What we collect, what we share, and what we don’t

VoucherGrid (“we”, “us”, “our”) - operated by VoucherGrid Australia Pty Ltd, trading as VoucherGrid (ABN 20 701 919 520) - operates the platform at vouchergrid.com. This policy explains how we collect, use, disclose, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

§1 · Information we collect

Account information

When you register, we collect your name, email address, business name, ABN, and phone number. If you connect a Stripe account, Stripe shares limited account details (account ID, business name) with us to enable payment processing.

Voucher and transaction data

We store voucher details (amounts, recipients, redemption history) and transaction metadata (dates, statuses) on your behalf. Credit card numbers are processed and stored exclusively by Stripe - they never touch our servers.

Browser extension data

Public browser extension distribution is not yet released. The data handling below applies when the extension is used.

VoucherGrid Quick for Chrome and Safari stores a short-lived extension token and your privacy acknowledgement in extension-local storage on your device. When you look up, sell, or redeem a voucher, it sends that token, the voucher code, and the details you enter to VoucherGrid over HTTPS. The token identifies your VoucherGrid user and business, expires after no more than 24 hours, and can be revoked from Settings. The extensions also store opaque request fingerprints and idempotency keys for unconfirmed sales or redemptions so an interrupted retry cannot duplicate the operation. Those records contain no plaintext voucher, merchant, or token data and are removed after server confirmation or unlinking. The extensions do not read browser cookies or browsing history.

Chrome Web Store Limited Use

VoucherGrid Quick's use and transfer of user data will comply with the Chrome Web Store User Data Policy, including the Limited Use requirements. Chrome extension data handling is described above.

Purchaser location data

When customers purchase vouchers from your online store, we use Cloudflare geo headers (country, region, city derived from the purchaser’s IP address) to provide geographic analytics on your dashboard. The purchaser’s IP address is processed to derive the location and is not kept in your analytics - only the derived location is retained. Infrastructure and security providers listed in the Sub-Processor Register process IP addresses as request metadata.

Usage data

We use limited Sentry error reporting to diagnose failures and security incidents. It retains code-location information and limited technical metadata. Our necessary-error controls exclude customer content, voucher tokens, credentials, sensitive URL parameters and unnecessary identifiers. This reporting is separate from optional analytics.

Sentry performance tracing and Vercel Speed Insights require opt-in consent, alongside PostHog and Web Analytics. You can refuse or withdraw consent through Cookie Settings. Session replay is disabled. These are our product choices, not a statement that every performance tool legally requires consent in every jurisdiction.

§2 · How we use your information

For merchant customer data, we process information on the merchant's documented instructions. We determine the purposes of our own subscription billing, business administration and independently determined fraud/security processing. Staff information can serve either purpose. Our initial merchant service is for Australian businesses; applicable obligations still depend on the actual processing and people involved.

• To provide and maintain the VoucherGrid service
• To process transactions and deliver vouchers on your behalf
• To communicate with you about your account (billing, security, support)
• To generate accounting and analytics reports you request
• To provide geographic purchase analytics on your dashboard
• To improve the platform based on aggregated, de-identified usage patterns

§3 · Sharing your information

We share personal information only:

• With Stripe - to process payments. Stripe’s privacy policy applies to data they hold.
• With email providers - to deliver voucher emails on your behalf (e.g. Resend). Recipient names, email addresses and email content (including voucher details and gift messages where included) are shared for delivery.
• With PostHog - to collect product analytics. PostHog processes usage data on our behalf.
• With Sentry - to monitor errors and application performance.
• With Freshdesk - to create in-app support tickets for authenticated merchants. Freshdesk processes merchant names, email addresses, tenant IDs, and ticket content in the US.
• With accounting providers - when you enable an accounting integration (Xero, QuickBooks), we share financial transaction data (voucher amounts, dates, and reference codes) to create journal entries in your accounting system.
• With a referring partner - when you create an account through a partner referral link, we show that partner your business name, referral date, referral status, subscription status, and whether you separately grant accounting access. We do not share financial, voucher, or customer data through the referral program.
• With Cloudflare - for file storage (R2) and bot protection (Turnstile). Cloudflare processes user interaction data for bot detection and stores uploaded files on our behalf.
• When required by law - to comply with legal obligations, court orders, or regulatory requests.

We do not sell or rent personal information to third parties.

For a complete list of our data sub-processors, including data regions and links to each provider’s data-processing or privacy terms, see our Sub-Processor Register. Merchants requiring a formal agreement can view our Data Processing Agreement.

