Privacy Policy

MatWorld Inc., a California corporation (“MatWorld”, “we”) operates matworld.ai and is the controller of the personal data described here. Reach us at matworldai@gmail.com for anything in this policy.

This policy is written to be read. Where it says we collect something, we collect it; where it says we don’t, we don’t. The technical inventory it is based on is kept alongside the code and updated in the same change as the code that touches it.

By how it arrives:

• Account (via Clerk). Your email address, name, and the identifier of the sign-in method you chose. If you sign in with Google or another provider, Clerk receives what that provider shares; we store only email, name, and the Clerk user id.
• Billing (via Stripe). When you subscribe, Stripe collects your card and billing details on its own pages. We receive and store your Stripe customer id, subscription id, and plan status. We never see or store card numbers.
• Usage. Actions in the app are logged as events: which materials you viewed, searches and the text of plain-English queries, exports (format and material count), calibration fits (family and verdict, not your data), agent tool calls (which tool, whether it succeeded, and how long it took — not what was asked), and sign-in activity. Anonymous visitors’ events carry no account identifier.
• Agent access. If you generate a personal key for AI agents (Settings → Agent access) we store a one-way hash of it, its first characters, and when it was created and last used — never the key itself. When an agent signs in with your account instead, Clerk issues it a token that we verify on each request and do not store.
• Feedback. If you send feedback from the app: the type, subject, message, and the page you were on, linked to your account.
• Team membership. Which team you own or belong to, and seat changes.
• Support email. Whatever you send us by email, and our replies.
• Technical. Our hosts keep standard request logs (IP address, browser user agent, URL, timestamp). If a page errors, an error report is sent to Sentry (section 6).

• Your calibration uploads are not stored. Test curves you upload are parsed, plotted, and fitted in memory for that request. The only copy is in your browser’s local storage, which you can clear at any time.
• No advertising identifiers, no ad networks, no cross-site tracking, no social pixels.
• No third-party analytics cookies. Page-view analytics are cookieless (section 7).
• No card data. It stays with Stripe.
• Fonts are served from our own site, so no font request reaches Google.
• No sale of personal data, to anyone, ever.

• To run your account and provide the Service — sign-in, plan entitlements, saved preferences, team seats. Basis: performance of our contract with you.
• To bill you and handle renewals, failed payments, and cancellations. Basis: contract; legal obligation for tax and accounting records.
• To send account emails — welcome, upgrade confirmation with renewal terms, payment failure, cancellation, email change. These are transactional; we send no marketing email. Basis: contract.
• To understand and improve the product — which materials, searches, and formats are used, and what fails. Basis: our legitimate interest in operating and improving the Service; you can object (section 9).
• To answer plain-English queries by sending the query text to a language model (section 5). Basis: contract, when you use the feature.
• To keep the Service secure and diagnose errors. Basis: legitimate interest.
• To comply with law and respond to lawful requests. Basis: legal obligation.

Plain-English search and the assistant send the text you type to Anthropic’s Claude API to turn it into a structured query. We send the query text and the list of property names the catalogue supports. We do not send your name, email, account id, or any file you uploaded. Under Anthropic’s commercial API terms, inputs are not used to train its models. Material descriptions were generated in bulk by the same provider from published data, not from user input.

If you connect an AI agent (Claude, Cursor, or one you built) through our MCP server, the agent’s provider receives whatever material data the agent requests on your behalf, under that provider’s terms; we send it nothing else. Plain-English questions an agent asks are handled exactly like questions typed into the search box.

Treat the search box like any third-party service: don’t paste confidential design information into it.

These companies process personal data on our behalf under their standard data-processing terms. We do not share personal data with anyone else except as required by law or to protect the Service, and we never sell it.

A data-processing agreement covering these subprocessors is available to business customers on request.

We set only the cookies needed to keep you signed in, and we use a few browser-storage keys for preferences that never leave your device. Analytics are cookieless. Every cookie and key is listed by name, purpose, and lifetime in the Cookie & Local Storage Notice. Because nothing we use requires consent, we show no cookie banner.

Do Not Track and Global Privacy Control. We do not track visitors across sites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. Our behaviour is the same with or without the signal.

“Shine the Light” (Cal. Civ. Code §1798.83). We do not share personal information with third parties for their own direct-marketing purposes.

Depending on where you live you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a supervisory authority. We extend the same rights to everyone, wherever you are.

• Delete your account yourself from Settings → Account. This removes your account record and usage events, cancels any subscription you own at the end of its paid period, disbands a team you own, and deletes your Stripe customer record.
• Correct your email or name from Settings; the change syncs to our records.
• Get a copy of your data, object, or ask anything else by emailing matworldai@gmail.com from the address on your account. We respond within 30 days.
• Complain to the data-protection authority where you live if you think we have got something wrong. We would appreciate the chance to fix it first.

We will not discriminate against you for exercising any right.

We are a United States company and our providers store data in the United States. If you use the Service from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States. Our providers’ data-processing terms include the European Commission’s Standard Contractual Clauses or an equivalent mechanism, and we apply the measures in section 11 regardless of location.

Traffic is encrypted in transit. Credentials are handled by Clerk; we never see passwords. Card data is handled by Stripe; we never see card numbers. Administrative access to the database and hosting is limited to named people on an allow-list. Error reports mask on-screen text by default. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the relevant authorities as the law requires.

The Service is for professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, email us and we will delete it.

MatWorld is a California company. For the California Online Privacy Protection Act: the categories of personal information we collect are listed in section 2; the categories of third parties we share it with are in section 6; you can review and change your information as described in section 9; we tell you about changes as described in section 14; the effective date is at the top of this page; and our response to Do Not Track signals is in section 7.

We do not currently meet the thresholds that bring a business within the California Consumer Privacy Act, and we do not sell or share personal information for cross-context behavioural advertising. We review this annually. If it changes, this section will describe the rights that apply and how to exercise them.

When we change this policy the version and effective date at the top change with it. For material changes — a new purpose, a new category of data, a new subprocessor that receives personal data — we will email account holders before the change takes effect. Minor clarifications are posted here without notice.