Privacy Policy

1. Who is responsible

For the personal data of MatrisAI account holders (solo businesses, agencies, and the staff they invite) and of people who leave their details on our own website, MatrisAI is the data controller.

For the personal data of customers and visitors of the stores, booking sites and websites run on MatrisAI, the business that runs that site is the controller and MatrisAI is a processor acting on its instructions. The Data Processing Terms in section 12 form the processing agreement the GDPR requires between us.

Where an agency runs a site for one of its own clients, the agency and its client decide between themselves who controls that site's customer data, and should record it in their own agreement. Whatever they decide, our instructions come from the account holder we contract with, the agency, and our role stays that of a processor. If you are an agency's client and want to know how your site's data is handled, ask your agency first; we will help them answer, but we cannot act on their client's instructions without them.

Some third parties we work with are not our processors and decide for themselves how they use data: a payment provider verifying a business's identity, a domain registry recording a registrant, a marketplace receiving an order. Section 6 says which is which, because the difference decides who you address a request to.

2. What we collect

2.1 Account data

• Name and email address (provided at sign-up or through a sign-in provider such as Google);
• Encrypted password hash, or for single sign-on the provider's user identifier;
• If you enable two-factor authentication, your TOTP secret (stored encrypted at rest); if you register a passkey, its public key and credential identifier. A passkey's private key never leaves your device and never reaches us;
• Billing details: company name, tax identification number, billing address. Payment card numbers are entered directly into our payment provider and never reach our systems;
• If you activate card payments through our platform, the identity details Stripe requires to open a connected account in your name. Those details go to Stripe, which verifies them as a controller in its own right under the financial-regulation obligations that apply to it;
• If you register a domain through us, the registrant details the registry requires, including for .ro an identification number. These are passed to the registrar and registry because the registry requires them.

2.2 What you type into our sign-up boxes

When you enter your email address in a sign-up box on matris.ai, or describe your business in the box on our home page, we store what you sent the moment you send it, before you have an account:

• your email address, if you gave one;
• the description of your business, if you wrote one;
• the kind of business the page was about (for example online stores), the language of the page and the page you were on;
• where you gave an email address, a record that you saw the sentence beside the box ("By continuing, you agree to receive emails from MatrisAI. Unsubscribe anytime."), which version of it you saw (currently landing-v3-2026-10-06) and when;
• a keyed one-way hash of your IP address, used to limit abuse of the form. We do not store the address itself.

We use this to open the registration page with your details already filled in, through a one-time link that works for 24 hours and never puts your email address in a web address; to set up the kind of business you described once you have an account; and, where you gave your email address, to write to you as described in section 3. If you then create an account, the record is linked to it. If you do not, the record is deleted 12 months after you sent it, whether or not it holds an email address (section 7).

2.3 Service-usage data

• Logs of API requests, page views in the dashboard, error traces and performance metrics, used to operate and improve the Service;
• Counters of what your account uses (projects, visits to the sites you run, transactional emails sent, and paid orders where your plan carries a commission) for billing and for enforcing plan limits;
• IP address, user-agent, browser and operating-system metadata at the time of a request, retained in network logs for security and abuse prevention;
• A device signature derived from your browser, language and network, used to recognise a sign-in from a device you have not used before and to email you about it. It is a one-way value computed from those signals; it is not an advertising identifier and is not shared;
• Support conversations you open with us, including any files you attach.

2.4 Content you upload

• Product catalogues, services, menus, copy, images and other media you upload to your sites;
• Order, booking, customer and inventory records created in your sites;
• Settings, design customisations, and any other configuration you make.

2.5 Your customers' data (we process on your behalf)

When your customers place an order, make a booking or otherwise interact with a site hosted on MatrisAI, we process the data you collect from them (name, address, email, phone, order and booking history) on your behalf. Sections 7 and 12 of this policy explain the safeguards.

2.6 Cookies and measurement on our own sites

On matris.ai and in the dashboard we set first-party cookies that are strictly necessary: to keep you signed in, to carry your sign-up details from our website to the registration page, to remember which organisation you are working in, and to remember your cookie choice itself. These do not require consent and cannot be turned off without breaking the Service.

We also measure how our own marketing site and dashboard are used, and we may send a small number of events (a sign-up, a started trial, a subscription) to advertising platforms so we can tell which of our campaigns work. This is optional and off until you agree to it. The banner you see on your first visit is where you agree or decline, and you can change your mind at any time from the "Cookie settings" link at the bottom of every page. Declining does not limit anything about the Service. Our Cookie Policy lists each cookie.

None of this runs on a white-label domain. Where an agency serves the panels under its own brand, our measurement is not loaded at all: their clients are not ours to measure.

Sites built on MatrisAI are separate. Any analytics or advertising there is configured by the business that runs that site, is subject to the visitor's consent on that site, and is covered by that site's own cookie policy, not by this one.

