Privacy Policy
Version 2026-10-13
Responsible for your data: MatchyTouch (the name under which the Platform is operated; when an operating company is registered, this Policy passes to it and we will notify you), at support@matchytouch.com.
This document has two parts: Part 1 applies to every user everywhere. Part 2 adds country-specific data protection terms where MatchyTouch actively operates.
Part 1 — Global Base Policy
1. Overview
This Policy explains what personal data we collect, why, how long we keep it, and what choices you have. It applies to Hosts, Sellers, and Buyers alike.
Browsing, scanning and Discover need no account. If you buy through Hosted Checkout, Stripe collects your payment and shipping details; we keep a copy of the shipping address with the order record, and the Seller sees your order details, including email. If you buy on a Seller's own website, that Seller's privacy policy applies. The official plugin sends us only an order number, an amount, a currency and our reference. It sends no personal data about you. If the Seller's Shopify store is connected to MatchyTouch, Shopify sends us the Seller's standard paid-order notification, which also contains your name and contact and shipping details. We read only the order number, the product line that came through MatchyTouch, its amount and currency, and our reference; the rest is discarded when the notification is processed and is never stored or logged.
We do not collect card details: all payment processing is handled directly by Stripe. Hosts provide their venue's address and coordinates, shown publicly so Buyers can find them. We do not collect a Buyer's precise device location unless you separately grant permission to a feature that explicitly requests it.
2. What We Keep, Why, and For How Long
| Data | Why | Kept for |
|---|---|---|
| Host and Seller account: name, business name, email, country | Run the account | While active, then as financial and legal records require |
| Verification documents: business registration, payout instrument, venue photo (private storage) | Approve accounts | While the account is active and for 5 years after it closes, then deleted |
| Payout details: bank or wallet text (Invoice path), shown to the party who must pay you | Settle between Host and Seller | While the account is active; deleted or anonymised within 90 days after it closes, unless needed for an open dispute |
| Sale reports and evidence files (private storage) | Verify sales | 5 years after the sale, as financial records |
| Hosted Checkout order: shipping address copy | Fulfilment record | With the financial record; cannot be erased while the record is required |
| Anonymous session ID (cookie) | Link a scan or click to a purchase | Deleted after expiry unless it belongs to an attribution or order; then kept with that record |
| Discount-code email | Issue and send the code | Removed by a daily job once the code has expired (10 days after creation) or been redeemed, and no sooner than 24 hours after creation |
| Waitlist: email, role, country, optional note up to 300 characters | Tell you when your country opens | Until your country opens plus 12 months, or until you ask us to delete it |
| IP address counters | Rate limiting and abuse prevention | Deleted after 1 day |
| Hosting provider logs: IP address, timestamps | Security | Per provider policy |
A discount-code email is optional. If a Seller enables the feature, you may provide an email in exchange for a code; it is stored with your session and the product, used to issue and send that code, and is not sold or shared with any third party. If you later complete a purchase through Hosted Checkout, the Seller may see your email as part of standard order details, the same way any online seller sees a customer's email after a sale.
3. How We Use Data
We use this data to operate the Platform (attribution, payouts, listings), prevent fraud and enforce our Terms of Service, communicate with Hosts and Sellers about their account and sales, and improve reliability. We do not use Buyer data for advertising or marketing beyond the specific transaction it was collected for, unless you separately opt in.
4. Cookies and Similar Technologies
Anonymous attribution session: two cookies (mt_session and mt_sig), set when you visit the Platform, valid for 30 days. They carry a random identifier and its signature, so we can link a scan or click to a possible purchase. They hold no name or email. Sign-in session: Hosts and Sellers receive session cookies from our authentication provider to stay signed in. Banner choice: one item in your browser's local storage (mt_cookie_consent) remembers that you dismissed the cookie notice.
We do not use advertising trackers or analytics cookies. Fonts are served from our own domain.
Visit statistics: we use Vercel Web Analytics to count page views. It sets no cookies and records only aggregated data: the page, the referring site, country, device type and browser. Visitors are not identified individually. We remove every URL parameter before sending, except campaign tags (utm_*) that show which link brought you here.
5. Third-Party Processors and Requests
We share data with service providers solely to operate the Platform: Stripe (payments), Supabase (database and backend, hosted in the AWS us-east-1 region), Vercel (application hosting and visit statistics), Resend (transactional email), providers of domain name and mailbox services, and an AI assistant from Anthropic that the operator uses for administration and that may see account data while doing so. Each processes data under its own privacy policy. We do not sell personal data.
The map page loads map tiles from OpenStreetMap servers, which receive your IP address and the part of the map you view.
6. Legal Bases, Transfers and Responsibility
Legal bases: contract (accounts, attribution, payouts, samples); legitimate interests (security, fraud and abuse prevention, rate limiting); consent (discount-code email, waitlist); legal obligation (financial records). Transfers: our database is in the United States (AWS us-east-1), and personal data may be accessed from other countries where we and our providers operate, under our providers' contractual safeguards.
7. Data Security
We use reasonable technical and organizational measures to protect personal data, including database access controls and encrypted connections. No system is completely secure.
8. Your Rights
You have the rights of access, correction, deletion, restriction, objection and portability, to the extent the law that applies to you grants them. Write to support@matchytouch.com and we reply within 30 days. You may complain to the data protection authority of your country. For users in Brazil and the United Arab Emirates, the rights under the Brazilian LGPD and the UAE data protection law apply to the extent those laws apply. Erasure requests are handled through support. Records we must keep for financial or legal purposes are anonymised rather than deleted.
9. Children's Privacy
The Platform is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact us and we will delete it.
10. Changes to This Policy
We may update this Policy from time to time. For material changes we will give at least 30 days' notice, by email or in your dashboard, before the change takes effect.
11. Contact
Questions about this Policy, or requests to exercise your data rights, can be directed to support@matchytouch.com.
Part 2 — Country-Specific Addenda
Country addenda are published for each country when it opens for sign-up. Until an addendum for your country is published, Part 1 applies.
Version 2026-10-13. See also our Terms of Service.