01
Overview
This GDPR Policy explains how Matter ("Matter", "we", "us", or "our") meets its obligations under the General Data Protection Regulation (Regulation (EU) 2016/679) for users located in the European Union, the European Economic Area, and the United Kingdom.
This policy supplements our Privacy Policy and should be read alongside it. Where this policy is more specific about a GDPR right or process, this policy governs.
The short version: you have real, enforceable control over your data, including a right to erasure that we process automatically. Your data is stored and handled in the United States, and we explain below how that transfer is safeguarded.
02
Legal Basis for Processing
Under Article 6 of the GDPR, we rely on the following legal bases depending on the activity in question:
Contractual Necessity
Processing your MatterID, sign-in credentials, and activation records is necessary to provide the services you've requested; we cannot authenticate you or maintain your account without this data.
Legitimate Interest
Audit logs, session security records, and abuse-prevention data are processed under our legitimate interest in keeping Matter services secure and reliable, balanced against your right to privacy.
Consent
Optional features: such as AI-assisted tools (e.g. Aurora); are processed only where you've given explicit consent via your myMatter settings. You may withdraw this consent at any time without affecting the lawfulness of processing prior to withdrawal.
Legal Obligation
In limited cases, we may process or retain data to comply with a legal obligation, such as responding to a valid governmental request.
03
Your Rights Under GDPR
If you are located in the EU, EEA, or UK, you have the following rights with respect to your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data ("right to be forgotten"), detailed below
- Right to restrict processing — request that we limit how we use your data in certain circumstances
- Right to data portability — request your data in a structured, commonly used, machine-readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — withdraw consent for any optional processing at any time
- Right to lodge a complaint — file a complaint with your local supervisory authority
You may exercise any of these rights by contacting support@himatter.xyz, or, for erasure specifically, through the automated process described in the next section.
04
Right to Erasure (Right to Be Forgotten)
Unlike a standard account deletion, a Right to Be Forgotten (RTBF) request is a formal GDPR erasure request. It instructs us to permanently and irreversibly remove your personal data, bypassing the normal account recovery window described in the next section.
Automated Processing
RTBF requests are handled automatically by our systems. Once submitted, your request is verified against your MatterID and processed without manual staff review or intervention, ensuring a consistent and prompt outcome. You will receive confirmation once the erasure has been completed.
What Happens to Your Data
An RTBF request permanently erases your personal data from our active systems. There is no 30-day grace period for an RTBF request — erasure is final, and your account cannot be restored once it has been processed.
If you simply want to delete your account but might want to come back, use standard account deletion instead; it gives you a 30-day window to change your mind. RTBF is for when you want your data gone for good.
We may retain a minimal record (such as the fact that an erasure request was made and fulfilled) where necessary to demonstrate compliance with our legal obligations, but this record contains no personal data beyond what is strictly required for that purpose.
05
Standard Account Deletion & Grace Period
When you delete your Matter account through standard means (rather than submitting a dedicated RTBF request), we give you a window to change your mind before your data is permanently removed.
You will recieve an email once we have processed your account deletion request. You will recieve another email the day of roughly an hour before account deletion.
This grace period exists to protect you from accidental or impulsive deletions. If, instead, you want your data erased immediately and permanently with no possibility of restoration, submit a Right to Be Forgotten request instead. RTBF requests skip the grace period entirely and are processed automatically.
06
Data Retention
Outside of deletion requests, your account data is retained for as long as your account remains active. We do not place arbitrary expiry dates on account data; it persists until you choose to delete your account or submit an RTBF request.
- Active account data is retained indefinitely while your account exists
- Deleted accounts are retained, deactivated, for the 30-day grace period described above
- Data subject to a completed RTBF request is erased immediately and is not retained
- Limited records may be kept beyond these windows only where required by law or for legitimate security purposes (e.g. fraud prevention)
07
International Data Transfers
Matter is based in, and stores and handles all user data within, the United States. If you are accessing Matter services from the EU, EEA, or UK, this means your personal data is transferred outside of those regions when you use our services.
We rely on the legal mechanisms made available for such transfers, including ensuring that any cross-border processing is conducted under safeguards consistent with GDPR requirements (such as Standard Contractual Clauses, where applicable to our service providers). We do not transfer your data to any country, or any party within the United States, beyond what is necessary to operate Matter services.
You may request further information about the safeguards applicable to your data by contacting support@himatter.xyz.
08
Supervisory Authority & Complaints
We encourage you to contact us first at support@himatter.xyz so we can try to resolve any concern directly. That said, you always retain the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or the place where an alleged infringement occurred, regardless of whether you've contacted us first.
A list of EU supervisory authorities is maintained by the European Data Protection Board. UK residents may contact the Information Commissioner's Office (ICO).
09
Policy Changes
We may update this GDPR Policy as our services evolve or as legal requirements shift. The effective date at the top of this page will always reflect the most current version.
For significant changes; particularly those that affect your rights or how erasure requests are processed; we will post an announcement via our Discord server or through a MatterID Mass Notification, giving you time to review before changes take effect.
Your continued use of Matter services after a policy update constitutes your acceptance of the revised terms.
10
Contact
If you have questions about this GDPR Policy, want to exercise any of your rights, or want to submit a Right to Be Forgotten request, please reach out.
- Privacy & data enquiries: support@himatter.xyz
- General support: support@himatter.xyz
We aim to respond to all GDPR-related requests within a reasonable timeframe and in any event within the timeframes required by law. RTBF requests, as noted above, are processed automatically rather than manually reviewed.