Privacy notice

Last updated: 22 October 2026

This notice explains how MatCurate handles personal data, from your first visit and design to your personal project area.

1. Controller and contact

You can send privacy questions and requests concerning your data to this email address or use our contact form.

2. Visiting and securing the website

Requests to the website involve technical connection data, including the IP address, time, requested address, browser information and response status. We use this to deliver the site, investigate errors and prevent abuse. The application also uses counters and hashed identifiers to limit repeated login attempts or submissions. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, functioning service.

The website is provided through OpenAI’s Sites platform and uses Cloudflare for delivery, security, database and file storage. These technical service providers may process connection data and stored content. Images and fonts are served without embedded advertising networks. The on-site help dialog uses prepared answers; it does not send your input to an AI chat service.

4. Contact, access requests and designs

We process the contact details, business information, project description and, where included, your design, logos and preview images to answer the enquiry, email the requested draft and personally review B2B access. The general contact form requires only a reply email and a message; a name is optional. This does not sign you up for a newsletter.

For enquiries about your own contract, Article 6(1)(b) GDPR applies. Where you act as a business contact, we rely on Article 6(1)(f) GDPR: our interest in communicating with business partners and handling the project. Privacy requests are processed to meet our legal obligations under Article 6(1)(c) GDPR. We cannot process a request without the details marked as required.

When you request an appointment, we save your name, email address, phone number, conversation language and preferred time. The responsible team member receives these details by email for personal review, and you receive an acknowledgement. A request does not constitute a confirmed appointment. The browser remembers within the current tab whether the appointment prompt has appeared, so it does not interrupt you repeatedly.

5. Accounts, offers and orders

After approval, we store contact details, usernames, hashed password verifiers, account status and time-limited sign-in tokens. Your saved mats, logos, delivery addresses, enquiries, offers, orders and assigned messages are accessible to you and authorised team members. Designs submitted before sign-up are matched using your email address. Correspondence provided by you or your business may be added to the project record.

This supports the business relationship under Article 6(1)(b) GDPR or, for business contacts, Article 6(1)(f) GDPR. Tax and commercial records are processed under Article 6(1)(c) GDPR. Where required for an order, production and shipping providers receive the relevant product or delivery details. Access is reviewed personally; we do not make solely automated decisions with legal or similarly significant effects.

6. Email delivery and service providers

We use Resend (Plus Five Five, Inc., USA) for requested drafts, acknowledgements, access links and project notifications. This involves the recipient address, email content, any attachments, and delivery or error data. Open and click tracking are disabled for our sending domain. The legal bases are those of the underlying enquiry or business relationship.

OpenAI, Cloudflare and Resend may process data outside the EU or EEA, particularly in the United States. Their published safeguards include EU Standard Contractual Clauses and, where applicable, adequacy decisions. Information about these safeguards is available from OpenAI, Cloudflare and Resend. You can request information and a copy of the safeguards applicable to your data through our privacy contact.

7. How long data is retained

Browser cookie lifetimes are listed above. Sign-in sessions and invitation links expire after no more than 7 days. Technical errors and abuse information are processed to investigate the specific incident. Retention depends on when that incident is resolved; evidence needed for claims may be retained until those claims are settled.

Enquiries, messages and designs are needed for ongoing handling and any resulting project. Continued retention depends on an outstanding offer, active business relationship, order fulfilment and unresolved warranty or other claims. Once the purpose ends and there is no retention duty, the data must be deleted. Designs in an existing account remain available for your project work; you can request deletion at any time.

Business correspondence, accounting records and tax-relevant documents are subject to their applicable statutory retention duties. During those periods, use is restricted to the retention purpose. Removing a design from your view or moving an account to the trash does not itself permanently delete all related records.

8. Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). Where processing relies on consent, you may withdraw it at any time for the future, without affecting earlier processing.

You may also complain to a data protection authority, especially where you live or work or where a suspected infringement occurred. The authority at our Berlin location is the Berlin Commissioner for Data Protection and Freedom of Information.

Back to MatCurate