Legal

Privacy Policy

Last updated: October 30, 2026 · Effective: October 30, 2026

Overview

VouchUp.me ("VouchUp") is a product of Tabillo Inc. ("Tabillo," "we," "us," or "our"), 218 Queens Quay W, Toronto, Ontario, Canada. VouchUp gives each member a professional profile, organized by their focus areas, and a network of people who can vouch for them. This Privacy Policy describes how we collect, use, disclose and protect personal information through the VouchUp website and app at vouchup.me (the "Service"). It covers:

What personal information we collect and why
What is public on your profile, and who can see the rest
How we use and share information, and the legal basis for it
Your rights and choices, including how to download or delete your data
How we keep information secure, and how to contact us

Tabillo Inc. is responsible for (the "controller" of) the personal information described here. This Policy applies only to the Service. It does not cover third-party websites or services that the Service links to.

Information we collect

Account information

When you sign up, we collect your email address and how you sign in: with a one-time code sent to your email, or with Google. When you sign in with Google, Google shares your name, email address and profile picture with us. We do not receive your Google password, and signing in with Google does not give us access to your Google contacts, calendar or email.

Your profile

Your profile holds what you choose to add: your name (and whether your full last name shows), photo, city and country, role and employer, pronouns, My update, network goals, focus areas, proof of work, posts, milestones, how you work with AI, the people and work that inspire you, and links to your other accounts (such as LinkedIn or GitHub). When you add something from a link, we read that public page to fill in its title, image, author and date. Organization names you type that aren't on our list are kept so they can be matched later.

Your network

We keep your connections, connection requests (including the note you send with one), the people you follow, the people you block, and the contacts you import. Imported contacts can include, for each person: first and last name, email address, LinkedIn profile, company and position. See People who aren't members.

Messages

We store the messages you send and receive on VouchUp so that you and the people you write to can read them.

Settings

We keep your choices in Settings, such as who can see your profile, whether search engines may list it, and which emails you receive.

Usage, device and log information

Our hosting provider records technical information with each request, such as IP address, browser type and version, operating system, the date and time, and the page requested, to run the Service securely. On public pages (the home page, profiles, sign-in, search results and these legal pages), we use Google Analytics to understand how visitors use them, as described in Cookies and analytics. We do not use Google Analytics inside the signed-in app.

Communications

When you contact us, we collect what you send us, such as your name, email address and message, in order to respond and improve our support.

What is public on your profile

VouchUp is a public profile. Once you publish your profile, it is visible on the web at vouchup.me/your-link, can appear in VouchUp search, and can be read by search engines and AI assistants. You decide how much of it is public:

Who can see your profile (Settings): Everyone, Signed-in members, or your 1st and 2nd degree connections. Your photo, name, My update, network goals and focus areas are always visible once you publish; the rest only to the audience you choose.
Let search engines and agentic platforms find me (Settings): when off, we ask search engines not to index your profile and leave it out of our sitemap. VouchUp's own search still finds you.
Show my city and who sees your links are your choice too.
Unpublish (Settings) takes your profile off the web at once.

Signed-in members can see how they're connected to you. When you share a link to your profile, other sites (for example LinkedIn or a messaging app) show a preview with your photo, name, role, My update and focus areas. Search engines and other services may keep copies of public pages for a while after you change or remove them; we can't delete those copies, but you can ask those services to.

People who aren't members

Members can import their contacts (a contacts file or their LinkedIn connections) or add a person by name and email. If you are one of those contacts and don't have a VouchUp account:

Your details are stored privately for the member who imported them. They are never shown on a profile or to other members.
We do not email you, invite you or contact you in any way because you were imported.
We use your details only to connect you with that member if you join VouchUp yourself, using the same email or LinkedIn profile.
You can ask us to delete them at any time at support@tabillo.com.

How we use your information

We use the information we collect to:

Create and run your account, and sign you in securely
Show your profile to the people you choose, and in search
Work out how members are connected (1st, 2nd and 3rd degree), and show paths, the network map, recommendations and the feed
Deliver messages, connection requests and notifications
Send the emails the Service needs (such as sign-in codes and confirming a change of email), and the notification emails you choose in Settings
Understand how the public pages are used, so we can improve them
Respond to support requests and resolve issues
Keep the Service safe: prevent spam and abuse, enforce our Terms, and protect members and the public
Comply with legal obligations

We do not sell your personal information. We do not use your profile, messages or contacts to train AI models, and we do not show advertising.

With other members and the public

Your profile is shared as described in What is public on your profile. Your messages are shared with the people you write to. A connection request (with its note) goes to the person you ask. Your contacts, settings and the people you block are never shown to others.

Service providers

We use trusted service providers to run the Service. They have access to personal information only as needed to perform their services, and are contractually obligated to protect it:

Vercel Inc.: hosting and content delivery
Neon Inc. (a Databricks company): database, sign-in, and storage of profile photos
Resend Inc.: email delivery
Google LLC: Google Analytics on public pages, and sign in with Google when you choose it

Legal requirements

We may disclose personal information if required by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, court order or government request; to enforce our Terms of Service; to protect the rights or safety of Tabillo, our members or others; or to detect or prevent fraud or security issues.

Business transfers

If Tabillo is involved in a merger, acquisition, asset sale or other corporate transaction, personal information may be transferred as part of that transaction. We will give notice before your personal information is transferred and becomes subject to a different privacy policy.

