Privacy Policy

DEEP ORDINARY LTD, registered in England and Wales (company no. 17381666, registered office: 66 Paul Street, London EC2A 4NA), is the data controller for the personal data processed through matio.tv. You can reach us at [email protected]. Our data-protection contact is the same address. We have not appointed a Data Protection Officer and are not required to under Article 37 UK GDPR.

We process the following categories of personal data:

• Account data — email address, name (if you give one), authentication tokens. Collected and stored by Clerk on our behalf. We also mirror a minimal user record (Clerk id, email, role) in our own database to power authorisation. If you sign in with Google or Apple, we receive from that provider, through Clerk, what you choose to share with us: your email address (with Apple, possibly a private relay address that forwards to your real one), your name and, from Google, your profile picture, together with the provider’s identifier for your account. Clerk keeps them with your account. For each sign-in session, Clerk also records the approximate location the session was used from — the city and country, worked out from the IP address — together with that IP address and the browser and type of device. Clerk uses this to keep your account secure, for example to email you when your account is signed in from a device it hasn’t seen before; we don’t use it for anything else. It is kept with your account (“Account” in section 6).
• Subscription and payment data — billing name and address (required for VAT calculation), payment method, invoice history, subscription status, period end. Collected and stored by Stripe on our behalf. We never see your full card number; we only receive a Stripe customer reference and a redacted last-four.
• Usage data — which episodes you watched and the playback position, recorded per (user, episode) so you can resume. When a free episode plays on your browser, we may also keep one record per show for that browser, identified by the random token in the trial_session cookie: the show, when the record was created, the last free episode you watched and how far into it you got, the furthest episode you reached in that show, when you first reached the sign-up screen, a keyed hash (HMAC) of your IP address — for an IPv6 address, of its network prefix — (the raw IP is never stored), whether the record came from the website or the app, and the campaign source / medium / campaign that brought you, only while marketing cookies are on. If you then sign in on that browser, the record may be linked to your account — as may website records created from the same internet connection in the six hours before — and if that account later subscribes, the record is marked as converted. Unlinked records are kept as described under “Trial sessions” in section 6. The app keeps the same kind of record against its device identifier (section 11).
• Marketing-attribution data — if you arrive from a campaign URL we record the source / medium / campaign in two cookies and may attach the snapshot to your account at checkout for revenue attribution. While marketing cookies are on, we also run the Meta Pixel and Meta Conversions API for advertising measurement (sharing a hashed email address, IP address and conversion events with Meta), PostHog for product analytics (funnel and engagement events, masked session replays, processed in the EU), Google Analytics (GA4) for site-traffic measurement, the ChatGPT Ads measurement pixel (ChatGPT ad measurement), and Mux Data (watch-time and playback-quality measurement by our video provider, Mux). Wherever you are, marketing cookies are on only after you accept them in the cookie banner, and you can switch them off at any time under “Cookie preferences” in the footer. See the Cookie Policy.
• First-party audience measurement — a strictly first-party cookie (matio_aid) holding a random anonymous identifier lets us measure our own audience: the days you visited, which pages you viewed (home page, show pages, the sign-up wall), the marketing source / medium / campaign and referrer of your first visit, and the country your visit came from (derived from your IP — the raw IP address is never stored against it). This is never shared with third parties and never used for advertising or cross-site tracking. If you later create an account, the identifier is linked to it so we can join that first visit to your sign-up. You can delete the cookie at any time in your browser settings.
• Communications — emails you send us, support conversations, and transactional email such as the new-episode notifications you ask for.
• Story ideas — if you send us an idea through matio.tv/ideas, we keep the idea itself (the series it continues or that it is a new one, the working title, the logline and the story), the name or pen name you give us and your email address; whether you asked for emails about new episodes and story calls, the version of the Idea Submission Terms you accepted, and the site language; and the campaign that brought you, only while marketing cookies are on — after you accept them in the cookie banner, until you switch them off under “Cookie preferences” in the footer. You don’t need an account to send an idea, and we don’t store your IP address with it.
• Job applications — if you apply for a role through matio.tv/careers, we keep the role you applied for, your full name, your email address, where you are based, the links you give us (LinkedIn, a portfolio or other work, and up to four social profiles — a link or an @handle) and what you write about yourself. You don’t need an account to apply, we don’t accept files, and we don’t store your IP address with your application.
• Technical data — IP address, browser user-agent, request logs needed to operate, secure and debug the service. Held for up to 30 days.

