Privacy policy
Effective
1. Who we are and what this policy covers
Maatriks is operated by Riverin OÜ, registry code 17031097, at Ida-Viru maakond, Lüganuse vald, Lüganuse alevik, Papli tn 5c, 43301, Estonia. Contact us at info@maatriks.ai with questions about this policy or requests concerning personal data.
This policy explains personal data handled through the Maatriks public website, organization Console, employee agent connection, and the pass-through that carries agent and application requests to connected services. Maatriks is currently operated with assisted access for the organizations it provisions, before general customer launch. It distinguishes the content used to carry out work from the records used to administer and operate the service.
A controller decides why and how personal data is processed. A processor handles personal data on a controller's instructions. Riverin OÜ acts as controller for its own website operation, business communications, and administration of its business relationship with customers. Riverin OÜ also determines the purpose of its own controlled service evaluation and the authorized test-account administration needed for that evaluation. When an organization engages Riverin OÜ to process work content and associated service records on its instructions, that customer processing must be covered by an applicable data processing agreement. The organization then controls its instructed processing, and Riverin OÜ acts as its processor. This policy does not replace or establish that customer agreement.
Your employer or other organization determines why you use Maatriks, which Connections you may use, and its own rules for handling personal data. Its privacy information therefore also matters. Your AI agent, Microsoft, and connected providers have their own privacy terms for the services they supply.
2. Visiting the public website
The public landing page loads its content, fonts, images, and scripts from the Maatriks site. Its demonstrations and copy-address control work locally in the browser. They do not create an administrator session or invoke an AI provider. The current landing page does not include advertising pixels, browser analytics, or tracking cookies.
The Company and Work email fields currently have a disabled submission control. Information typed into them is not submitted to or stored by the Maatriks application. They do not send an enquiry. If we introduce a working submission service, we will describe its purpose, recipients, and retention before collecting submissions.
Delivering a website involves processing network information needed to send the page to your browser. Our hosting infrastructure participates in that delivery. The application's operational records are deliberately limited to technical events and do not contain raw request headers or bodies. This statement does not assert that every underlying infrastructure provider has no separate network or security records.
3. Signing in and administering access
Microsoft sign-in provides a verified organization identifier, account identifier, and, where available, your name and work email. Maatriks uses these details to match the organization and person, establish a session, and enforce current access. We do not receive your Microsoft password. Ordinary sign-in requests identity information; it does not request access to read or send your email.
The service stores the organization's name, Microsoft tenant identifier, approved administrator setup information, and people records. A person's record includes identity details, administrator or employee role, active or disabled state, and relevant timestamps. It also stores Connections, including the address and key placement an administrator enters for a custom Connection, blocked-request rules, and grants that determine which person may use which Connection.
The organization's administrators can see the People directory and the access they manage. They can also inspect the Usage and Admin-change records described below. Disabling a person prevents access but does not delete their record or configured grants.
An organization can publish a Development project as an app for its own people. Opening one uses the same Microsoft sign-in, and a first sign-in creates your person record in that organization. While you use a published app, Maatriks passes your name and work email to that app with each request, so it can show who did what. They go only to published apps of your own organization. What the app keeps is the organization's project data, under its own rules.
4. Work content and provider credentials
When your agent or an application calls a connected service through Maatriks, Maatriks receives the request, checks it, adds the organization's key, forwards it to that service and streams the service's response back. Depending on the request, this content may include prompts, text, audio, video, files, and generated results. Maatriks relays it without storing request or response bodies, uploaded files, or generated media.
Content is sent only to the service of the Connection that a request uses. The preconfigured providers are OpenAI, Anthropic, Google Gemini, ElevenLabs, Jutusta, and HeyGen. An administrator can also connect another HTTPS service, which then receives the requests sent to that Connection. Content is not sent to all providers simply because the organization has several Connections.
Provider credentials are held in protected custody and added to authorized requests inside Maatriks. The employee's agent does not receive the raw organization credential. It receives a Connection token that lasts 15 minutes and works only for that person and one Connection. Adding or checking a Connection can make one read-only request to the service with the stored key.
The current service has no Maatriks model-training workflow. This does not establish how the customer's chosen agent or external provider uses or retains data. The customer's account configuration and agreement with that service remain relevant.
