Privacy Policy

Effective Date: 18 September 2026

Last Updated: 18 September 2026

This policy explains how Matainable Ltd ("Matainable", "we", "us") handles personal data. It applies to five groups of people:

• visitors to our website;
• anyone who uses our public compliance assistant;
• account holders (the staff of our customers);
• people whose details a customer enters on the platform, such as contacts at a supplier, a factory or a buyer;
• anyone who views a product passport on id.matainable.com or on a customer's own domain.

We follow the UK General Data Protection Regulation and the Data Protection Act 2018. If you are in the European Economic Area, the EU General Data Protection Regulation also applies and this policy covers it.

1. Who we are

The controller of your personal data is:

Matainable Ltd
Company Registration Number: 16543039
Registered Address: 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE
Privacy Contact: admin@matainable.com

We have not appointed a data protection officer. Privacy questions go to the address above. We are reviewing whether to appoint a representative in the EU and will update this policy if we do.

2. Who this policy covers

We are the controller for the data we collect about you directly: your account, your use of the platform, your support messages and any marketing you opt into.

Customers also enter records about their own products, materials, facilities and supply chains. Those records can include the names and business contact details of people at the customer's suppliers, facilities and buyers. For that data the customer is the controller and we are its processor. We handle it only on the customer's instructions under our data processing agreement at https://www.matainable.com/legal/dpa. If a customer entered your details, that customer is responsible for telling you how it uses them.

3. What we collect and where it comes from

We collect the following kinds of personal data:

• Account data: your name, work email address, password (stored hashed, never in plain text), an optional phone number, your role and your country.
• Company profile: company name, registration or VAT number, address fields, and an optional company registration document.
• Product and supply-chain records: the products, materials, facilities and supply-chain data a customer enters, where they name or identify a person.
• Contacts entered by customers: names, email addresses and phone numbers of people at a customer's suppliers, facilities and buyers.
• Assistant questions: what you type into the compliance assistant and the passport chat, together with your IP address.
• Support and marketing: contact-form and support messages, and marketing sign-ups.
• Billing: Stripe holds your card details. We store only your Stripe customer and subscription identifiers. We never see your card number.
• Usage and security logs: IP address, browser type and the actions you take on the platform, kept in an activity log.

This data comes from four sources. Most of it comes from you. Some comes from your employer, or from the customer that entered your details. Stripe tells us the status of your payments. Finally, if a customer consents at signup, we generate a company profile using AI. That profile is inferred from the company name, email domain and registration number alone. We do not look up external registers and we do not search the web.

4. Why we use your data and our lawful basis

The law requires a lawful basis for each use of your data. Ours are set out below.

What we do	Lawful basis
Providing the service: running your account, storing your records and showing them to the people you choose.	Contract: we need this to deliver the service you signed up for.
Billing: taking payment through Stripe and sending invoices.	Contract.
Security, abuse prevention and rate limits: keeping logs, blocking attacks and limiting how often the assistant can be used.	Legitimate interests: protecting the platform and its users.
Product analytics and improvement: understanding which features are used. This runs on our servers only and uses pseudonymised identifiers, never your full email address.	Legitimate interests: improving the service.
Marketing email about Matainable products and events.	Consent: you opt in, and every email carries an unsubscribe link.
Legal duties: keeping tax records and answering lawful requests from authorities.	Legal obligation.

Where we rely on legitimate interests, we have weighed our interests against yours and concluded that they do not override your rights. You can object at any time (see section 11).

5. AI features

Several features use artificial intelligence: the compliance assistant on our website and inside the app, catalogue import, the passport chat and the optional profile generated at signup. When you use one of them, the text you enter is sent to Anthropic in the United States to draft an answer. For search and ranking, the text is also sent to Voyage AI in the United States. We also send the names of materials and components customers enter to Voyage AI to build search indexes. Your question and the answer, with technical metadata, are also recorded in Langfuse (EU) for quality monitoring. PostHog (EU) receives usage metadata only, never your question or your IP address.

Anthropic keeps API logs for up to 30 days and does not use them to train models. We have opted out of model training on our Voyage AI account, so Voyage AI does not retain or train on the text we send. Neither do we. We record questions, answers and technical metadata (IP address, timestamps, token counts) to operate daily usage limits, monitor quality and improve the service. Retention periods are in section 9.