• To deliver the service to you (account, playback, subscription billing). Lawful basis: performance of the contract you enter into when you subscribe.
• To meet our legal obligations (VAT/tax records, consumer-rights compliance, anti-fraud, replying to lawful requests from authorities). Lawful basis: legal obligation.
• To keep the service secure (rate-limit abuse, detect fraud, debug). Lawful basis: legitimate interests — operating a stable, safe service.
• To improve the service (aggregate analytics). Lawful basis: legitimate interests.
• To review a story idea you send us, contact you about it and keep a record of the licence you grant. Lawful basis: performance of a contract — the Idea Submission Terms you accept when you send it. Emails about new episodes and story calls: lawful basis consent, only if you tick the box; we don’t send them yet.
• To consider your job application and contact you about it. Lawful basis: steps taken at your request before entering into a contract and our legitimate interests in recruiting for Matio. We use your application for nothing else. While marketing cookies are on, our product analytics (PostHog) also counts that an application for a role was sent — which role, never your name, your contact details, your links or what you wrote.
• Marketing and advertising measurement via the attribution_first and attribution_last cookies and, where enabled, the Meta Pixel, Meta Conversions API, PostHog (product-analytics funnel measurement), Google Analytics (site-traffic measurement), the ChatGPT Ads measurement pixel (ChatGPT ad measurement), and Mux Data (watch-time and playback-quality measurement by our video provider, Mux). Lawful basis: consent — wherever you are, these run only after you accept marketing cookies in the cookie banner, and stop when you withdraw consent under “Cookie preferences” in the footer.
• First-party audience measurement (counting unique visitors and understanding which pages are used, via the matio_aid cookie). Lawful basis: legitimate interests — understanding how our own service is used without third-party tracking. Because this measurement stays strictly first-party and is never used for advertising, it does not require consent.

We rely on third-party processors who handle data on our instructions. The current subprocessor list:

• Clerk Inc. (US) — authentication: your account and the record of each sign-in session described in section 2, including its approximate location. EU/UK transfers covered by Standard Contractual Clauses (SCCs).
• Stripe Payments Europe Ltd (Ireland) — payments and billing. Stripe may transfer some data to its US affiliates under SCCs.
• Mux Inc. (US) — video transcoding, storage and signed playback, and playback measurement (Mux Data: watch time and playback quality). Mux Data is only engaged while marketing cookies are on: after you accept them in the cookie banner, until you switch them off under “Cookie preferences” in the footer. SCCs.
• Vercel Inc. (US, EU regions for compute) — hosting. Our application functions run in Frankfurt (eu-central-1); the CDN is global. SCCs.
• Neon Inc. (US, EU region for our database) — our Postgres database is hosted on AWS Frankfurt (eu-central-1). SCCs.
• Resend Inc. (US, EU region for email delivery) — transactional email: the new-episode notifications you ask for. We share the email address you submitted and the show it relates to; every email carries an unsubscribe link. SCCs.
• Meta Platforms Ireland Ltd (Ireland, with transfers to Meta Platforms Inc. in the US) — advertising measurement via the Meta Pixel and Conversions API. Only engaged while marketing cookies are on: after you accept them in the cookie banner, until you switch them off under “Cookie preferences” in the footer. We share a hashed (SHA-256) email address, IP address and conversion events so Meta can attribute and optimise our ad campaigns. US transfers covered by SCCs.
• PostHog Inc. (US, EU Cloud region for our project) — product analytics. Our PostHog project is hosted on PostHog’s EU Cloud (servers in the European Union), so behavioral and usage data stays in the EU. Only engaged while marketing cookies are on: after you accept them in the cookie banner, until you switch them off under “Cookie preferences” in the footer. We send funnel events (page views, feature interactions, sign-up steps) and masked session replays. SCCs cover any onward transfers to PostHog’s US infrastructure.
• Google Ireland Ltd (Ireland, with transfers to Google LLC in the US) — site analytics via Google Analytics 4. Only engaged while marketing cookies are on: after you accept them in the cookie banner, until you switch them off under “Cookie preferences” in the footer. We share usage and device data (page views, approximate location from IP, browser/device details) so we can measure site traffic. US transfers covered by SCCs.
• Google and Apple — only if you choose to sign in with them. Google (Google Ireland Ltd and Google LLC) or Apple (Apple Distribution International Ltd and Apple Inc.) learns that you signed in to Matio and passes us, through Clerk, the details described in section 2. They are not our processors: each acts as the independent controller of your Google or Apple account, under its own privacy policy.
• Production partners — only for an idea we develop with you, and only what the production needs.
• Google Ireland Ltd (Google Workspace, with transfers to Google LLC in the US) — our mailbox at [email protected], for correspondence with you, including replies about story ideas and job applications and requests about your data. SCCs.

