Privacy Policy

1.The two kinds of data, and who answers for each

Your firm’s client data. Client names, matters, correspondence, documents, ledgers. Your firm decides what goes in and why; we hold and process it on your instructions. Under the Data Protection Act, 2019 your firm is the data controller and AutoTribes Ltd is its processor. A data-subject request about this data goes to the firm, and we help the firm answer it.

Account data. The name, email address, phone number and role of the people who sign in, plus billing details and the technical records below. We decide what we need this for, so for it we are the controller.

2.What we collect as controller, and why

• Identity and contact — name, email, phone, the firm you belong to and your role in it. To create your account, let you sign in, and address you as a person.
• Billing — plan, seat counts, invoices and payment status. Card details are handled by our payment processor and never reach our servers.
• Technical and security— IP address, browser, timestamps, and an audit record of significant actions taken in the product. To keep accounts secure and to answer “who did this, and when”, which for a law firm is not optional.
• Support — what you write to us when you ask for help, and enough context to answer it.

3.What we never do

• We do not sell personal data, and we never have.
• We do not use your firm’s client data to advertise anything to anyone.
• We do not train models for other customers on your firm’s data. The assistant answers from your firm’s own records, inside your firm’s boundary.
• We do not hold or move client money, so we hold no client bank credentials to lose.

4.Who else sees it

Only the service providers needed to run the product, each under a written processing agreement and each limited to what it needs: hosting and backups, email delivery, the payment processor, and the model provider that powers the assistant. We publish the current list on request.

We disclose data to anyone else only where the law requires it. Where we are lawfully able to tell you first, we will.

5.Where it is held

Data is hosted on servers we control. Where a provider processes data outside Kenya, the transfer is made under the safeguards the Data Protection Act, 2019 requires, and the provider is bound to the same restrictions set out here.

6.How long we keep it

• Your firm’s data — for as long as the account is open. After closure it stays available for export for 30 days, then is deleted within a further 60 days. Backups age out on their own cycle within 90 days.
• Audit records— kept for 7 years. They are the record of who did what in a firm’s file, and shortening that would defeat the reason they exist.
• Billing records — kept for as long as tax and company law require.

7.Security

Data is encrypted in transit and at rest. Each firm’s data is isolated from every other firm’s, and access inside the product is governed by the roles your firm sets. Access by our own staff is limited to what a named person needs to operate or support the service, and is logged.

If a breach affects your firm’s data we will tell you without undue delay, and will notify the Office of the Data Protection Commissioner where the Act requires it.

8.Your rights

Under the Data Protection Act, 2019 you may ask for a copy of your personal data, ask us to correct it, ask us to delete it, object to certain processing, and complain to the Office of the Data Protection Commissioner.

For account data, write to us and we will answer within 30 days. For your firm’s client data, the request belongs to the firm as controller: write to the firm, and we will give the firm what it needs to answer you.

9.Cookies

Matterly sets the cookies it needs to keep you signed in and to remember which firm you are working in. There are no advertising cookies and no third-party trackers on the signed-in product.

10.Changes

We will post any change here with a new date at the top, and notify the firm’s administrators in the product before a material change takes effect.

11.Contact

Data protection enquiries: legal@matterly.ke.