Privacy Policy

1. Who we are

Matys ("Matys", "we", "us") provides an AI data analyst that connects to your company's data and answers questions with charts, dashboards and reports. This policy explains what personal data we collect when you visit our website or use our service, why we collect it, and the choices you have.

For account, website and billing data, Matys is the data controller. For the data our customers connect or upload to the service, the customer is the controller and Matys processes it on their behalf, under our agreement with them and our Data Processing Addendum. If your data reached us through one of our customers, please contact that customer first.

2. Data we collect

• Account data: your name, email address, profile picture when you sign in with Google, a hashed password when you sign in with email, and your organization and role.
• Content: the questions you ask, the AI answers, charts, dashboards and files you create or upload, and the messages you send us through Slack or WhatsApp.
• Connected data: the credentials you give us for your databases, warehouses, code repositories and apps, and the query results and metadata we read from them to answer your questions.
• Integration data: your Slack workspace and user identifiers, your WhatsApp phone number, and your GitHub installation details when you connect those services.
• Billing data: plan, invoices and billing contact. Stripe processes card details; we never see or store your full card number.
• Usage and device data: pages and features used, IP address, browser, device type, and error reports, collected through cookies and similar technologies.

3. How we use your data

We use personal data on the following legal bases under the GDPR:

• To provide, secure and support the service you signed up for — performance of a contract.
• To bill you and meet our tax and accounting duties — contract and legal obligation.
• To understand usage, fix bugs, prevent abuse and improve the product — legitimate interests.
• To send product updates and newsletters, which you may unsubscribe from at any time — consent or legitimate interests.
• To comply with the law and respond to lawful requests — legal obligation.

We do not sell your personal data and we do not use it for targeted advertising.

4. AI processing

To answer a question, we send your prompt and the relevant data and context to our model provider, OpenAI, through its API. OpenAI does not use API data to train its models. Matys does not train AI models on your content or connected data. We record traces of AI requests to debug and improve answer quality, and keep them under the same retention and access controls as the rest of your content.

AI answers can be wrong. Review them before relying on them for important decisions.

5. Who we share data with

We share personal data only with service providers that process it for us under written contracts, with the organization that owns your workspace, and when the law requires it. Our current sub-processors are:

If Matys is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

6. International transfers

Some of our providers process data outside the European Economic Area, including in the United States. When they do, we rely on the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism.

7. Retention

We keep account data and content for as long as your account is active. When you or your organization delete content or close an account, we delete it or anonymize it within 30 days, except where we must keep it longer to meet legal, tax or accounting duties, or to resolve disputes. Backups roll over on a fixed schedule. Analytics and error data are kept for no longer than needed for their purpose.

8. Security

We protect your data with encryption in transit (TLS) and at rest, encrypted storage of connector credentials, role-based access controls, malware scanning of uploaded files, and least-privilege access for our staff. We are currently undergoing a SOC 2 Type II audit. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

9. Your rights (EEA, UK and Switzerland)

You have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased
• restrict or object to our processing, including for direct marketing
• receive your data in a portable format
• withdraw consent at any time, where we rely on it

To exercise a right, email [email protected]. We answer within one month. You may also lodge a complaint with your local data protection authority.

10. Your rights (United States)

Residents of California and other US states with privacy laws have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to not be discriminated against for exercising these rights. The categories we collect are those listed in section 2, for the purposes in section 3, disclosed to the providers in section 5.

We do not sell or "share" personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. To make a request, email [email protected]. We will verify your identity before acting on it. You may use an authorized agent.

11. Cookies

We use strictly necessary cookies to keep you signed in and secure the service, and analytics cookies to understand how the product is used. You can block or delete cookies in your browser settings; the service may not work without the necessary ones.

12. Children

Matys is a business product and is not directed to children under 16. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We will change the date at the top of this page, and notify you by email or in the product before a material change takes effect.

14. Contact

For any question about this policy or your personal data, email [email protected].