Privacy Policy

1. Overview

This Privacy Policy explains how Mateza ("we," "our," "us") collects, uses, discloses, and protects personal information when you visit our websites, use our platforms, or communicate with us (collectively, the "Services").

Digital Services Scope: Where the Services are used strictly for digital goods or SaaS via a Merchant of Record, the personal data collection and processing described herein applies only to those digital-services transactions; personal data will not be processed for the purpose of shipping physical goods or manual delivery of services. In connection with services processed via the Merchant of Record, personal data will not be used or shared for purposes that violate the Acceptable Use Policy defined by the Merchant of Record.

2. Information We Collect

• Provided by you: name, email, company, billing details, support communications.
• Automatically collected: device and browser data, IP address, usage logs, crash/error diagnostics, cookies and similar technologies.
• From partners: payment confirmations, identity verification signals (where required), and analytics service data.

3. How We Use Personal Information

We use personal information to:

• Provide, secure, and improve the Services (provisioning, access control, analytics, troubleshooting).
• Process payments and manage subscriptions/licensing.
• Communicate about accounts, support, product updates, and security notices.
• Comply with legal obligations and enforce our Terms.

4. Legal Bases (where applicable)

For jurisdictions that require a legal basis (e.g., GDPR), we rely on: performance of a contract, legitimate interests (service improvement, security), consent (where required for marketing/cookies), and compliance with legal obligations.

5. Cookies and Tracking

We use cookies, SDKs, and similar technologies for authentication, preferences, analytics, and performance. You can control cookies via browser settings; disabling cookies may affect functionality. For jurisdictions requiring consent, we provide a cookie banner with options to accept, reject, or customize categories (essential, analytics, marketing).

See our Cookie Policy for a detailed list of cookies used, their purposes, durations, and providers.

6. Sharing and Disclosure

We share personal information with:

• Service providers (hosting, analytics, payment processing, support) under contracts and confidentiality.
• Merchant of Record/payment partners for billing, tax, fraud prevention, and payouts.
• Affiliates and subprocessors supporting the Services.
• Authorities where required by law or to protect rights, safety, and security.
• In a business transaction (merger, acquisition) subject to appropriate safeguards.

We do not sell personal information.

7. Data Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, logging, and vulnerability management. No system is perfectly secure; notify us of suspected incidents.

8. Data Retention

We retain personal information for as long as necessary to provide the Services, meet legal obligations, resolve disputes, and enforce agreements. Specific retention periods include:

• User account and contact data: Retained while account is active and for up to 3 years after deactivation.
• Payment and transaction data: Up to 7 years for tax and legal compliance purposes.
• Analytics and usage logs: Up to 3 years for service improvement and security.
• Support communications: Up to 5 years for dispute resolution and compliance.

We will delete or anonymize data when it is no longer needed, subject to lawful retention requirements.

9. International Transfers

We may transfer personal information across borders to jurisdictions such as the United States, European Union, and Rwanda. Where required, we use safeguards such as Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms to ensure appropriate protection.

10. Your Rights

Subject to applicable law, you may request to access, correct, delete, or restrict processing of your personal information; object to certain processing; and request data portability. You may withdraw consent where processing is based on consent. To exercise these rights, contact us using the details in Section 16. We will respond within 30 days, subject to verification of identity and any legal exemptions.

Where legally permitted, we may charge a reasonable fee for excessive or complex requests. See our Rights Request Portal for more details.

11. Children's Privacy

The Services are not directed to or intended for minors. Do not submit personal information of minors. If we become aware we have collected a minor's personal information, we will delete it without undue delay.

12. Marketing Preferences

You may opt out of non-essential marketing communications by using the unsubscribe link or contacting us. We will continue to send transactional or service-related notices.

13. Merchant of Record and Payment Processing

Where a payment partner or MoR (such as Polar) is used, they may process personal information for identity verification, fraud prevention, tax handling, and chargebacks according to their policies. We do not receive or store full payment card numbers, but may store masked card details, transaction IDs, and related billing data for up to 7 years.

Data Controller/Processor Roles: Mateza acts as data controller for data submitted by you in connection with the Services. The Merchant of Record acts as controller for transactions. Where we act as processor, we process personal data only according to the instructions of the controller and under our internal security safeguards.

The Merchant of Record also has its own privacy and processing practices for transactions; we recommend you review their privacy policy in addition to this one. For more on the relationship, see our Terms of Use.

14. Subprocessors

We maintain a list of key subprocessors (hosting, analytics, email, support tools). We require appropriate data protection commitments from subprocessors. You can view the current list of subprocessors here.

We will provide advance notice of new subprocessors where possible, and you may object to new subprocessors by contacting us.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will post updates and update the "Last updated" date, and notify you where required by law.