Privacy Policy
Last updated: 2026-10-27
This policy explains how Mattersimple ("we", "us"), handles personal data in connection with Mattersimple (the "Service"). Contact us about privacy at [email protected].
1. Our two roles
As controller. We decide how and why personal data is processed for the people who sign up for and use the Service on behalf of a firm ("Firm") — owners and staff — and for visitors to our own website at mattersimple.com.
As processor. Firms put data about their own clients, contacts and matters into the Service. For that data the Firm is the controller and we process it only on the Firm's behalf and instructions. If you are a client of a Firm, please contact that Firm about your data; we will help it respond.
2. What we collect
Account data: name, email address, password (stored hashed), photo and bio if you add them, two-factor settings, and your marketing preferences.
Firm data: the Firm's name, address, country, currency and settings, and billing details. Card details are handled by our payment provider; we do not store full card numbers.
Usage and security data: sign-in events, IP addresses, device and browser information, and records of security- and privacy-relevant actions.
Support data: the messages and files you send to our support team.
Website data: on our own website, with your consent where required, analytics and advertising cookies.
3. Why we use it and our legal bases
To provide the Service and support you (performance of a contract).
To bill the Firm and keep financial records (contract and legal obligation).
To keep the Service secure, prevent abuse and keep audit records (legitimate interests and legal obligation).
To send service notices about your account (contract and legitimate interests).
To send product news, only if you opt in (consent, which you can withdraw at any time in your account settings).
To understand use of our website, only with your consent where required.
4. Who we share it with
We share personal data only with service providers that help us run the Service, with professional advisers, and where the law requires. We do not sell personal data.
5. International transfers
Some providers may process data outside your country. Where data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses or another lawful mechanism.
6. How long we keep it
Account and Firm data: while the account or Firm exists. A deleted Firm's data is erased after a grace period of 90 days.
Security and audit records: 24 months.
Website enquiries: 24 months.
Data export files: 30 days.
7. Security
Each Firm's data is kept in its own separate database schema. Data is encrypted in transit, files are stored privately and served only to authorized users, and staff can protect their accounts with two-factor authentication. Our own administrators must use two-factor authentication, and support access to a Firm's account is recorded and shown to the Firm's owner.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict some processing, and to withdraw consent. You can download your data or delete your account in your account settings, or contact us at [email protected]. You can also complain to your data protection authority.
9. Cookies
We use cookies that are needed to sign you in and keep the Service secure. With your consent, our website also uses analytics and advertising cookies; you can change your choice at any time from the cookie banner.
10. Changes
We will post any changes here and, for material changes, tell account holders by email or in the Service.