PRIVACY POLICY

How we handle your data

Last updated 21 October 2026

Who we are

matrixai.group is run by MATRIX AI PTE. LTD. (UEN 202613629H), 116 Middle Road, #09-01, ICB Enterprise House, Singapore 188972 ("we", "us"). We handle personal data under Singapore's Personal Data Protection Act 2012 (PDPA). For any question or request about your personal data, contact our data protection officer, Dong, at hello@matrixai.group.

Matrix Tools (matrixai.group/tools)

The free online tools do their work in your web browser. Files, text and settings you give a tool stay on your device: the tool pages make no upload requests, and their security policy does not let them send data to other websites. There is no account and no sign-in for the tools.

A few tools keep information in your own browser, never on our servers:

• The Quote and Invoice Maker saves your draft in your browser only if you tick its option to keep it; unticking it removes the saved copy.
• Budget Import keeps your monthly targets (month, currency, category and amount) in your browser only if you tick its option to keep them; unticking it removes them. Your statements, their rows and your account names are never kept.
• The tools page keeps the tools you star as favourites and, only if you tick its option to remember them, the tools you open, in your browser's local storage. Unstarring a tool or unticking the option removes them, and they are never sent to us.
• If you choose Light or Dark as the theme of the tools pages, that choice is kept in your browser's local storage so the next page opens in it. Choosing System removes it, and it is never sent to us.
• If you choose a language for the tools pages other than your browser's own, that choice is kept in your browser's local storage so the next page opens in it; choosing your browser's language again removes it, and it is never sent to us.
• Tools record simple usage steps (such as "started" or "succeeded", with the tool's name, the time, the number of files and, for a failure, an error code; never file names or contents) in your browser tab's session storage. At most the latest 200 steps are kept, for that tab only, until it is closed, and they are not sent to us. If you send us a problem report from a page that offers it, you can choose to attach those steps; we receive them only when you tick the box, and never file names or contents.
• Text to Speech offers only the voices your browser runs on your device, because online voices would send your text to their provider.

The tools' API (for developers)

Developers can run the same tools on our server through our API, with an API key (see the tools' API guide). What you send for a run, the tool's settings and your files, is processed on our server in a separate process that has no network access and ends with the run. Files sent inside a request are held in memory for the run only and are not stored. The files a tool makes are sent back to you in the answer and are not kept. We do not open or read your files for any other purpose, and our logs do not record them or their names. For each call we keep the usage record described under "Developer keys and AI connections" below. It never holds your files or their names. Encrypt a file, Decrypt a file and the CSR Generator are not offered on the API, so their passphrase or private key never leaves your device.

The same tools also run in ChatGPT and Claude once you connect them to your Matrix account. A tool that works on your files opens the Matrix panel in the chat: the files you choose there go from your device to our server for that run only, and the result comes back to the panel for you to download. We keep neither your files nor the result. Until you run it, we hold a one-time ticket for up to 15 minutes that names the tool and holds no file and no copy of your settings. The assistant is told what the run made (a summary, the names and sizes of the files, and data such as a form's field names when you asked for it), not the files themselves.

This website and the contact form

The enquiry form on our app development page does not send anything to our servers. It prepares an email in your own email app, which you review and send yourself, or a text file you can download. If you email us, we receive your email address and what you write, and we use it to reply to you.

Our website is served by Cloudflare, which processes the technical data needed to deliver pages and protect the site from attacks (such as your IP address and browser type).

Accounts, Matrix Transfer and other signed-in services

When you create an account (for example to send files with Matrix Transfer), we collect and use:

• Account details: your email address, the name you choose, and when you signed up and were last active. Your password is handled by our sign-in service and stored only in hashed form.
• Transfers you send: the files you upload, and the title, message, file names, sizes and download times of each Transfer. If you set a password on a Transfer, we store only a hash of it. We scan uploaded files for viruses; we do not otherwise open or read them. Recipients need no account and we do not ask for their details.
• Workspaces: the email addresses you invite and their roles.
• Payments: if you buy a plan, our payment provider Airwallex receives your name and email address and processes your card on its own checkout page. Your card details never reach our servers; we keep the subscription status and the provider's records of it.
• Developer keys and AI connections: if you create an API key or connect an AI assistant, we keep a hash of the key and a record of each use (action, result and size), and the connection you approved.
• Server logs: our servers log each request (its time, type and address, with passwords, keys and link tokens removed) to run the service and investigate problems. These logs do not record your IP address. Wrong-password attempts on a Transfer are counted against a one-way hash of your IP address, not the address itself.

Cookies

We use only the cookies needed for signing in. Pages that do not need an account, including the home page and all Matrix Tools, set no cookies.

• matrix_session keeps you signed in: it ends after 14 days without use and after 30 days at most.
• matrix_login protects the sign-in step and lasts 10 minutes.
• Our sign-in service at auth.matrixai.group and the screen where you approve an AI connection set their own sign-in cookies.

Who else processes your data

We use these service providers, only for the purposes described here:

• Cloudflare: website delivery, file storage for Transfers and backups (in its Asia-Pacific region), and routing of email sent to matrixai.group addresses.
• Resend: sending account and invitation emails.
• Airwallex: payments for paid plans.
• Zoho Mail: the mailbox where we read email sent to us.
• OpenAI or Anthropic: only if you connect ChatGPT or Claude to your account; the assistant then receives the results of the actions you ask it to take. If you download a result from the Matrix panel in ChatGPT, ChatGPT saves it among your ChatGPT files.

Some of these providers process data outside Singapore. Where they do, we rely on their contractual commitments to protect it to a standard comparable to the PDPA. We do not sell or rent personal data, and we do not share it for advertising.

How long we keep it

• Transferred files are deleted when their link expires (within the hour) or when you revoke the Transfer. Unfinished uploads are deleted after 2 days.
• Transfer records (title, message, file names, sizes and download times) and your account details are kept while you have an account.
• Files sent to the tools' API are not kept beyond their run.
• Workspace invitations expire after 7 days.
• API key usage records are kept for 90 days. An AI connection lasts 90 days from your approval, and its usage records for 90 days.
• Database backups are kept for 30 days.
• Server logs are deleted automatically within 30 days.

Your choices and rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, withdraw your consent, or ask us to delete your account and its data, by emailing hello@matrixai.group. We may need to confirm your identity first, and we will reply within 30 days. After deletion, your data leaves our backups as they expire (within 30 days). If you are not satisfied with our reply, you may contact Singapore's Personal Data Protection Commission.

Security

We protect data with encrypted connections, private storage, access only through short-lived signed links, hashed passwords and keys, and virus scanning of transferred files. No system is completely secure; if a data breach affects you, we will notify you and the authorities as the PDPA requires.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change affects how we use data you have already given us, we will tell account holders by email before it takes effect.