Privacy Policy

We collect only what we need to run your workspace and reach you where you asked us to.

• Account details. Your name, email address, password (stored only as a salted hash), phone number if you add one, and time zone. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Workspace content. The pages, databases, tables, records, links and files you create or upload, including items in your trash.
• Assistant conversations. The messages you exchange with the assistant, and the drafts, triggers and notifications it creates for you.
• Channel messages. When you link a channel (email, SMS, WhatsApp, Telegram, Messenger, Instagram, Discord or Slack), we receive the messages you send us through it and the sender identifiers that come with them.
• Gmail access. If you connect Gmail, we store an access token that lets us send email from your address. We request send-only permission and cannot read your inbox.
• Plan and usage. Your plan, and counts of pages, databases, tables and storage used, so we can apply your plan's limits.
• Technical data. IP address, browser type, and request logs that our servers record to operate and secure the service.

We use your information to:

• provide the workspace, search and the assistant, and deliver messages you ask for;
• authenticate you and keep your account secure;
• apply plan limits and handle billing;
• send service emails such as password resets and important changes;
• investigate abuse, fix problems and keep the service running.

We do not sell your personal information, show you ads, or use your workspace content to train AI models.

To answer you, the assistant sends the relevant parts of your workspace and conversation to a third-party large language model provider. We also create embeddings (numeric representations) of your documents so the assistant can find what's relevant.

These providers process data on our behalf under agreements that do not allow them to train their models on it. The assistant can make mistakes; check anything important before you rely on it.

MatterbaseAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google sign-in gives us your name, email address and profile picture, which we use only to create and identify your account.
• The Gmail send permission is used only to send emails you have asked the assistant to send or have approved as a draft. We do not read, store or scan your mailbox.
• We do not use Google user data for advertising, sell it, or use it to train AI models, and no person reads it unless you ask us to for support, it is needed for security or the law requires it.

You can disconnect Gmail in Settings or revoke access from your Google account at any time.

We share information only with service providers that help us run MatterbaseAI, and only what each one needs:

• hosting, database and file storage providers;
• large language model and embedding providers (see AI processing);
• Zavu, to send and receive SMS, WhatsApp, email and other channel messages;
• Google, for sign-in and Gmail sending when you enable them;
• messaging platforms you link, such as Telegram, Slack or Discord;
• a payment processor when you buy a paid plan. We never see your full card number.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy continues to apply to your information.

We use a session cookie to keep you signed in and your browser's local storage to remember preferences such as light or dark mode. We don't use advertising or cross-site tracking cookies.

We keep your content for as long as your account exists. Items you move to the trash stay there until you delete them permanently. When you delete your account, we delete your workspace, conversations and linked channels within 30 days, except where the law requires us to keep a record, such as billing history.

Backups and server logs are overwritten on a rolling basis, within 90 days.

Data travels over encrypted connections, passwords are hashed, and your browser never holds the credentials our servers use to reach your data. Incoming webhooks from channel providers are verified by signature. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect unauthorized access.

You can:

• view and edit your profile, phone number and linked channels in Settings;
• download your files and delete any content in your workspace;
• disconnect Gmail or any channel at any time;
• ask us for a copy of your data, to correct it, or to delete your account.

Depending on where you live (for example the EU, UK or California), you may have further rights, such as to object to or restrict processing, to data portability, and to complain to your local data protection authority. We honor these requests regardless of where you are. Email [email protected] and we'll respond within 30 days.

We and our providers may process your information in countries other than your own, including the United States. Where required, we rely on safeguards such as Standard Contractual Clauses to protect it.

MatterbaseAI is not intended for children under 16, and we don't knowingly collect their information. If you believe a child has given us personal information, contact us and we'll delete it.

If we make a material change, we'll update the date at the top and let you know by email or in the app before it takes effect.

MatterbaseAI is responsible for your information. Questions or requests go to [email protected].