Matteh.Last updated 19 May 2026
Privacy.
What we collect. Why. Where it goes. How to get it deleted. UK GDPR Article 13 boils down to one thing — tell people what you’re doing with their data, in language they can actually read. The rest of this page tries that. If a sentence reads like legal-template wallpaper instead of telling you something useful, that’s a bug. Email braeden@matteh.uk.
The data controller.
- Trading name
- Matteh
- Operator
- Braeden Izatt, sole trader, London, United Kingdom
- Contact
- braeden@matteh.uk
- Data Protection Officer
- Not appointed — sole-trader operations don’t hit the threshold that mandates one. The contact above handles every request himself.
Four pots of personal data.
1. Essay waitlist signups
Drop your email at the bottom of an essay and we store five things: the email address itself, which essay you signed up from, the browser user-agent string the request came in with, the IP that sent it, and a created-at timestamp. Nothing else.
2. Audit orders
Buy an audit on matteh.uk and the intake form keeps a working file: email, name, brand’s domain, the question you want answered, the competitors you named, any free-form notes, the request’s user-agent, its IP, timestamps. The card itself never reaches us — Stripe handles payment and we get back the session ID, the payment intent, and the amount paid. That’s the whole payment-side surface.
3. Anything you email us
Email braeden@matteh.uk and the thread sits in the inbox. We don’t copy it elsewhere; it stays so we can pick the conversation up next time.
4. Cold-outbound prospect contacts
From late May 2026 onward, we send first-touch outreach emails to named individuals at UK clinics — owners, practice managers, and the people who run the front desk — whose work email and public role we’ve identified from the clinic’s own site, LinkedIn, or public company filings. The sender is braeden@anchor.matteh.uk (a subdomain we use specifically so cold outreach doesn’t share reputation with the editorial inbox).
For each prospect we hold: name, role, work email, clinic name, clinic domain, a brief per-prospect note relevant to their clinic (the thing we’d open the email with), and the sequence state for that contact (sent, replied, unsubscribed). No personal phone numbers, no consumer data, no enrichment-shop profiles. The list is built by us, not bought.
Every cold email carries the sender’s identity, postal address, a one-click unsubscribe header (RFC 8058), and a link back to this policy. Reply “unsubscribe” or click the mail-client native button and the row is suppressed within minutes. The legitimate-interests assessment behind this processing is documented internally and available on request.
What we don’t collect
On purpose: no analytics. No Google Analytics, no Plausible, no PostHog, nothing fingerprinting visits to these pages. The tradeoff is real — we lose funnel data that would be nice to have — but at our traffic level the calculus doesn’t favour exporting visitors to a third party for metrics neither of us needs. (The data sources our teardowns cite are your brand’s public surfaces, not your visitors.)
No advertising cookies. No tracking cookies. The only cookies set on this site are the strictly necessary session cookies the admin and client-portal areas need to work, and a public reader of the essays never encounters them.
No automated decision-making. The audit you’d buy is written by a human (Braeden), not generated by something silently scoring you in the background.
Purpose and lawful basis, line by line.
- Waitlist email
- Purpose: let you know when new teardowns publish and when audit slots open. Lawful basis: consent (Article 6(1)(a)). The submit click is the consent. Withdraw any time — see § 06.
- Audit-order data
- Purpose: deliver the audit you bought. Lawful basis: performance of a contract (Article 6(1)(b)). The intake fields are the minimum the work depends on; nothing extra is asked.
- Stripe payment data
- Purpose: take payment, account for it, refund it if it comes to that. Lawful basis: contract (6(1)(b)) plus legal obligation (6(1)(c)) — HMRC requires the accounting record either way.
- User-agent + IP address
- Purpose: abuse prevention, error diagnosis, and an audit trail if a row gets disputed. Lawful basis: legitimate interests (6(1)(f)) — running a site that isn’t being spammed or tampered with.
- Email correspondence
- Purpose: have a conversation. Lawful basis: legitimate interests (6(1)(f)) for general enquiries; contract (6(1)(b)) once you become a buyer.
- Cold-outbound contact data
- Purpose: first-touch B2B outreach to named individuals at UK clinics we think the work might be useful to. Lawful basis: legitimate interests (6(1)(f)) — promoting a B2B service to the named recipient’s professional role at their employer. PECR Reg 22 exempts marketing to corporate subscribers from the prior-consent requirement that applies to consumers, provided the sender identity is disclosed and an unsubscribe route is present. Both are. The legitimate-interests assessment behind this processing (purpose / necessity / balance) is documented internally and available on request.
The six processors that touch your data.
