Privacy Policy

1. Accountability and Scope

Matterly is responsible for personal information under its control and has designated a privacy contact to oversee compliance with this Privacy Policy. This policy applies to personal information collected through our website, the Matterly application, customer support, and connected services or integrations.

For information that a law firm, paralegal practice, legal professional, or other organization uploads or processes through Matterly on behalf of its own clients ("Client Data"), that customer remains responsible for determining the purposes for which the information is collected and used. Matterly acts as a service provider and processes Client Data to provide the Service and as otherwise instructed by the customer, subject to applicable law.

2. Information We Collect

Depending on how you use Matterly, we may collect the following categories of information:

• Account and contact information, such as name, email address, telephone number, organization or firm name, role, login information, and account preferences.
• Billing and transaction information. Payment card information may be processed by our payment processor; Matterly may receive payment status, transaction, invoice, and related billing records.
• Client Data, including information, documents, notes, court dates, billing records, trust-accounting information, communications, and other content that users choose to upload, create, or store in Matterly.
• Communications with Matterly, including support requests, feedback, onboarding information, and other correspondence.
• Technical and usage information, such as IP address, browser and device information, access times, system activity, diagnostic information, and security or audit logs.
• Integration data from third-party services that you choose to connect to Matterly, including Google Workspace data as described in Section 3 below.

3. Google Workspace Integrations (Google Calendar and Gmail)

Matterly allows users to connect a Google account to enable optional Google Calendar and Gmail functionality. Connecting a Google account is voluntary. Google displays the permissions (OAuth scopes) requested by Matterly before authorization, and Matterly requests access only to permissions reasonably necessary for the features being provided.

3.1 Google User Data Matterly May Access

The Google user data available to Matterly depends on the features you enable and the permissions you grant on Google's authorization screen. It may include:

• Google account information used to identify the connected account, such as your Google email address and account identifiers.
• Google Calendar data, such as calendars, calendar identifiers, event titles, descriptions, dates and times, attendees, locations, recurrence information, and other event details required to synchronize or manage calendar events between Matterly and Google Calendar.
• Gmail data needed for Matterly's user-facing email features. Depending on the permissions you authorize, this may include the ability to send email through your Gmail account and, where a Matterly feature requires it, access to message metadata, message content, attachments, labels, or related mailbox information necessary to display, synchronize, associate, or manage email within Matterly.

Matterly does not access Google user data that is unrelated to the Google-connected features a user has enabled, and we do not request broader Google permissions solely for possible future use.

3.2 How Matterly Uses Google User Data

Matterly uses Google user data only to provide or improve user-facing features that the user has chosen to use. These purposes may include:

• Synchronizing Matterly calendar items with a connected Google Calendar and creating, updating, or deleting synchronized events when initiated by the user or required to maintain the synchronization the user enabled.
• Allowing users to compose and send email from Matterly through a connected Gmail account.
• Where enabled, displaying, synchronizing, or associating Gmail messages or related information with Matterly records, matters, clients, or workflows for the user's benefit.
• Maintaining the integration, authenticating API requests, preventing abuse, diagnosing connection errors, and providing customer support.

Matterly does not use Google user data for advertising, retargeting, personalized advertising, sale to data brokers or information resellers, determining creditworthiness, or unrelated marketing purposes.

3.3 Storage and Retention of Google User Data

Matterly may store OAuth authorization credentials, such as access tokens, refresh tokens, account identifiers, and other connection information, for as long as reasonably necessary to maintain the Google integration. Matterly may also store limited Google-derived data when necessary to provide a feature the user has enabled or when a user chooses to save or associate that information with a Matterly record.

For example, an email or calendar item that a user chooses to associate with a legal matter may become part of that customer's Client Data and may be retained according to the customer's account settings, professional record-keeping obligations, contractual requirements, and applicable law. Disconnecting a Google account stops future API access but does not necessarily delete copies of information that were previously and legitimately saved in Matterly as part of the user's records.

We retain Google user data only for as long as reasonably necessary for the purposes disclosed in this policy or as required by law, and we seek to minimize the amount of Google data stored outside Google.

3.4 Sharing and Transfer of Google User Data

Matterly does not sell Google user data. Matterly does not transfer Google user data to third parties except where permitted by Google's applicable policies and necessary for one of the following purposes:

• To provide or improve the Google-connected, user-facing features requested by the user, including through service providers acting on Matterly's behalf and subject to appropriate confidentiality and data-protection obligations.
• For security purposes, including investigating abuse, fraud, vulnerabilities, or technical incidents.
• To comply with applicable law, regulation, legal process, or enforceable governmental request.
• As part of a merger, acquisition, financing, reorganization, or sale of assets, where permitted by applicable Google policies and after obtaining any consent required by those policies or applicable law.

3.5 Human Access to Google User Data

Matterly does not permit employees, contractors, or other people to read Google user data except where: (a) the user has given affirmative permission for Matterly to view specific information for support or troubleshooting; (b) access is reasonably necessary for security or abuse investigation; (c) access is necessary to comply with applicable law; or (d) the information has been aggregated and anonymized and is used for internal operations in accordance with applicable law and Google policy.

3.6 Artificial Intelligence and Model Training

Matterly does not transfer, sell, or use Google Workspace user data to create, train, or improve generalized or non-personalized machine-learning or artificial-intelligence models. If Matterly introduces a user-facing feature that uses Google data in a new way, Matterly will update its disclosures and obtain any consent required before using Google user data for that new purpose.