5. Usage, administration, and operational records
Usage records identify the caller (a person, an organization API key, a Development project, or a project's published app), the Connection, the time, the request method, a redacted endpoint, the response status, transferred size, duration and, for preconfigured providers, available usage measurements and cost estimates. The redacted endpoint replaces path segments that may contain identifiers with a placeholder and never includes the query string. Admin-change records show who changed access or configuration and the relevant safe before-and-after values.
These records exclude request and response bodies, headers, full paths, query strings, uploaded or generated file contents, credentials, and tokens. They are content-free records of work and administration, not anonymous records: they can still identify an employee and which Connection they used.
The Console does not give administrators a content viewer through Logs. Technical service telemetry records limited route categories, outcomes, timings, and safe operational measurements for reliability and security. It does not copy work content into those records.
6. Why data is processed and the legal basis
Customer-directed processing is performed to relay requests to the organization's connected services and to provide the identity and access control and governance records the organization has instructed. The customer is responsible for its lawful basis for those instructions and for informing the people whose data it submits. The data processing agreement sets out Riverin OÜ's processor obligations.
For processing where Riverin OÜ acts as controller, the purposes and bases are:
| Purpose | Relevant data | Legal basis |
|---|---|---|
| Delivering and protecting the public website and operating the business service | Necessary network information and limited technical records | Legitimate interests in providing and protecting a functional service (GDPR Article 6(1)(f)) |
| Controlled service evaluation and authorized test-account administration | Work identity, role, configured access, limited usage evidence and content deliberately sent through Maatriks for the evaluation | Legitimate interests in evaluating and securing the service before launch (GDPR Article 6(1)(f)); this does not authorize unrelated employee monitoring or sensitive-data experiments |
| Communicating with a prospective or current organization and administering that relationship | Business contact details, correspondence, and relevant account information | Legitimate interests in communicating with business contacts; contract necessity only where the individual is themselves a contracting party or requests pre-contract steps |
| Responding to legal duties, including applicable rights requests | Information necessary to fulfil the particular duty | The applicable legal obligation |
For the legitimate interests above, we limit the data to what the purpose needs, restrict access, keep work content out of administrative logs and apply the technical retention limits described here. You can object to this processing by contacting us. A business relationship with an employer does not automatically make its employee a party to our contract.
Microsoft's technical authorization screens are not blanket consent to every use of personal data. We do not rely on acceptance of this policy as consent for unrelated marketing or tracking. A new purpose requiring consent would need its own clear choice.
7. Who receives data and where processing happens
Microsoft Azure provides the current Maatriks hosting, database, credential custody, and operational monitoring services. Microsoft Entra provides work identity authentication. The currently verified Maatriks hosting environment is in Azure Sweden Central; this is not a guarantee that every provider operation or every supplier support activity takes place only in Sweden or the European Economic Area.
Development projects and their published apps run in Microsoft Azure Container Apps sandboxes. Azure enforces the sandboxes’ network rules. Outbound HTTPS remains encrypted through Azure’s network proxy. Maatriks does not record the content of this traffic.
The customer's selected agent and connected provider receive the data necessary for their roles in the requested workflow. The provider-account agreement determines the provider's processing conditions. A provider the customer connects directly is not automatically classified as Riverin OÜ's subprocessor simply because Maatriks relays requests to its API; the actual contractual relationship and purpose must be considered.
Email sent to info@maatriks.ai passes through the domain's configured Elkdata mail servers. Messages contain your address, message content and any attachments you choose to send. They are used to handle your enquiry or request. We do not need provider keys, passwords or complete work files to answer an ordinary enquiry; send only the information needed. Elkdata publishes its service and data-protection information.
Authorized Riverin OÜ personnel and suppliers may require access necessary to operate or support the service. Any such access must follow the applicable confidentiality, security, and processing arrangements. We may also disclose information where required by applicable law or a valid request from a competent authority.
Microsoft and some connected providers operate internationally. Requests can therefore involve processing outside the European Economic Area, including in the United States, depending on the service, account and operation. Sweden Central hosting does not apply automatically to those external operations.
Microsoft publishes its Products and Services Data Protection Addendum, including contractual transfer protections for services covered by its terms. Its EU Data Boundary documentation also describes exceptions for processing outside that boundary. These documents explain Microsoft's published arrangements; the applicable scope follows the actual subscription and service terms.
The customer must check the agreement and settings for its own connected provider before sending personal data through that account. Relevant provider information is available from OpenAI, Anthropic, Google Gemini, ElevenLabs, Jutusta and HeyGen. A provider's public document does not establish that every optional account protection is enabled. For a custom Connection, the customer chooses the service and must check its terms in the same way.
