Privacy policy

1. Who we are

Matchwork ("Matchwork", "we", "us"), operated by Matchwork Ltd, is a members-only directory that connects vetted members with vetted professional advisers ("experts"). For the purposes of UK and EU data-protection law, Matchwork Ltd is the data controller for the personal data described in this policy.

Matchwork Ltd is a company registered in England and Wales (company number 17305981). Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

Our registered contact for privacy matters is contact@thematchwork.com. If we appoint a Data Protection Officer, their details will be published here.

2. Data we collect

Depending on how you use the platform, we may collect:

• Account data — name, email address, password (stored only as a secure hash), and your role (member, expert, or admin).
• Application data — the information you submit when applying, such as organisation, professional role, sectors, links, and the reason for applying.
• Expert profile data — biography, areas of expertise, education and career history, recognition, and a profile photo, which experts choose to publish.
• Usage data — searches you run, profiles you view, and contact requests you send, used to operate and improve the service.
• Billing data — subscription status and payment metadata. Card details are handled entirely by our payment processor (Stripe); we never see or store full card numbers.
• Technical data — limited log data such as timestamps and error information needed to keep the service secure and reliable. Diagnostic error reports are sent to our error-monitoring provider (Sentry) with personal data removed.

3. How we use your data

We use your personal data to:

• Create and administer your account and verify eligibility through our vetting process.
• Operate core features — search, expert profiles, and member-to-expert contact requests.
• Process subscriptions and payments through our payment processor.
• Send service communications (for example application outcomes, contact notifications, and billing notices).
• Maintain the security, integrity, and performance of the platform.
• Comply with our legal and regulatory obligations.

4. Legal bases for processing

We rely on the following legal bases: performance of our contract with you (to provide the service you signed up for); our legitimate interests (to run, secure, and improve the platform); consent (for any non-essential cookies or optional communications, which you can withdraw at any time); and compliance with legal obligations.

5. Sharing your data

We do not sell your personal data. We share it only with:

• Service providers who process personal data on our behalf under contract, only on our instructions. These currently include: Supabase (database and hosting, EU region) and Vercel (application hosting and content delivery); Stripe (payment processing); Resend (email delivery); Upstash (caching); Cohere and Anthropic (the AI services that power search and result summaries); and Sentry (error monitoring).
• Other users only as the product intends — for example, an expert’s published profile is visible to members, and when a member contacts an expert the expert receives the message and the member’s reply-to email address. A member’s identity is not otherwise exposed.
• Authorities or third parties where required by law, or to protect our rights, users, or the public.

6. International transfers & data residency

We host personal data in the United Kingdom (Supabase, London region). Where a provider processes data outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses.

7. Data retention

We keep personal data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution requirements, after which it is deleted or anonymised.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, or port your data; to object to or restrict certain processing; and to withdraw consent. If you have an account, you can export your data and request account deletion directly from your account page. You can also exercise any of these rights by emailing contact@thematchwork.com. When you ask us to delete your account, we erase your personal data — including your profile, searches, and messages — and de-identify the limited records we are legally required to keep. You also have the right to complain to the UK Information Commissioner’s Office (ICO) or your local supervisory authority.

9. Cookies

We use a small number of essential cookies needed to sign you in and keep the service secure. Any non-essential cookies are used only with your consent. See our Cookie policy for details.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the platform or by email, and the "last updated" date above will change.