3. Why we use this data

• To operate the Service: serve your dashboard, host your sites, sync inventory, process orders and bookings, and deliver transactional email such as order and booking confirmations.
• To bill you: charge subscription fees, commission and usage-based overage, generate invoices, and handle payment disputes.
• To secure the platform: detect and stop fraud, abuse, brute-force login attempts and other security threats.
• To support you: reply to your email tickets and investigate issues you report.
• To write to people who left their email address on our website: where you gave us your address in a sign-up box and agreed to receive emails from MatrisAI, we may send you emails about MatrisAI, such as help finishing your sign-up and news about the product. Every one of them has a one-click unsubscribe link that takes effect immediately (section 5).
• To help you finish setting up your account: if you start creating an account and stop part way (before confirming your email address, finishing the first questions, or creating your first business), we send you a few short emails that help you finish. At most two for each step, they stop as soon as the step is done, and you can turn them off with the link in any of them or in your notification settings.
• To measure our own marketing: where you have agreed to it, to see which of our campaigns bring people to MatrisAI. You can decline this, and withdraw at any time, without any effect on the Service. Never on a white-label domain.
• To improve the product: measure aggregated feature usage and error rates so we know what to fix and what to build next. Personal data is not used to train marketing audiences.
• To comply with the law: respond to lawful requests from public authorities, defend our legal rights, and meet our tax and accounting obligations.

4. Legal bases (EU/EEA / UK)

We process personal data under the following GDPR bases:

• Contract: to provide the Service you signed up for, and to take the steps you asked for before signing up, such as filling in the registration page with the details you gave us;
• Legitimate interests: to keep the Service secure, prevent abuse, improve product quality, and send the emails that help you finish setting up your account (which you can turn off at any time), balanced against your rights;
• Legal obligation: tax and accounting recordkeeping, responding to court orders;
• Consent: for the emails we send to an address left in a sign-up box on our website, for the optional measurement described in section 2.6, and for any other optional processing that requires it (we will ask before relying on this basis).

5. Emails, and how to stop them

Every marketing email we send has a one-click unsubscribe link. One click stops our marketing emails to that address immediately, whether or not you have an account; there is nothing to sign in to and nothing to confirm. You can also write to support@matris.ai and we will do it for you.

After you unsubscribe we keep only a suppression record, your email address and the date you unsubscribed, so that we never write to it again. Everything else you sent through the sign-up box is deleted on the 12-month schedule in section 7. If you also want the suppression record deleted, ask us, and we will delete it; we then have no way to remember that you asked not to be written to, so a later sign-up starts afresh.

Emails that are part of running an account you hold (sign-in codes, security notices, invoices, order and booking confirmations) are not marketing and do not stop when you unsubscribe from marketing.

6. Who we share data with

We share data only as described below. The distinction that matters is between a sub-processor, which acts only on our instructions, and an independent controller, which decides for itself what it does with the data and answers to you directly.

• Sub-processors: vendors that help us run the Service and act only on our instructions: our cloud, edge hosting and CDN provider, which is where the platform runs and where data is stored; our transactional email provider, which delivers mail on our behalf and on yours. All are bound by written data-processing terms. A current list is available on request to support@matris.ai.
• Independent controllers: Stripe, which handles our subscription billing and, where you activate card payments, the connected account opened in your name through Stripe Connect; it decides for itself what it needs in order to meet its own regulatory obligations. The domain registrars and registries that record a registrant, which are required by their own rules to hold and in some cases publish those details. Their privacy policies govern what they do with that data.
• Service integrations you enable: when you connect a third party (a marketplace, a courier, an analytics or advertising platform, an app from our catalogue) we forward only the data that integration needs, and only after you enable it. An app you install acts on the permissions you grant it, which are shown to you before you confirm.
• Law enforcement and authorities: when we are legally required to do so, or when disclosure is necessary to protect the rights, property or safety of MatrisAI, our users or others.
• Successors: in a merger, acquisition or sale of all or part of our business, personal data may be transferred to the successor under the same protections.

We do not sell personal data and do not share personal data with advertising networks or data brokers.

7. How long we keep data

• Account data: while your account is active. When you ask us to close it, we schedule deletion after a 30-day grace period during which you can change your mind and nothing is lost.
• Sign-up details from our website: the link that fills in the registration page stops working after 24 hours. If you do not create an account, the record (with or without an email address) is deleted 12 months after you sent it; you can ask us to delete it sooner. If you unsubscribe, only the suppression record described in section 5 is kept, the address and the date, so that we never write to it again. If you create an account, the record is linked to the account and follows it.
• Billing records: for the period accounting and tax law requires, typically up to seven years. These are not deleted on request, because we are not permitted to delete them.
• Security and audit records: the log of privileged and security-relevant actions, and the IP and device details attached to it, are kept for up to two years and then anonymised. They exist to answer questions about account access after the fact, including yours.
• Operational logs: 30 to 90 days. Aggregated metrics that no longer identify anyone are kept longer.
• Your content and your customers' data: while your account is active. After closure, or after a lapsed subscription runs through the timeline in our Terms, the projects and their data are deleted. Export before then; deletion is not reversible.