3.7 Google Limited Use Compliance

Matterly's use and transfer of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy and Google Workspace User Data and Developer Policy, including the Limited Use requirements.

Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

3.8 Disconnecting Google and Revoking Access

You may disconnect a Google account from Matterly through available integration settings or revoke Matterly's access through your Google Account permissions. Once access is revoked, Matterly will no longer be able to obtain new Google user data through the revoked authorization. You may also contact Matterly at support@matterly.ca to request assistance with disconnection or deletion, subject to applicable legal, contractual, security, and professional record-retention requirements.

Google Account permissions: https://myaccount.google.com/permissions

4. Client Data and Professional Responsibility

Customers are responsible for ensuring that they have lawful authority to collect, use, disclose, and process Client Data through Matterly, including obtaining any consents required by law or professional obligations. Matterly processes Client Data to provide the Service, support customer-directed workflows, maintain security, comply with law, and perform other purposes disclosed in this Privacy Policy or agreed with the customer.

Matterly does not use Client Data for third-party advertising or sell Client Data to data brokers or information resellers.

5. How We Use Information

Matterly may use personal information and other data for the following purposes:

• To provide, operate, maintain, support, and improve the Service and its user-facing features.
• To create and administer accounts, authenticate users, manage subscriptions, process payments, and provide customer support.
• To enable integrations and workflows that a user or customer chooses to activate.
• To communicate about the Service, including operational notices, security messages, support responses, billing communications, and product updates where permitted by law.
• To monitor performance, troubleshoot errors, maintain audit logs, prevent fraud or misuse, and protect the security and integrity of Matterly and its users.
• To comply with legal, regulatory, contractual, accounting, tax, and professional obligations and to establish, exercise, or defend legal claims.
• For other purposes identified at or before the time of collection, with consent where required.

6. Service Providers and Other Disclosures

Matterly may use third-party service providers to support functions such as cloud hosting, infrastructure, authentication, email delivery, electronic signatures, payment processing, monitoring, analytics, security, and customer support. These providers may process information on Matterly's behalf only to the extent reasonably necessary to provide their services and subject to contractual, confidentiality, and security obligations appropriate to the information involved.

Matterly may also disclose information where required or permitted by law, including in response to a subpoena, court order, regulatory request, or other lawful process; to investigate or prevent fraud, abuse, or security incidents; to protect the rights, safety, or property of Matterly, our customers, or others; or in connection with a corporate transaction such as a financing, merger, acquisition, reorganization, or sale of assets, subject to applicable legal requirements.

7. Data Location and Cross-Border Processing

Personal information and Client Data may be stored or processed in Canada, the United States, or other jurisdictions where Matterly or its service providers operate. As a result, information may be subject to the laws of those jurisdictions and may be accessible to courts, law enforcement, or governmental authorities in accordance with applicable law.

Matterly uses contractual, organizational, and technical measures designed to protect information when it is processed by service providers or across borders.

8. Security Safeguards

Matterly uses administrative, organizational, physical, and technical safeguards that are intended to be appropriate to the sensitivity of the information we process. These measures may include access controls, authentication, logging and monitoring, encryption or protected transmission where appropriate, security testing, vendor controls, and procedures for responding to suspected incidents.

No method of electronic transmission or storage is completely secure. Accordingly, Matterly cannot guarantee absolute security, but we work to reduce the risk of unauthorized access, use, alteration, loss, or disclosure.

9. Retention and Deletion

Matterly retains personal information and Client Data only for as long as reasonably necessary for the purposes for which it was collected, to provide the Service, to comply with customer instructions, and to meet applicable legal, regulatory, tax, accounting, dispute-resolution, security, and professional record-retention requirements.

When an account is terminated or data is deleted, Matterly may retain certain information for a limited period in backups, audit logs, security records, or other systems where immediate deletion is not technically practicable, provided that the information remains protected and is not used for unrelated purposes. Some records may also be retained where required by law or where the customer has an independent obligation to preserve them.

10. Consent, Access, Correction, and Other Privacy Rights

Subject to applicable law and lawful exceptions, individuals may request access to personal information about them that is under Matterly's control, request correction of inaccurate information, or withdraw consent where processing is based on consent. Withdrawal of consent may affect the availability of certain features or services.

If your information is contained in Client Data controlled by a Matterly customer, you should generally direct your request to that customer. Matterly will assist customers with privacy requests where required by applicable law and our contractual obligations.

To make a privacy request, contact support@matterly.ca. Matterly may need to verify your identity before completing a request.

11. Cookies and Similar Technologies

Matterly and its service providers may use cookies, local storage, and similar technologies to operate the website and application, keep users signed in, remember preferences, protect accounts, measure service performance, and understand how the Service is used. Where required by law, Matterly will obtain consent for non-essential cookies or similar technologies.

12. Changes to This Privacy Policy

Matterly may update this Privacy Policy from time to time to reflect changes to the Service, integrations, legal requirements, or data practices. The "Last Updated" date at the top of the policy will identify the most recent revision.

If Matterly changes the way it accesses or uses Google user data, or otherwise makes a material change requiring renewed consent, Matterly will update the applicable privacy disclosures and provide notice or obtain consent as required before using the data for the new purpose.

13. Contact Information

Organization

Matterly Inc.

Email

support@matterly.ca

Website

https://matterly.ca