Terms of Service

Effective date: April 19, 2026

These Terms of Service ("Terms") govern your use of the Vouch Shopify app ("Vouch", "we", "us", or "our"). By installing or using Vouch, you ("merchant" or "you") agree to be bound by these Terms.

1. Acceptance

By installing Vouch from the Shopify App Store or otherwise activating the service, you confirm that you have read, understood, and agree to these Terms. If you do not agree, do not install or use Vouch.

2. Service Description

Vouch is a data processor that acts on behalf of the merchant (the data controller). Vouch collects and processes customer data solely as instructed by the merchant through the app's configuration and in accordance with these Terms. The merchant remains responsible for ensuring that any processing carried out by Vouch on their behalf complies with applicable law.

3. Merchant Responsibilities

As a merchant using Vouch, you agree to:

• Comply with all applicable privacy laws in your jurisdiction (including but not limited to GDPR, CCPA, and PDPO) with respect to customer data processed via Vouch.
• Maintain your own privacy policy for end customers that discloses the use of third-party apps such as Vouch.
• Configure data retention settings in Vouch appropriately for your legal obligations.
• Ensure you have a lawful basis for any marketing communications sent through Vouch on your behalf.
• Where you use Vouch's UGC submission feature to collect customer photos, videos, or reviews for public display, customers consent to display their submitted content by completing and submitting the review form. You must provide, or ensure customers have access to, a means to request removal of their content — see Vouch's Privacy Policy §8 for the withdrawal process.

4. Data Processing Agreement

Vouch processes only the data necessary to provide the service features you have enabled. We do not sell, rent, or trade customer data to any third party. All data associated with your store is permanently deleted when you uninstall Vouch.

Where you provide third-party integration credentials (e.g. email platform API keys), you are responsible for ensuring you have the appropriate rights and consents to authorise that integration.

5. Security Incident Response

Vouch takes the security of merchant and customer data seriously. In the event of a suspected security breach:

• We will begin investigating the incident within 24 hours of detection.
• Affected merchants will be notified by email within 72 hours of confirmed breach, sent to the merchant's Shopify account email address.
• Where legally required, Vouch will cooperate with applicable regulatory disclosure obligations.

To report a security concern, contact us at support@vouch.hk.

6. Shopify Partner Agreement

Your use of Vouch is also governed by Shopify's Partner Program Agreement. In the event of a conflict between these Terms and Shopify's Partner Program Agreement, Shopify's agreement takes precedence with respect to platform-level obligations.

7. Third-Party Platform Integrations

Instagram / Meta

Vouch integrates with the Meta Graph API to allow merchants to connect their own Instagram Business account and display their Instagram posts in Vouch-powered storefronts. By enabling this integration, you acknowledge and agree that:

• You may only connect an Instagram account that you own or are duly authorised to use. Vouch may not be used to access, store, or display Instagram content from accounts you do not own or have not been expressly authorised to use.
• Your use of Instagram content through Vouch is subject to Meta's Platform Terms and Developer Policies. You are responsible for ensuring your storefront's display of Instagram content complies with those policies.
• Vouch stores only the CDN URL strings, captions, and permalink references for your Instagram posts. Vouch does not download, copy, or re-host your Instagram media files. All images and videos continue to be served directly from Instagram's CDN.
• Instagram CDN URLs may expire in accordance with Meta's policies. Vouch is not liable for Instagram media becoming unavailable after a CDN URL expires.
• Vouch displays an Instagram attribution icon and permalink link alongside every Instagram post shown on your storefront, in accordance with Meta's attribution requirements.
• You may disconnect your Instagram account from Vouch at any time via the app settings. Upon disconnection, Vouch will cease fetching new Instagram content. You may also request deletion of all stored Instagram post metadata by contacting support@vouch.hk.

8. Limitation of Liability

To the maximum extent permitted by applicable law, Vouch shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or goodwill, arising out of or in connection with your use of the service, even if advised of the possibility of such damages. Vouch's total aggregate liability to you shall not exceed the amounts paid by you to Vouch in the twelve months preceding the claim.

9. Changes to These Terms

Vouch may update these Terms from time to time. When material changes are made, we will update the effective date above. Continued use of the service after the updated Terms are posted constitutes your acceptance of the revised Terms.

10. Contact

For questions about these Terms, email us at support@vouch.hk.