8. Your rights

Under the GDPR and equivalent laws you have the right to:

• access the personal data we hold about you,
• correct inaccurate data and complete incomplete data,
• delete your data ("right to be forgotten"), subject to the retention requirements above,
• restrict or object to certain processing, including any processing based on our legitimate interests,
• port your data to another provider in a structured, machine-readable format,
• withdraw any consent you have given, without affecting processing that already happened. For our emails the unsubscribe link is the control; for the measurement described in section 2.6 it is the "Cookie settings" link at the bottom of every page,
• lodge a complaint with your local data-protection authority (in Romania, ANSPDCP, dataprotection.ro).

To exercise any of these rights, email support@matris.ai. We will respond within 30 days.

9. International transfers

MatrisAI is operated from the United States by MatrisAI, LLC, and uses sub-processors that may store and process data in the United States, the European Union and other regions where they operate. Where personal data of EU/EEA, UK or Swiss data subjects is transferred outside its country of origin, the transfer is protected by the European Commission's Standard Contractual Clauses (or the UK equivalent), the EU-U.S. Data Privacy Framework where applicable, or another approved transfer mechanism.

10. Security

We protect personal data with technical and organisational measures appropriate to the risk: encryption in transit and at rest, a separate isolated runtime and database per business, scoped access to data, rate limiting and abuse controls, phishing-resistant authentication for operator accounts, an append-only audit log of privileged operations that cannot be edited or deleted by the application, alerting on security-relevant events, and regular review of access rights and of the third-party code we depend on.

No system is perfectly secure. If you become aware of a vulnerability or potential breach, please report it responsibly as described on our security page.

11. Children

MatrisAI is not directed at children under 16 and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data to us, contact support@matris.ai and we will delete it.

12. Data Processing Terms (DPA)

These Data Processing Terms apply when MatrisAI processes personal data on behalf of an account holder (the "Controller") who provides stores, booking sites, websites or other services to its customers using MatrisAI.

12.1 Roles

Controller is the data controller of its customers' personal data. MatrisAI is the data processor and acts only on documented instructions from the Controller. Those instructions are reflected by the configuration the Controller makes in its admin (which features are enabled, which integrations, which retention settings) and by use of the Service consistent with these Terms.

12.2 Subject matter, duration and categories

Categories of data subjects: customers and visitors of the Controller's sites, and the staff the Controller gives access to them. Categories of personal data: name, contact details, billing and shipping address, order, booking, return and inventory records, marketing preferences, and the IP address and device metadata of visitors.

Where the Controller is an agency operating a site for its own client, the agency remains the Controller towards MatrisAI and is responsible for having whatever agreement it needs with that client. MatrisAI acts on the agency's instructions.

Subject matter: providing the Service. Nature and purpose: hosting, storing, transmitting and otherwise processing the Controller's data as needed to run the sites the Controller operates. Duration: for as long as the Controller holds an account, and thereafter as described in section 12.7.

12.3 Confidentiality and security

MatrisAI ensures that personnel authorised to process personal data are bound by confidentiality obligations and applies the security measures described in section 10.

12.4 Sub-processors

Controller gives general authorisation for MatrisAI to engage sub-processors as described in section 6. MatrisAI imposes data-protection obligations on each sub-processor no less protective than those in these Terms and remains responsible for their acts and omissions. MatrisAI will give the Controller reasonable notice before adding or replacing a sub-processor, so that the Controller may object on reasonable data-protection grounds; where an objection cannot be resolved, the Controller may terminate the affected part of the Service.

12.5 Data subject rights and assistance

MatrisAI will provide reasonable assistance to the Controller in responding to requests from data subjects, in conducting impact assessments, and in handling breach notifications. Where MatrisAI receives a request from a data subject relating to Controller's data, MatrisAI will forward it to the Controller and not respond directly.

12.6 Breach notification

MatrisAI will notify the Controller without undue delay (and in any case within 72 hours where feasible) after becoming aware of a personal data breach affecting Controller's data, along with the information needed for the Controller to meet its notification obligations.

12.7 Return or deletion on termination

On termination of the Service, MatrisAI will, at the Controller's choice, return or delete all personal data, unless law requires further retention. Default behaviour is deletion within 30 days of termination if no other choice is communicated.

12.8 International transfers

Where processing the Controller's data involves a transfer out of the EEA, the UK or Switzerland, it is carried out under the European Commission's Standard Contractual Clauses (module three, processor to processor, or module two where MatrisAI receives data directly from a controller), the UK International Data Transfer Addendum, or another mechanism approved under the applicable law. By accepting these Terms the parties are taken to have entered into those clauses for that purpose.

12.9 Audits

MatrisAI will make available to the Controller information reasonably necessary to demonstrate compliance with these Terms and will allow audits on reasonable notice and during business hours, subject to confidentiality safeguards.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced at least 30 days in advance via email to the address on file or via a notice in the dashboard.

14. Contact

For any privacy question, including DPA requests and data subject rights, write to support@matris.ai or send post to:

Billing records that contain personal data are also kept in line with U.S. federal and California state tax-record retention requirements.