§4 · Data storage and security

Application data is stored on servers located in Singapore, operated by Render, our hosting provider. Requests also pass through global edge providers (Vercel, Cloudflare), and some telemetry is processed in the US - the Sub-Processor Register lists every provider and region. Under Australian Privacy Principle 8 (APP 8), we take reasonable steps to ensure overseas recipients handle your information in accordance with the APPs.

All data is encrypted in transit (TLS 1.2+) and at rest. We use role-based access controls, audit logging, and regular security reviews. Sensitive personal information is encrypted at the field level using envelope encryption.

§5 · Your rights

Subject to applicable law and identity verification, you can:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Ask for deletion of your account and associated data; the request must be assessed against applicable retention and legal obligations, not a universal right to erasure
• Request an export of your data, subject to identity verification and applicable retention limits
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs

If you are a voucher purchaser or gift recipient who does not have a VoucherGrid account, you can submit data access, export or deletion requests through our email-verified data subject request process. Contact privacy@vouchergrid.com or visit the merchant's store page to initiate a request.

Paid cancellation and handover

Cancelling renewal keeps your paid plan, public store and new sales available until the provider-confirmed end of your paid billing period. You can reactivate before that period ends. The next 30 calendar days provide existing-voucher handover: authorised viewing, redemption, permitted refunds and voids, and existing ledger, report and accounting exports remain available. New sales and issuance stop during handover.

An interim export is prepared when handover begins. At the fixed operational cutoff, operational access and public live-balance access end and a final export is prepared. Cancelling does not cancel valid vouchers or remove your responsibility to honour them outside VoucherGrid.

Retained records and access

Verified owners can use records-only access without resubscribing. Explicitly authorised representatives can use representative records access. Retrieval covers records still retained and permitted for disclosure; it does not reopen the workspace or provide live balances. Exports distinguish the cutoff, snapshot and generation dates, with later retained activity labelled separately.

Private download links are time-limited. Records-only links last up to 15 minutes, subject to the package expiry. Revoking representative access stops new requests and links; an already issued link expires at its original expiry time. Deleted or anonymised information is not reconstructed from earlier archives.

Retention and deletion

Paid cancellation and operational cutoff do not themselves anonymise customer records. We keep personal information only for the purposes for which it is needed, including providing the service, supporting outstanding vouchers, complying with law and handling legitimate disputes. We assess retention by record category and purpose, rather than keeping every customer detail for the same period.

• Financial records: retain the minimum transaction fields and supporting evidence for the applicable statutory period or lawful, documented merchant instruction. Where the seven-year company-record requirement applies, it runs after the covered transactions are completed.
• Profiles, contact details and messages: review whether they remain necessary after service and handover end or when a verified request is received. Delete or de-identify information no longer needed, unless retention is required by law or a justified continuing purpose.
• Security and audit records: keep information needed to investigate incidents and substantiate relevant transactions. Retention depends on the record and purpose; a selected incident does not justify preserving all customer information indefinitely.
• Exports and backups: a download link expiring is not evidence of stored-object deletion. Temporary packages and backup copies follow their separate cleanup and provider recovery processes. Until removal, restrict retained copies to recovery or another justified purpose and reapply completed deletion instructions after restoration.

We can handle these reviews and verified requests manually. A legal or dispute hold records the affected information, reason, responsible person and review date. It does not automatically restart every retention period. Where immediate destruction of a backup is not reasonably possible, we restrict its use and take reasonable steps to remove it through the applicable recovery cycle; we do not promise a single expiry period for all copies.

Keyed hashes and surviving identifiers remain personal information where someone is reasonably identifiable. Removing names alone does not establish de-identification. Merchant downloads and independently controlled provider records require separate handling; we do not promise erasure of copies outside our control.

Trial expiry is separate

If a trial ends without payment details, the existing seven-day read-only grace period applies. Choose a paid plan to restore full access. This is different from paid-cancellation handover; failed payment and immediate account deletion are also separate processes.

§6 · Cookies

Essential authentication/session cookies are separate from optional tracking. Optional behavioural and performance collection remains off until you opt in; rejection or withdrawal keeps it off. Session replay remains disabled even after consent. Limited necessary error/security reporting is separate. Accepting Terms or the DPA, or acknowledging this Privacy Policy, does not provide optional tracking consent.

§7 · Third-party links

Our platform may contain links to third-party websites (e.g. Stripe, Xero, QuickBooks). We are not responsible for the privacy practices of those sites.

§8 · Changes to this policy

We explain material changes to our information handling and provide affected merchants with the notice described in the Terms. Changes apply prospectively; earlier versions and acceptance records are retained. We obtain fresh consent where required for a changed use. Acknowledging this policy remains separate from optional tracking consent.