We don’t sell anything to anyone. No advertiser, no broker, no enrichment shop. The third parties below are the infrastructure that actually runs the site — each operates as our processor under a written DPA. That’s the whole list.
- Supabase
- Our database and auth provider. Stores waitlist rows, audit-order rows, and admin/client-portal accounts. Hosted in the EU. supabase.com/privacy.
- Stripe
- Payment processing for audit orders. Stripe is a separate data controller for the payment information itself (card number, billing address, fraud signals); we receive only the session and payment IDs and the amount paid. stripe.com/gb/privacy.
- Vercel
- Hosts and serves matteh.uk. Sees request logs (IP, user-agent, path) for the duration of the access logs. vercel.com/legal/privacy-policy.
- Resend
- Sends transactional email (e.g. magic-link sign-in for buyers, audit-delivery notifications). Sees the recipient address and the email body we choose to send. resend.com/legal/privacy-policy.
- Google Workspace
- Hosts the
braeden@anchor.matteh.ukmailbox we use for first-touch B2B outreach. Sees the messages we send and the replies we receive at that address. workspace.google.com/terms/dpa_terms. - Smartlead
- The cold-outreach platform that holds our prospect contact list, sends the sequence from the Workspace mailbox above, detects replies, and stops the sequence the moment a reply arrives. Sees the prospect’s name, role, work email, clinic, the per-prospect note we open the message with, and the sequence state. US-domiciled. smartlead.ai/privacy.
Add a processor, this list grows. The footer always points back here.
Some of your data leaves the UK.
Five of the six (Stripe, Vercel, Resend, Google Workspace, Smartlead) are headquartered in the US and may move data there in the course of doing the work. Supabase runs our project in the EU, but its corporate parent is US-domiciled too — so the same transfer question applies to it.
The legal vehicle covering each transfer is the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (UK IDTA), built into every processor’s DPA. In practice that means transferred data gets the same protection on a server in San Francisco that it would on one in London. Each processor’s DPA is linked from its privacy notice above.
What you can ask us to do.
Seven rights under UK GDPR. To exercise any of them, email braeden@matteh.uk. We act inside thirty days, usually the same day. No charge, no forms, no portal.
- Access. Ask what we hold; we send you a copy.
- Rectification. Anything wrong gets corrected.
- Erasure. Deleted on request, with one carve-out: audit-order rows are kept seven years because HMRC requires it. Everything else can go.
- Restriction. Pause processing while a question is being resolved.
- Portability. Your data, in a machine-readable export, so you can take it wherever.
- Object.If we hold something under legitimate interests, you can tell us to stop. If our reason to continue isn’t stronger than yours to stop, we stop.
- Withdraw consent. For the waitlist: click the one-click unsubscribe link in the footer of any email we send you (or use your mail client’s native unsubscribe button — we send the RFC 8058
List-Unsubscribeheader so Gmail and Outlook show it inline). One click marks the row unsubscribed and we stop sending. You can also reply to any email or write to us directly.
If we’ve handled your data badly and haven’t fixed it on request, the UK Information Commissioner’s Office takes complaints: ico.org.uk/make-a-complaint. We’d rather hear about it first — gives us a chance to put it right — but it’s your route either way.
Retention, in dates.
- Waitlist signup
- Held until you ask for deletion. Once a year (every January) the table gets reviewed; addresses that haven’t opened anything in twelve months get pruned.
- Audit-order data
- Seven years from the order date — HMRC requires the accounting record. The next quarterly purge after the seven-year mark removes the row.
- Server / access logs
- 30 days at Vercel, then rotated out automatically.
- Email correspondence
- Kept while the working relationship is live. Archived and deleted at the annual inbox sweep otherwise.
- Cold-outbound prospect contacts
- Held for the active sequence (~14 days), plus 90 days after the last touch for follow-up context. Unsubscribed addresses go onto a permanent suppression list (we keep them precisely so we never email you again). Replies that turn into a conversation move into the email-correspondence pot above.
What happens if you don’t give it.
Waitlist: skip it. Every essay reads end-to-end without giving us anything. The form is for people who want a heads-up when a new essay drops or a slot opens.
Audit order: brand domain, your question, your email — not optional. They’re what the work depends on. Skip them and we can’t deliver, in which case the payment gets refunded.
We’ll tell you.
Material changes — new processor, new purpose, longer retention — mean a page update, a fresh last updateddate at the top, and an email out to the waitlist and any open audit clients before the change kicks in. Cosmetic edits (typos, link fixes, layout) don’t earn an email.
Last updated 19 May 2026