You own your data
Everything your team puts into Matte stays yours. We host and process it only to run, secure, and improve the service for your organization.
Terms of ServiceData privacy
Your data stays yours.
A plain-language summary of how Matte collects, uses, protects, and deletes the data in your workspace.
Our commitments
What we promise, and where it's written down.
We don't sell it
We don't sell personal information, and we don't sell or share customer data as the CCPA defines those terms.
Data Processing AddendumIt doesn't train AI models
We don't use your customer data to train general-purpose AI or machine learning models.
Data Processing AddendumExport it anytime
Take your data with you through CSV exports, or through the API where it's enabled for your workspace.
Data Processing AddendumDeleted when you leave
After you cancel or send a written deletion request, we remove your data from active production systems within 90 days, and from backups as their normal cycles expire.
Data Processing AddendumTold quickly if something happens
If we confirm a security incident affecting your data, we notify you without undue delay, and within 72 hours where feasible.
Data Processing AddendumWhat we collect
Only what it takes to run Matte.
We use this data to operate the service, secure accounts, answer support requests, and improve reliability. Full details
Who you are
Name, work email, role, and a hash of your password. We never store the password itself.
What your team tracks
Items, counts, inventory records, and the notes attached to them.
How the product is used
Pages visited, feature interactions, and timestamps.
How you connect
IP address, browser type, device identifiers, and log events.
Who can see it
Access is earned, not assumed.
Your team
Workspace roles and permissions decide who can see and change what. Those checks run on our servers, not just in the browser.
Other customers
No access. Workspaces are logically separated, and server-side checks enforce workspace membership.
Matte staff
Only people who need access to run, secure, or support the service, and everyone with access is bound by confidentiality obligations.
Service providers
Only the providers we rely on to host and operate Matte, each under a written agreement with data protection terms at least as strong as ours.
Authorities
Only when the law requires it. Where we're allowed to, we tell you first so you can seek protection, and we disclose no more than required.
Data is processed in the United States and wherever our service providers operate. Transfers from the EEA, UK, and Switzerland are covered by the Standard Contractual Clauses. International transfers
What to keep out
Built for inventory, not sensitive records.
Unless your agreement with us says otherwise, don't store these types of data in Matte. Matte isn't a HIPAA business associate without a separate Business Associate Agreement. Regulated data terms
- Health information covered by HIPAA
- Payment card data covered by PCI DSS
- Government ID numbers and tax identifiers
- Bank credentials, private keys, and other secrets
- Children's data and student education records
- Biometric identifiers and special-category data under GDPR
Your rights
Ask, and we'll act on it.
Depending on where you live, you can ask to access, correct, delete, or export your personal data, or to restrict how it's processed. We may verify your identity first. If your data sits in a company's workspace, that company controls it, so we'll point you to them or follow their instructions.
Privacy requests
Access, correct, delete, or export your personal data.
privacy@trymatte.com
Security reports
Report a suspected vulnerability or security issue.
security@trymatte.com
Legal notices
Contracts, DPAs, and formal legal correspondence.
legal@trymatte.com
This page summarizes our commitments in plain language. The Privacy Policy, Terms of Service, and Data Processing Addendum are the binding documents, and they control if anything here differs.