Privacy Policy

Matterly is built and operated by DigiSmart Technology Ltd ("DigiSmart", "we", "us", "our"), a company registered in England and Wales (company no. 13111564; registered office 20-22 Wenlock Road, London N1 7GU). We provide practice management software to UK law firms ("Customers") and, through them, may process personal data relating to Customers' staff, clients, opponents, and other contacts ("Data Subjects"). This policy explains how we handle personal data when you visit our website, sign up for a trial, or use the Matterly platform.

For most of the personal data processed inside a firm's Matterly account — client names, matter details, correspondence, billing records — DigiSmart acts as a data processor on behalf of the firm, who is the data controller. Where we process data about our own website visitors, trial sign-ups, and billing contacts, DigiSmart acts as the data controller in its own right.

We collect the following broad categories of data:

• Personal data — name, work email, phone number, job title, and role, collected when you or your firm create an account.
• Matter data — client and contact records, matter details, documents, time entries, invoices, and correspondence entered into Matterly by your firm.
• Usage data — log-in timestamps, feature usage, device and browser type, IP address, and diagnostic events, collected automatically to keep the service secure and reliable, and to understand how our website is used (see Website analytics below).
• Communications data — transcripts and details captured by the optional AI phone assistant, and messages exchanged through the email, SMS, and WhatsApp channels your firm connects.
• Payment data — card payments are handled by our payment processor; we never see or store full card numbers.

We use personal data to:

• Provide, maintain, and support the Matterly platform, including hosting matter, contact, billing, and document data on behalf of your firm.
• Authenticate users, enforce role-based access, and protect accounts against unauthorised access.
• Send service communications — security alerts, billing notices, and product updates relevant to your account.
• Improve the product through aggregated, de-identified usage analysis.
• Meet our legal, accounting, and regulatory obligations, including responding to lawful requests from courts or regulators.

We do not use your firm's data to train AI models, and our AI provider does not use it to train theirs. Data sent for one firm's request is never used for another firm. AI features such as drafting, analysis, and lead scoring support your staff's decisions; they never make decisions with legal or similarly significant effects on their own.

Where DigiSmart is the controller, we rely on the following lawful bases under the UK GDPR: performance of a contract (running your subscription and providing support), legitimate interests (product security, fraud prevention, and service improvement, balanced against your rights), and consent (optional marketing communications, which you can withdraw at any time). Where DigiSmart is a processor acting on your firm's instructions, your firm determines the lawful basis for processing its clients' and contacts' data, and we process only in accordance with our data processing agreement with that firm.

We do not sell personal data. We share data only with sub-processors that help us deliver the service, under written agreements that require them to protect data to a standard consistent with UK GDPR. Our current sub-processors are:

We update this list before adding or replacing a sub-processor, and notify customer account administrators by email in advance, so your firm can raise any objection.

Customer data is stored on servers located in the United Kingdom. Traffic to and from Matterly passes through our network provider, which may process it in transit outside the UK. Where a sub-processor transfers personal data outside the UK or EEA, we ensure an appropriate safeguard is in place — such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on an adequacy regulation — before the transfer takes place.

We keep your firm's matter, contact, billing, and document data for as long as its subscription is active. When the subscription ends, we keep the data for 30 days so you can retrieve it or reactivate, then permanently delete it from our live systems. Copies in our encrypted backups are overwritten within a further 30 days. Your firm remains responsible for any longer record-keeping it owes, such as under SRA rules, so retrieve what you need before the 30 days end.

Where DigiSmart is the controller, we keep account and trial sign-up details while the account exists, our invoices and billing records for six years to meet tax law, and website analytics records as described under Website analytics below.

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete personal data, where there is no overriding legal reason to retain it.
• Portability — receive certain data you provided to us in a structured, machine-readable format.
• Object or restrict — object to, or ask us to restrict, certain processing based on legitimate interests or direct marketing.
• Withdraw consent — where we rely on your consent, withdraw it at any time.
• Automated decisions — not be subject to a decision based solely on automated processing that significantly affects you.

Where DigiSmart processes data as a processor on behalf of your firm, requests relating to client or matter data should generally be directed to your firm in the first instance, and we will support them in responding. To exercise these rights directly with us, contact [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We protect data in transit and at rest with industry-standard encryption. Each firm's data is kept logically separate, so one firm can never access another's. Access to production systems is restricted to authorised personnel and logged. See our Security page for further detail on our technical and organisational measures.

To understand how our website is used and to improve it, we analyse the records our servers keep of each request: IP address, browser and device type, the page requested, the page you came from, and an approximate location (country or city) derived from the IP address. On our public website, a small cookieless signal also tells us when you move from one page to another. DigiSmart is the controller of this data, and our lawful basis is legitimate interests.

This analysis runs entirely on our own systems and is not shared with any third party. Detailed records are deleted after 30 days, and aggregated statistics after 90 days. You can object at any time: your browser's Global Privacy Control or Do Not Track setting is honoured, or you can opt out on our Cookie Policy page.

Matterly's website and application store a small amount of essential and functional data in your browser to keep you signed in and remember your preferences. We do not use advertising trackers, analytics cookies, or third-party analytics services. Full details of every cookie we use, how we measure visits without cookies, and how to manage your preferences, are set out in our Cookie Policy.

We will post any changes to this policy on this page and update the date at the top. If a change materially affects how we handle your data, we will email customer account administrators before it takes effect.

Questions about this policy, or requests relating to your personal data, can be sent to [email protected]. You can also write to us at DigiSmart Technology Ltd, 20-22 Wenlock Road, London N1 7GU, United Kingdom.