Cookies and analytics

We keep cookies and similar storage to a minimum:

Sign-in cookies (essential): keep you signed in until you sign out or your session expires. The Service can't work without them, so they don't need consent.
Preferences (essential, stored in your browser, not a cookie): your light or dark theme, and your cookie choice.
Google Analytics (optional): the cookies _ga and _ga_<id>, kept for up to 2 years, count visits to public pages and how people move between them. They don't identify you by name, we don't send Google your name, email or any account details, and Google's advertising features are turned off.

In the European Union, the European Economic Area, the United Kingdom and Switzerland, Google Analytics does not load at all unless you choose Accept in the cookie notice. Elsewhere it is on by default. Anyone can change their choice at any time with Cookie settings at the bottom of the page; choosing Reject stops Google Analytics and removes its cookies. You can also block cookies in your browser, or install the Google Analytics Opt-out Browser Add-on.

Data retention

We keep your personal information while your account is open. You can delete your account at any time in Settings → Delete account. This deletes your profile, photos, network, contacts, follows, settings and sign-in at once. The messages you sent stay in the chats of the people you wrote to, shown as from "Deleted member"; we keep only a minimal record (an internal member number and the date of deletion) so those chats still make sense.

Server logs are kept by our hosting provider for a short period for security and troubleshooting. Google Analytics data is kept for the period set in our Google Analytics account (up to 14 months). Aggregated, anonymized data that can't identify you may be kept for analysis. We may keep information longer where the law requires it, or to resolve disputes and enforce our agreements.

Data storage and transfers

Personal information is stored and processed on infrastructure in the United States and Canada, by the service providers listed above. It is not transferred elsewhere except as required to deliver the Service or by law. See EU and UK: not yet launched for how transfers are protected for people in Europe.

Security

We use physical, electronic and administrative safeguards to protect personal information against unauthorized access, disclosure, alteration or destruction, including:

Encrypted connections (TLS/HTTPS) for all traffic
Sign-in with one-time email codes or Google, so we never store a password for you
Access to personal information limited to authorized personnel
Regular review of how we collect, store and process data

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at support@tabillo.com.

Security breach notification

If a confirmed security breach affects your personal information, we will notify affected members without undue delay, and where the law requires, the relevant privacy authority within 72 hours of becoming aware of it. The notice will describe the breach, the information involved and the steps we are taking.

Your rights and choices

Many choices are in the app itself:

Edit or remove anything on your profile in the profile editor
Choose who sees your profile, your city and your links, and whether search engines list you, in Settings
Choose which emails you receive in Settings → Notifications
Download a copy of your data in Settings → Download my data
Delete your account in Settings → Delete account

As a resident of Canada, your rights regarding personal information are protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) (S.C. 2000, c. 5) and, where applicable, provincial privacy legislation. You have the right to:

Access: request a copy of the personal information we hold about you
Correction: ask us to correct inaccurate or incomplete personal information
Withdrawal of consent: withdraw consent to our collection or use of your personal information at any time, subject to legal or contractual restrictions (withdrawing consent may affect your ability to use the Service)
Deletion: delete your account, or ask us to delete personal information about you
Complaint: file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated

To exercise any of these rights, write to us at support@tabillo.com or at the address below. We respond within 30 days. We may need to verify your identity first.

EU and UK: not yet launched

VouchUp.me is still under development and has not officially launched in the European Union, the European Economic Area, the United Kingdom or Switzerland. We don't market the Service there yet. If you use it from there, the General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection apply to your personal information, and this section applies to you in addition to the rest of this Policy.

Legal bases

Contract: running your account, showing your profile as you choose, messages, connections and the emails the Service needs
Legitimate interests: working out how members are connected, recommendations and the feed; storing contacts a member imports so they can be connected when those people join; keeping the Service safe; and improving it. We have balanced these against your rights, and you can object at any time
Consent: Google Analytics cookies, and notification emails you turn on. You can withdraw consent at any time, without affecting what happened before
Legal obligation: where the law requires us to keep or disclose information

Your rights

You have the right to access, correct and delete your personal information; to restrict or object to how we use it; to receive it in a portable format (Settings → Download my data); and to withdraw consent. You also have the right to complain to the data protection authority where you live or work, or, in the UK, to the Information Commissioner's Office. Contact us at support@tabillo.com to use these rights; we respond within one month. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

International transfers

Your information is stored in Canada and the United States. Canada is recognized by the European Commission and the UK as providing adequate protection for commercial organizations. For transfers to the United States, we rely on our providers' certification under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. framework) where they have it, or on the European Commission's standard contractual clauses (with the UK Addendum).

Representative

Because we have not launched in the EU or UK, we have not yet appointed a representative there. We will before we launch. Until then, please contact us directly at support@tabillo.com.

Children's privacy

VouchUp is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. If you believe we have collected information from a person under 18, please contact us at support@tabillo.com.

Third-party links

Profiles link to work, posts and accounts on other websites. Those links are provided for convenience; we are not responsible for the privacy practices or content of those sites, and we encourage you to read their privacy policies.

Changes to this Policy

We may change this Privacy Policy. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or in the app before they take effect. Only the current published version is effective.

Contact us

If you have questions, concerns or requests about this Privacy Policy or our privacy practices, please contact our Privacy Officer:

Tabillo Inc. (VouchUp.me): Privacy Officer
218 Queens Quay W
Toronto, ON M5J 2Y6
Canada
support@tabillo.com