Privacy Policy

Account data. Your email address and a password (stored as a hash by our authentication provider). Optionally a display name.

Data you enter. The client and prospect records you create — names, contact notes, states, offer progress, and profit/fee figures. This data exists so the product can work for you; it is scoped to your account and never shown to other users.

Billing data. Payments are processed by Stripe. We receive your subscription status, plan, and a customer reference — never your card number.

Messages. Anything you send through the contact form (delivered to us by email).

Technical logs. Standard server logs (IP address, user agent, timestamps) used for security, rate limiting, and debugging.

We do not sell your data. We do not share your client lists with anyone. We do not run third-party advertising trackers. Cookies are used only to keep you signed in.

To provide the service (accounts, worklists, billing), to respond when you contact us, to send transactional email (signup confirmation, password reset, billing notices), to prevent abuse, and to improve the product. We do not use your data for unrelated purposes.

Your data is stored and processed by these providers on our behalf:

• Supabase — database and authentication
• Stripe — payment processing
• Vercel — application hosting and logs
• Resend — contact-form email delivery

Each processes data only as needed to provide their service. Data may be processed in the United States.

We keep your data while your account exists. If you want your account and its data deleted, ask via the contact page and we will delete it, except records we must keep for billing, tax, or legal reasons.

You can request a copy of the data we hold about you, correct it, or have it deleted. Depending on where you live (e.g. California, the EU/UK), you may have additional statutory rights; we honor verified requests regardless of location. Contact us to exercise any of these.

All traffic is encrypted in transit (HTTPS/HSTS). Database access is locked to the application layer, passwords are hashed, and payment credentials never touch our servers. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you.

MatchDesk is for adults 21 and over. We do not knowingly collect data from anyone under 21; if we learn we have, we will delete it.

We may update this policy as the product evolves. Material changes will be posted here with a new effective date.

Privacy questions or requests: use the contact page.