Matchy is committed to protecting your personal data in line with India's Digital Personal Data Protection Act 2023 (DPDP Act). This policy describes what data we collect, why, and how to exercise your rights.
1. Data we collect
- Account data: name, email, phone (optional), role.
- Profile data: for developers — bio, skills, rates, portfolio URLs, GitHub; for founders — company name, project descriptions.
- Transaction data: projects, milestones, escrow amounts, payment status.
- Communication data: messages exchanged within the platform.
- Technical data: IP address, user-agent, basic event logs for security and product analytics.
- Curated profiles: developer name, role title, and portfolio URL sourced from public listings. No private contact data is indexed.
2. Why we use it
- Match founders with developers (skills + tier + project value).
- Process escrow payments and commission.
- Moderate communication (scan for off-platform contact attempts that violate the Non-circumvention policy).
- Detect fraud and abuse.
- Send transactional notifications (you cannot opt out of essential service emails while you have an active account).
3. Sharing
We do not sell personal data. We share data with:
- Payment processors (Razorpay) — strictly to process escrow transactions.
- Cloud infrastructure (hosting, backups) under standard contractual terms.
- Indian law enforcement when legally compelled.
4. Your rights (DPDP Act)
- Access: request a copy of your data.
- Correction: ask us to fix inaccuracies.
- Erasure: request deletion (subject to legal retention for completed transactions).
- Withdrawal of consent at any time.
- Grievance: our Grievance Officer (see Contact) responds within 30 days.
To exercise any of these, email privacy@matchy.io.
5. Curated profile removal
If your portfolio appears as a curated (unclaimed) profile and you wish it removed, email privacy@matchy.io with the URL. We remove within 72 hours, no questions asked.
6. Retention
Active account: data retained while account exists. Closed account: most data deleted within 90 days; transactional records retained for 7 years per Indian tax law.
7. Security
Passwords are hashed with Argon2id. Sessions use HTTP-only cookies with short TTLs. Sensitive operations require re-authentication. We do not store payment card details — all payment information is handled by Razorpay.
8. Cookies
We use first-party session cookies for authentication. We do not use third-party advertising trackers. Analytics, if added later, will be disclosed and opt-out enabled.
9. Children
Matchy is not for users under 18. We do not knowingly collect data from minors.
10. Changes
We will notify you of material changes by email at least 14 days in advance.
Contact
Privacy / Grievance Officer: privacy@matchy.io
General: hello@matchy.io