We do not sell your personal data. We may disclose information when required by law, to enforce these terms, or to protect rights, safety or property.

Some of the processors above are established in the United States. Where personal data leaves the EEA / UK, we rely on the European Commission’s Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum. Stripe is established in Ireland and processes most billing data in the EU.

• Account: while your account exists, plus a short grace period after deletion.
• Payment and tax records: kept for as long as required by tax and accounting law (typically 6–10 years depending on jurisdiction).
• Watch progress: kept while the account exists.
• Trial sessions: retained for 30 days for abuse analytics, then deleted or fully anonymised.
• Audience-measurement data: the first-party audience identifier and the data recorded against it are kept for up to 25 months, then deleted or fully anonymised.
• Story ideas: up to 24 months from submission, or longer only if we develop your idea with you.
• Job applications: 6 months from submission.
• Request and security logs: 30 days.

You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw any consent you have given (e.g. by clearing marketing cookies in the cookie banner). To exercise these rights, contact us at [email protected]. We will respond within 30 days.

You can withdraw your consent to emails about new episodes and story calls at any time by writing to [email protected] or through the “unsubscribe” link in any email we send you.

If you believe we have not handled your data correctly, you can lodge a complaint with your supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD, aepd.es). In the UK that is the Information Commissioner’s Office (ICO, ico.org.uk). Your local authority elsewhere in the EEA is equally competent.

The service is intended for users aged 16 and over. We do not knowingly collect personal data from children below that age. If we learn we have, we will delete it. Story ideas and job applications may only be sent by people aged 18 or over.

We take appropriate technical and organisational measures to protect your data: TLS everywhere, encrypted-at-rest databases, scoped credentials, signed playback tokens, webhook signature verification, and least-privilege access controls. No system is completely secure; if a personal-data breach is likely to affect you, we will notify you and the relevant authority as required by law.

We may update this Privacy Policy. If a change is material we will give reasonable notice (typically by email and a banner on the service).

This section covers the Matio app for phones. The rest of this policy applies to the app too, except the website’s cookies and the tools that depend on them, which the app does not use. Below is what the app adds.

