v0uch.me Partner Privacy Policy

Effective Date: 02-19-26
Last Updated: 02-19-26

This document is a draft and is pending legal review. It does not constitute a binding agreement until finalized and published.

1. Introduction

This Partner Privacy Policy describes how v0uch.me ("we," "us," or "our") handles data in the context of our partner integrations. It applies to businesses and organizations ("Partners") that integrate with v0uch.me's age verification services through our OAuth 2.0 API.

This policy supplements our general Privacy Policy and addresses the specific data flows between v0uch.me and our partners.

2. Data Shared with Partners

When a user authorizes a partner to verify their age through v0uch.me, the partner receives only the following:

• Boolean age claims: A simple confirmation that the user meets the required age threshold (e.g., "18+" or "21+"). The user's actual date of birth is never disclosed.
• Pairwise subject identifiers: A unique identifier specific to each partner-user combination. This identifier cannot be used to correlate users across different partner sites.

No personal information -- such as names, addresses, government ID images, or dates of birth -- is ever shared with partners.

3. Data Received from Partners

During partner registration and integration, we receive the following from partners:

• Redirect URIs for the OAuth authorization flow;
• Client credentials (client ID and secret) for API authentication;
• TLS certificates for mutual authentication (mTLS);
• Contact information for the partner organization.

4. Data Retention

Partner registration data is retained for the duration of the partner relationship and for a reasonable period after termination to fulfill legal and auditing obligations.

Authorization and token data is retained only as long as needed to process the verification request and is subject to configurable expiration periods.

5. User Consent and Revocation

Users must explicitly consent before their age verification status is shared with a partner. Users can revoke consent at any time through their v0uch.me account settings.

When consent is revoked, partners are notified via webhook and must promptly cease using the previously provided verification data. Partners must delete any cached verification claims upon receiving a revocation notification.

6. Partner Data Handling Obligations

Partners who integrate with v0uch.me agree to the following data handling obligations:

• Do not attempt to deanonymize or re-identify users;
• Do not share age verification claims with third parties without user consent;
• Do not use pairwise identifiers to track users across websites or services;
• Implement appropriate security measures to protect any data received from v0uch.me;
• Promptly report any data breach that may affect v0uch.me users.

Failure to comply with these obligations may result in immediate termination of partner access and may be reported to relevant regulatory authorities.

7. Security Requirements

All communications between partners and v0uch.me are secured using mutual TLS (mTLS). Partners are responsible for:

• Maintaining valid TLS certificates issued or approved by v0uch.me;
• Rotating certificates before expiration as specified in the integration documentation;
• Securing their client credentials and preventing unauthorized access;
• Implementing PKCE for all authorization flows to prevent token interception.

8. Contact Information

For questions about this Partner Privacy Policy or data handling practices, please contact us:

v0uch.me
Email: privacy@v0uch.me
For partner-specific inquiries: partners@v0uch.me