buying from.
4. Where your information goes
Some of the companies in section 2, including Stripe, Vercel, Resend and Google, are based in the United States or may handle information there. When your information is sent outside the UK, we only do so where it is protected by an approved safeguard, such as the UK's recognised data transfer arrangements with the company's country or standard contractual clauses.
You can contact us at contact.vouchr@gmail.com for more detail about where a particular company stores your information.
5. How long we keep it
We keep information only as long as we need it for the reasons in section 1.
| Information | How long we keep it |
|---|---|
| Orders, payments and voucher records | 6 years after the end of the financial year of the purchase, because of accounting and tax rules and to deal with disputes |
| Gift recipient details and gift messages | 12 months after the voucher expires or is used up |
| Successful applications and business accounts | For as long as the business sells on Vouchr, then 6 years |
| Rejected applications, including date of birth | 12 months after the decision |
| Support access records | 12 months |
| Hosting provider logs | As set by the provider, usually a few weeks |
- Information
- Orders, payments and voucher records
- How long we keep it
- 6 years after the end of the financial year of the purchase, because of accounting and tax rules and to deal with disputes
- Information
- Gift recipient details and gift messages
- How long we keep it
- 12 months after the voucher expires or is used up
- Information
- Successful applications and business accounts
- How long we keep it
- For as long as the business sells on Vouchr, then 6 years
- Information
- Rejected applications, including date of birth
- How long we keep it
- 12 months after the decision
- Information
- Support access records
- How long we keep it
- 12 months
- Information
- Hosting provider logs
- How long we keep it
- As set by the provider, usually a few weeks
When the time is up, we delete the information or remove anything that identifies you. Stripe keeps payment, identity and bank records for its own legal reasons, and we cannot delete those. Businesses keep what they received under their own rules.
6. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete your information, where we no longer need it or the law allows;
- ask us to limit how we use it, or to move it to another service;
- object to us using it where we rely on legitimate interests.
To use any of these rights, email contact.vouchr@gmail.com. We may ask you to prove who you are, and we will reply within one month. We cannot delete information we must keep by law, such as accounting records, and we will explain if that applies.
We do not make decisions about you using automated profiling. We do not send marketing emails, so there is nothing to unsubscribe from.
If you are unhappy with how we have used your information, you can complain to us first, and you also have the right to complain to the Information Commissioner's Office (section 10).
7. How we protect it
Information travels over secure connections (HTTPS), and our database provider encrypts the data it stores. Card details are handled only by Stripe. Businesses and our staff can see only what they need to do their job.
A voucher is locked after 10 wrong access codes in a row, which makes a code very hard to guess. Passwords are stored securely by our sign-in provider and we cannot read them.
Sometimes our staff sign in as a business, for up to 20 minutes, to help it. This needs one-time codes, cannot see bank details or change payout settings, is recorded in a log, and the business is emailed when it starts.
If we find out that your information has been lost or taken, we will tell you and the Information Commissioner's Office where the law requires us to.
8. Cookies and browser storage
We do not use advertising, tracking or analytics cookies. We only store what the site needs in order to work, so we do not ask for your consent.
| What | Who it affects | What it does | How long |
|---|---|---|---|
| Checkout draft (browser tab storage) | Buyers | Keeps your name, email and gift details while you pay, so you do not lose them if you go back from the payment page | Until you pay, come back from the payment page, or close the tab |
| Sign-in session (browser storage) | Businesses and our admin | Keeps you signed in | Until you sign out |
| Support access cookies | Our admin only | Keeps a support session secure | 10 to 20 minutes |
- What
- Checkout draft (browser tab storage)
- Who it affects
- Buyers
- What it does
- Keeps your name, email and gift details while you pay, so you do not lose them if you go back from the payment page
- How long
- Until you pay, come back from the payment page, or close the tab
- What
- Sign-in session (browser storage)
- Who it affects
- Businesses and our admin
- What it does
- Keeps you signed in
- How long
- Until you sign out
- What
- Support access cookies
- Who it affects
- Our admin only
- What it does
- Keeps a support session secure
- How long
- 10 to 20 minutes
When you pay, Stripe's own pages use Stripe's cookies, under Stripe's privacy notice. Businesses setting up payments on Vouchr also load Stripe's scripts, which can set Stripe's cookies.
The scanner that businesses use to redeem vouchers also remembers which camera you last used and whether you allowed camera access, on your own device.
9. Children
Vouchr is for adults. Businesses must be 18 or over to sell, and buyers should be 18 or over. We do not knowingly collect information from children.
A voucher can be given as a gift to someone of any age. If a buyer gives us a child's details as the recipient, we use them only to deliver the gift. If you think we hold a child's information that we should not, email contact.vouchr@gmail.com and we will remove it.
10. Changes, complaints and contact
We may update this notice, for example if we add a service or the law changes. The date at the top shows when it last changed. If a change affects how we use your information in a way you would not expect, we will tell you.
Contact us. Vouchr Ltd, 63 Redwood Drive, Chorley, England, PR7 3BW. Email: contact.vouchr@gmail.com.
Complain to the regulator. You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first, so please contact us if you can.