Privacy Policy

Matvei Dobrovolskii trading as Matio, based in the United Kingdom, is the data controller for the personal data processed through matio.tv. You can reach us at contact@matio.tv. Our data-protection contact is the same address. We have not appointed a Data Protection Officer and are not required to under Article 37 UK GDPR.

We process the following categories of personal data:

• Account data — email address, name (if you give one), authentication tokens. Collected and stored by Clerk on our behalf. We also mirror a minimal user record (Clerk id, email, role) in our own database to power authorisation.
• Subscription and payment data — billing name and address (required for VAT calculation), payment method, invoice history, subscription status, period end. Collected and stored by Stripe on our behalf. We never see your full card number; we only receive a Stripe customer reference and a redacted last-four.
• Usage data — which episodes you watched and the playback position, recorded per (user, episode) so you can resume. For anonymous previews we record a session token, the show id, an expiry timestamp, and a HMAC hash of your IP (the raw IP is never stored).
• Marketing-attribution data — if you arrive from a campaign URL we record the source / medium / campaign in two cookies and may attach the snapshot to your account at checkout for revenue attribution. If you accept marketing cookies, we also run the Meta Pixel and Meta Conversions API for advertising measurement (sharing a hashed email address, IP address and conversion events with Meta), PostHog for product analytics (funnel and engagement events, masked session replays, processed in the EU), and Google Analytics (GA4) for site-traffic measurement. See the Cookie Policy.
• First-party audience measurement — a strictly first-party cookie (matio_aid) holding a random anonymous identifier lets us measure our own audience: the days you visited, which pages you viewed (home page, show pages, the sign-up wall), the marketing source / medium / campaign and referrer of your first visit, and the country your visit came from (derived from your IP — the raw IP address is never stored against it). This is never shared with third parties and never used for advertising or cross-site tracking. If you later create an account, the identifier is linked to it so we can join that first visit to your sign-up. You can delete the cookie at any time in your browser settings.
• Communications — emails you send us, support conversations, and transactional email such as the new-episode notifications you ask for.
• Technical data — IP address, browser user-agent, request logs needed to operate, secure and debug the service. Held for up to 30 days.

• To deliver the service to you (account, playback, subscription billing). Lawful basis: performance of the contract you enter into when you subscribe.
• To meet our legal obligations (VAT/tax records, consumer-rights compliance, anti-fraud, replying to lawful requests from authorities). Lawful basis: legal obligation.
• To keep the service secure (rate-limit abuse, detect fraud, debug). Lawful basis: legitimate interests — operating a stable, safe service.
• To improve the service (aggregate analytics, playback-quality monitoring via Mux Data). Lawful basis: legitimate interests.
• Marketing and advertising measurement via the attribution_first and attribution_last cookies and, where enabled, the Meta Pixel, Meta Conversions API, PostHog (product-analytics funnel measurement), and Google Analytics (site-traffic measurement). Lawful basis: consent — these run only after you accept marketing cookies in the banner, and stop if you withdraw consent.
• First-party audience measurement (counting unique visitors and understanding which pages are used, via the matio_aid cookie). Lawful basis: legitimate interests — understanding how our own service is used without third-party tracking. Because this measurement stays strictly first-party and is never used for advertising, it does not require consent.

We rely on third-party processors who handle data on our instructions. The current subprocessor list:

• Clerk Inc. (US) — authentication. EU/UK transfers covered by Standard Contractual Clauses (SCCs).
• Stripe Payments Europe Ltd (Ireland) — payments and billing. Stripe may transfer some data to its US affiliates under SCCs.
• Mux Inc. (US) — video transcoding, storage and signed playback. SCCs.
• Vercel Inc. (US, EU regions for compute) — hosting. Our application functions run in Frankfurt (eu-central-1); the CDN is global. SCCs.
• Neon Inc. (US, EU region for our database) — our Postgres database is hosted on AWS Frankfurt (eu-central-1). SCCs.
• Resend Inc. (US, EU region for email delivery) — transactional email: the new-episode notifications you ask for. We share the email address you submitted and the show it relates to; every email carries an unsubscribe link. SCCs.
• Meta Platforms Ireland Ltd (Ireland, with transfers to Meta Platforms Inc. in the US) — advertising measurement via the Meta Pixel and Conversions API. Only engaged after you accept marketing cookies. We share a hashed (SHA-256) email address, IP address and conversion events so Meta can attribute and optimise our ad campaigns. US transfers covered by SCCs.
• PostHog Inc.(US, EU Cloud region for our project) — product analytics. Our PostHog project is hosted on PostHog’s EU Cloud (servers in the European Union), so behavioral and usage data stays in the EU. Only engaged after you accept marketing cookies. We send funnel events (page views, feature interactions, sign-up steps) and masked session replays. SCCs cover any onward transfers to PostHog’s US infrastructure.
• Google Ireland Ltd (Ireland, with transfers to Google LLC in the US) — site analytics via Google Analytics 4. Only engaged after you accept marketing cookies. We share usage and device data (page views, approximate location from IP, browser/device details) so we can measure site traffic. US transfers covered by SCCs.

We do not sell your personal data. We may disclose information when required by law, to enforce these terms, or to protect rights, safety or property.

Some of the processors above are established in the United States. Where personal data leaves the EEA / UK, we rely on the European Commission’s Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum. Stripe is established in Ireland and processes most billing data in the EU.

• Account: while your account exists, plus a short grace period after deletion.
• Payment and tax records: kept for as long as required by tax and accounting law (typically 6–10 years depending on jurisdiction).
• Watch progress: kept while the account exists.
• Trial sessions: retained for 30 days for abuse analytics, then deleted or fully anonymised.
• Audience-measurement data: the first-party audience identifier and the data recorded against it are kept for up to 25 months, then deleted or fully anonymised.
• Request and security logs: 30 days.

You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw any consent you have given (e.g. by clearing marketing cookies in the cookie banner). To exercise these rights, contact us at contact@matio.tv. We will respond within 30 days.

If you believe we have not handled your data correctly, you can lodge a complaint with your supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD, aepd.es). In the UK that is the Information Commissioner’s Office (ICO, ico.org.uk). Your local authority elsewhere in the EEA is equally competent.

The service is intended for users aged 16 and over. We do not knowingly collect personal data from children below that age. If we learn we have, we will delete it.

We take appropriate technical and organisational measures to protect your data: TLS everywhere, encrypted-at-rest databases, scoped credentials, signed playback tokens, webhook signature verification, and least-privilege access controls. No system is completely secure; if a personal-data breach is likely to affect you, we will notify you and the relevant authority as required by law.

We may update this Privacy Policy. If a change is material we will give reasonable notice (typically by email and a banner on the service).

Privacy questions: contact@matio.tv. See also our Terms of Service and Cookie Policy.