• Device identifier — the first time the app contacts our servers, it creates a random identifier (a UUID) that contains nothing about you or your device. It keeps the identifier in the device’s secure storage — on iPhone, the keychain, where the app can read it once the phone has been unlocked after being switched on, so that playback can continue with the screen locked — and sends it with every request to our servers. On iPhone the keychain can keep the identifier after the app is deleted, so reinstalling the app may bring back the same identifier; on Android it is normally removed together with the app. Signing in in the app does not link the identifier, or the records kept against it, to your account.
• What the identifier is used for — when a free episode plays, we may keep one record per show against the identifier: the show, when playback started, when the sign-up screen was first reached, and a keyed hash (HMAC) of your IP address — for an IPv6 address, of its network prefix — (the raw IP is never stored). These records let us check that the viewing counters below reflect real playback, limit abuse, and measure how our own service is used. Lawful basis: legitimate interests — offering free viewing fairly and understanding how our own service is used, without third-party tracking. Like the matio_aid cookie on the website, the identifier is never shared with third parties or used for advertising.
• Viewing counters — the app reports which 10-second stretches of an episode were played, and we add them to daily per-episode counters that hold no identifier — neither the device identifier nor your account. For a device that is not signed in, the identifier is only checked against the records above, so that the counters reflect real playback.
• How long we keep it — records kept against the device identifier are not linked to an account and are deleted 30 days after they are created (the “Trial sessions” period in section 6). Before 3 October 2026, a record could be linked to an account signed in to matio.tv from the same internet connection within six hours of the record being created; a record linked that way is kept like the rest of that account’s data (section 6) until the account is deleted. The viewing counters hold no personal data.
• If you sign in — to sign in or create an account, you enter your email address in the app, which sends it to Clerk, our authentication provider; Clerk emails you a one-time code. Instead, you can continue with Apple or Google: the app opens that provider’s own sign-in screen, and the provider passes Clerk the details described in section 2 (with Apple you can choose to hide your email address). When you create an account with your email address, the app also passes Clerk the language you use in the app. Your sign-in session is kept in the device’s secure storage. As on the website, Clerk records the approximate location of each sign-in session — the city and country, worked out from your IP address — with the IP address and the type of device (section 2). While you are signed in, the app sends us your watch progress — the episode, how far you got, whether you finished it and how long you watched — so you can pick up where you left off, in the app or on matio.tv; we also record the days on which you watched, to measure how our own service is used. Lawful basis: performance of the contract for your account and watch progress (section 3), legitimate interests for the days watched. Watch progress is kept while your account exists (section 6); the days watched are kept for up to 25 months. Both are erased if you delete your account.
• Kept only on your device — the autoplay setting. If you continue with Google, Google’s own sign-in component also keeps your Google session (your Google account details and its sign-in tokens) in the device’s secure storage, so it can recognise you next time; the app does not read it, and ends it when you sign out of Matio or delete your account.
• Providers — the app contains no analytics, advertising or tracking tools, and it does not track you across other companies’ apps or websites. Besides Sentry for error reports (below), it uses only providers already listed in section 4: Vercel and Neon (our servers and database), Clerk (sign-in) and Mux (video and episode images) — and Apple or Google, only if you choose to sign in with them. Like any request to our servers, the app’s requests carry your IP address and basic device details, handled as “Technical data” in section 2. When you open our Terms, this policy or the Cookie Policy from the app, the page opens in an in-app browser without our analytics or advertising tools.
• Error reports — when the app crashes or runs into an error, it can send a report to Functional Software, Inc. (Sentry; US company, our data held in its EU region; US transfers covered by the EU-US Data Privacy Framework and its UK Extension) so we can find and fix the fault. A report holds the technical details of the error, the app version, the device model, operating system and similar device details, a trail of recent app events with the parameters removed from web addresses, and a random identifier that Sentry’s software creates on the device. It never includes your email address, your account or the device identifier above, and never a screenshot or a recording of your screen. Lawful basis: legitimate interests — keeping the app working. Sentry keeps reports for up to 90 days.
• Deleting your account — you can delete your account in the app at any time: Account → Delete account. Once you confirm, your account and the data we keep with it are erased, including your watch progress, the days you watched and your new-episode reminders; an active subscription is set to end at the close of the period you have paid for; and your billing records held by Stripe, our payment processor, are kept as described under “Payment and tax records” in section 6. You can also write to [email protected], which is also how you exercise the other rights in section 7. Records kept against the device identifier are deleted 30 days after they are created, as above: deleting the account does not remove them sooner, and one that was linked to your account loses the link and then follows the same rule.

Privacy questions: [email protected]. See also our Terms of Service and Cookie Policy.