Please do not enter personal data or confidential information into the assistant. Its answers are information, not legal advice, and you should check them before relying on them.

6. Passports and public pages

A customer can publish product passports and a public company page. What appears publicly is decided by that customer's consent switches, not by us. The only field on a passport that could identify a person is the company compliance mailbox the customer chooses to show. Contacts at facilities and suppliers are never shown on public pages.

Readiness scores on passports and public pages measure data completeness: whether the required fields and documents are present. A score does not mean that anyone has checked the underlying claims.

If you only view a passport or a public page, we keep short-lived request logs at the network edge and nothing more, unless you use the passport chat (see sections 5 and 9).

7. Who we share your data with

• Sub-processors: the service providers that host, deliver and support the platform. The full list, with what each one does and where it is, is at https://www.matainable.com/legal/sub-processors.
• Other platform users: only under the visibility and sharing settings your company configures.
• Professional advisers: lawyers and accountants bound by confidentiality.
• Authorities: where the law requires us to disclose data.
• A buyer of our business: if Matainable is sold or merged, and we will tell you if the controller changes.

We never sell personal data, and we never share it with third parties for their own marketing.

8. Where your data is held and international transfers

The platform database is hosted in the United Kingdom by Xano. Uploaded files are stored in Sweden with Amazon Web Services (Stockholm). Analytics and AI observability run in the EU (PostHog, Langfuse). The application itself is hosted in France (WeWeb).

Transfers from the UK to the EEA rely on the UK adequacy regulations. Transfers from the EEA to the UK rely on the European Commission's adequacy decision for the UK, renewed in December 2025. Some providers process data in the United States: Anthropic, Voyage AI, Postmark email delivery (operated by AC PM, LLC), Stripe affiliates and Cloudflare. For those transfers we rely on the UK Addendum to the EU Standard Contractual Clauses or the International Data Transfer Agreement, or on the EU-US Data Privacy Framework with its UK Extension where the recipient is certified. You can ask us for a copy of the safeguards we rely on.

9. How long we keep your data

Data	How long
Account and company data.	For the life of the account, then a full purge 90 days after deletion.
Activity and security logs.	12 months, except the record that an account was deleted, which we keep for 6 years.
Assistant and chat conversations.	12 months.
Public assistant and passport-chat logs, including IP address.	90 days.
Contact-form and waitlist entries.	6 months.
Staged catalogue imports.	30 days after they are processed.
Billing records.	6 years, as the law requires.
Published passports.	For as long as the customer keeps them published. The Terms explain what happens after an account ends.

When a period ends we delete the data or strip it of anything that identifies you.

10. Cookies and local storage

We set no advertising cookies and no analytics cookies. The app stores your sign-in token and your preferences in your browser's local storage. The sign-in token is strictly necessary and the preferences only remember your choices, so the law requires consent for neither and we show no banner. You can clear them at any time through your browser, which will sign you out.

Cloudflare may set a security cookie on passport and demo pages to protect them from automated abuse.

11. Your rights

The law gives you the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted where we no longer need it;
• restrict how we use it in certain cases;
• receive your data in a portable format (you can export your own data from your account at any time);
• object to processing based on legitimate interests;
• withdraw consent at any time, for example by unsubscribing from marketing email.

To use any of these rights, email admin@matainable.com. We respond within one month. The law lets us pause that clock while we confirm your identity or ask you to clarify the request. If a customer entered your details, we pass your request to that customer and help them answer it.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. If you are in the EEA, you can complain to the data protection authority in your own country instead.

12. Security

Data is encrypted in transit and passwords are stored hashed. Access to data is limited by role and by company, so staff at one customer cannot see another customer's records. Our staff and contractors are bound by confidentiality.

13. Children, changes and contact

Matainable is a business service. It is not intended for anyone under 18 and we do not knowingly collect their data.

We may update this policy as the platform and the law change. For material changes we give at least 30 days' notice by email or by a notice in the app before they take effect. Our Terms are at https://www.matainable.com/legal/terms.

Questions about this policy go to admin@matainable.com or by post to Matainable Ltd, 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE.

This policy is governed by the laws of England and Wales.