Privacy Policy

1. What we collect

Account information — name, email address, and firm name for anyone who creates or is invited to a MatterPay account. If you sign in with Google or Microsoft, we receive the name and email those services send us so we can create or match your account.

Payment metadata — when a payment is made through the Service, we store the amount, card brand, the card's last four digits, and a receipt number. We never receive or store full card numbers, expiration dates, or security codes — those are entered in Finix's hosted payment fields and go straight to Finix.

Matter and billing records — clients, matters, invoices, time entries, and trust-ledger lines your firm enters so the Service can run.

Usage information — basic technical information (such as IP address and browser type) generated by using the application, for security and troubleshooting only.

Firm financing-boarding information — if your firm applies to offer client financing, we collect information about the firm and about each principal owner, including name, title, date of birth, home address, home phone number, and ownership start date. We collect it only to prepare your firm's application to ePay Management LLC, our financing partner, who makes all lending decisions.

Principal owner information is encrypted while we hold it. We delete it as soon as your application is submitted to ePay, and in any case within 90 days, whichever comes first. We never place it in a web address, and we never share it with anyone other than ePay.

2. How we use it

We use the information above to operate and secure the Service, generate and deliver receipts and invites, respond to support requests, and meet legal and recordkeeping obligations. We do not use payment metadata, matter records, or account information for advertising. We do not use your data to train public artificial-intelligence models.

3. We never sell your data

We do not sell, rent, or trade personal information — not firm data, not client data, not payment metadata, not financing applications. We do not sell it to data brokers, advertising networks, lead buyers, or public datasets, and we do not make it available for anyone else to scrape and resell. "Sell" here includes exchanging personal information for money or anything else of value.

4. Cookies and analytics

MatterPay sets only the cookies needed to run the Service:

• A signed, HTTP-only session cookie (`fp_session`) so you stay signed in.
• A short-lived signed cookie (`mp_oauth_pending`) if you start an account with Google or Microsoft and still need to finish firm setup. It expires in 15 minutes.

Theme preference (`mp-theme`) is stored in your browser's local storage, not as a cookie, so the first paint matches the theme you picked.

We use product-analytics tools — currently PostHog and/or Google Analytics — on the marketing site and the application so we can see which pages and features are used, find bugs, and improve the product. Those tools set cookies or pixels. We do not use them to sell your data, to build advertising profiles of your clients, or to run ads to your clients on other sites. Client- facing payment pages do not load advertising pixels.

We do not set advertising cookies (Meta Pixel and similar) and we do not use targeting cookies to advertise MatterPay across the web using your firm's or your clients' information.

Two other parties may set cookies in their own context, not as MatterPay tracking:

• Cloudflare, which fronts the site, may set operational security cookies on its own domain.
• Finix's hosted payment fields run in Finix's iframe. Any cookies those fields set belong to Finix and are governed by Finix's policies, not ours.

5. Service providers

We share information with a small set of service providers who help us run the Service, under obligations to protect it. They receive only what they need to do that job:

• Finix Payments, Inc., which processes card and ACH payments and holds cardholder data in its vault.
• ePay Management LLC, which receives the firm-boarding information described above when your firm applies to offer client financing. Clients who apply for financing do so on ePay's own site.
• Cloudflare, for DNS, content delivery, and the tunnel that serves the site.
• Our transactional-email provider, which delivers receipts, invites, and similar operational messages on our behalf.
• Google or Microsoft, only if you choose to sign in through them.
• PostHog and/or Google Analytics, for product analytics as described in Section 4.

Sharing with these providers to operate the Service is not a sale.

6. Retention

We retain account, matter, and payment metadata for as long as your firm's account is active and afterward as needed to meet legal, accounting, and dispute-resolution obligations. Principal owner information collected for ePay boarding is deleted as described in Section 1.

7. Security

Data in transit is encrypted with TLS. Payment-processor credentials and principal-owner boarding information are encrypted at rest. Access to firm data within the application is restricted by account role.

8. Your rights

You can request access to, correction of, or deletion of your personal information by contacting support@usematterpay.com. Some information may need to be retained where required by law or to preserve accurate financial and trust-accounting records.

9. Children

The Service is directed at law firms and their business users. It is not directed to, and we do not knowingly collect information from, anyone under 18.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the effective date above.

11. Contact

Questions about this policy, or requests regarding your information, can be sent to support@usematterpay.com.