Contact info@maatriks.ai for information about the recipients and transfer safeguards applicable to Maatriks' processing of your data. Before undertaking customer-directed processing, Riverin OÜ and the customer must establish the applicable processing and transfer arrangements. This policy does not promise blanket EEA-only processing or zero retention at all providers.
8. How long data remains available
| Data | Current service handling |
|---|---|
| Request and response content, files, and generated media | Relayed between the caller and the connected service without being stored by Maatriks. |
| Connection tokens | Valid for 15 minutes. Maatriks keeps a hash of the token with its person, Connection and expiry; daily maintenance deletes it 24 hours after expiry. |
| Usage and Admin-change evidence | A moving 365-day access window, with scheduled cleanup of expired records. Related cleanup dependencies can affect physical removal timing. |
| Provider credentials | Retained for active Connection use. Replacement or disconnection removes old credentials from active use and schedules custody cleanup. Azure Key Vault can retain a protected soft-deleted recovery copy for 90 days. |
| Operational monitoring | The current Azure monitoring workspace is configured for 30-day retention. |
| Database backups | The current database backup configuration retains backups for seven days. Expired or deleted live records may remain within an earlier backup until it ages out. |
| Identity, organization, and active configuration records | Retained while the organization remains configured and the records are needed for authorized service operation or evaluation. These records have no automatic account-closure expiry; disablement is not deletion. A removal request is handled separately from the access switch and assessed against any continuing need or legal duty. |
| Business correspondence and legal records | Kept while needed to handle the enquiry, maintain an ongoing business relationship, resolve an outstanding issue, or meet an applicable legal duty. The application's automated retention periods do not apply to separate business correspondence. You can ask us to review or delete correspondence that is no longer needed; any further retention must have a specific continuing reason. |
These periods concern the stated Maatriks data and configuration. They do not control your agent's conversation history or sandbox, copies you keep, the organization's other systems, or an external provider's independent retention. Expiry stops application access before physical cleanup finishes. The service does not promise permanent storage or instantaneous erasure from all systems.
9. Cookies and browser storage
The public landing page does not set a Maatriks tracking cookie. Protected journeys use first-party cookies to complete sign-in securely and maintain the requested authenticated session:
| Cookie | Purpose | Current maximum lifetime |
|---|---|---|
__Host-maatriks-auth | Bind employee MCP Microsoft sign-in to the browser that began it | 10 minutes |
__Host-maatriks-console-oidc | Bind Console Microsoft sign-in to its starting browser | 10 minutes |
__Host-maatriks-console | Maintain an authorized Console session | Eight hours; server-side access checks can end it sooner |
These are authentication and security functions, not advertising cookies. The browser sends them only to the Maatriks host according to their cookie rules; they are not made available to page scripts. Signing out ends the relevant session. Blocking required cookies can prevent sign-in. Microsoft may use its own cookies on its sign-in pages, subject to its own privacy information.
10. Your choices and rights
If your organization controls the processing, contact its administrator or privacy contact about access, correction, deletion, restriction, or other requests. Riverin OÜ will assist the organization according to the applicable data processing agreement. You may also contact us, and we will determine which party should handle the request.
Where the GDPR applies, rights can include access, correction, erasure, restriction, portability, objection to certain processing, and withdrawal of consent where processing relies on it. The availability of a right depends on its legal conditions; withdrawal does not make earlier lawful processing unlawful. We may need proportionate information to confirm your identity before releasing or changing personal data.
You may complain to a competent supervisory authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). This does not prevent you from approaching another supervisory authority available to you under applicable law.
The current Console does not provide self-service account erasure or a general personal data export. Disabling an account or signing out is not the same as exercising an erasure request. Contact the responsible organization or Riverin OÜ for such requests.
11. Automated decisions, audience, and updates
Maatriks applies automatic checks to enforce configured identity, grants, blocked-request rules, and limits. Administrators choose access; the service does not contain an employee scoring or employment-decision feature. Customers remain responsible for how they use generated output in their own decisions and for any additional legal requirements.
Maatriks is intended for organizational use with work identities. It does not offer a consumer or child signup journey.
We will update this policy when the processing it describes changes and show the effective date of the version in force. Material new processing will be explained before it begins where required. Questions can be sent to Riverin OÜ at info@maatriks.ai.