Legal
How Matinee AI handles personal data, for both our customers and the customers they serve.
Scope
What is collected from account holders and from their end customers.
Why each category is processed and on what legal basis.
Where tenant data is stored and how regional pinning works.
How long each category is kept and what deletion means.
Which third parties process data and for what.
How access, correction and deletion requests are handled.
Meanwhile
A privacy policy is only as good as the system underneath it. Most policies are written first and hoped into the architecture afterwards; this platform is being built in the opposite order — the data-handling behaviour is specified, checked and in several cases enforced by the database itself, so the eventual policy can describe what the system actually does rather than what it intends.
What follows are engineering facts about the design, stated so you can evaluate them now. They are not legal language and do not substitute for the reviewed policy.
By design
All 103 tables declare a classification for every column they hold — public, internal, confidential, sensitive-personal, security, ledger or secret — over eight hundred classified columns in total. "What data do you hold and how sensitive is it" is answerable from the schema, not from somebody’s memory.
Row-level security policies stand on 43 tables, the organization header on every API request is validated against the caller’s actual memberships, and eleven tenant-isolation tests run against a live database on every verification pass.
Each table declares its retention — a number of days, a minimum, or indefinite with the reason stated. A scheduled worker applies the sweep, and tables the design marks immutable are never touched by it.
Customer data leaves the system through export jobs, never through a synchronous request: each export generates an audit event and produces a file that expires rather than living forever.
API keys are stored only as hashes and shown exactly once, at creation. Webhook signing secrets are held as secrets-manager references. There is no endpoint anywhere on the surface that can return either.
Context for any AI feature is permission-checked before a model sees business data, retrieval is filtered by permission before search rather than after, and cross-tenant retrieval is one of the isolation scenarios tested against the live schema.
Send it to us directly and you will get a specific answer rather than a link to a policy that does not exist yet.