Privacy Policy

MaatX is an engineering company working across AI systems, blockchain infrastructure and software products. We operate this website at maatx.xyz.

For anything in this policy — including requests to access or delete your data, or to stop receiving outreach — contact us at business.maatx@gmail.com. A person reads every message sent to that address.

MaatX is the controller of the personal data described below. Where this policy refers to “we”, “us” or “our”, it means MaatX.

This policy covers three distinct sets of data, which we keep separate because they are collected differently and for different reasons:

• Website analytics — aggregate, non-identifying measurements of how pages on this site are used.
• Enquiries you send us — what you type into our contact form, or email us directly.
• Business contact information of companies we research for business-to-business sales outreach. This is the only category where we hold data about someone who has not contacted us first, and it is described in full under Business contact information below.

It does not cover data processed under a signed client engagement. Where we handle a client’s data as part of delivering work, that is governed by the agreement for that engagement, in which we act as a processor on the client’s instructions rather than as a controller.

We use Vercel Web Analytics to count page views and referrers. It is cookieless and does not use a cross-site identifier, a device fingerprint, or anything that would let us recognise you on a return visit or across another website. We cannot identify you from it, and we do not attempt to.

Because it sets no cookies and stores nothing on your device for this purpose, there is no consent banner on this site. We collect it to answer one operational question — which pages are actually read — and nothing more.

One thing we do store on your device. When you first arrive, the site writes a single entry to your browser’s `sessionStorage` under the key `maatx:source`. It records which link brought you here — campaign tags from the URL, or the name of the referring website — so that if you later send us an enquiry, we can tell which channel it came from. It contains no identifier for you, it is readable only by this site, and your browser discards it when you close the tab.

This site sets no cookies. None for advertising, none for analytics, none for sign-in — there is nothing here to accept or reject, which is why you have not been asked to dismiss a consent banner.

The only thing we place on your device is the single `sessionStorage` entry described above: `maatx:source`, which records the link that brought you here so an enquiry can be attributed to a channel. It holds no identifier for you, only this site can read it, and your browser discards it when you close the tab.

You can clear it at any time through your browser’s site-data settings, and blocking storage for this site does not stop any part of it working.

We use no advertising pixels, conversion trackers, session recording, heatmaps or third-party tag managers. Because we do not track you across websites, there is nothing for a Do Not Track or Global Privacy Control signal to switch off — what those signals ask for is already how this site behaves.

If you use the contact form, we receive the fields you complete. These are:

• Name and work email address — both required, so that we can reply.
• Company — optional.
• What you are building, current stage and timeline — selected from a list.
• Project description — required free text, and an optional message field.
• Referral source — the `maatx:source` value described under Cookies and similar technologies, submitted with the form.

The form applies automated spam filtering before anything reaches us. Submissions it identifies as automated are discarded and nothing about them is stored. This filtering collects no additional information about you.

We use this to reply to you, to understand what you are asking for, and to keep a record of the conversation if it becomes a client engagement. We do not add enquirers to a marketing list, and we do not use what you tell us about your project for anything other than answering it.

We carry out business-to-business outreach. To do that we research companies that we think may need the work we do, and we record a small amount of information about them. This section describes that in full, because it is data we hold about people who have not contacted us.

What we record, per company:

• Company name and website domain.
• A business email address the company has published for contact purposes.
• A publicly listed role or job title, where the company itself publishes who holds it.
• A short note on why we thought the company was relevant — for example that it had advertised for an engineer with skills we provide.

Where it comes from. Two kinds of source, both public:

• Public company websites — contact, about and careers pages the company publishes itself.
• Public startup and company directories, and public job postings.

We do not buy contact lists, we do not use scraping tools against platforms whose terms prohibit it, and we do not attempt to find personal email addresses, personal phone numbers, home addresses or any information about you outside your professional role. We do not build profiles, infer anything about you, or enrich these records from other datasets.

If you are reading this because we contacted you, How to stop us contacting you below tells you how, and we would rather you used it than ignored us. One reply is enough.

Under the UK GDPR and the EU GDPR, we rely on two legal bases:

Enquiries

Article 6(1)(b) — taking steps at your request before entering into a contract. Where an enquiry does not lead to an engagement, our continued handling of it rests on Article 6(1)(f), legitimate interests, in keeping a record of who we spoke to and what was said.

B2B outreach

Article 6(1)(f) — legitimate interests. Our interest is in finding clients for a small business. We have assessed this against the interests of the people contacted, and we consider it proportionate because the data is limited to the professional sphere, is obtained from sources the company itself published, is not combined with anything else, and is deleted on request without question.

Analytics

Article 6(1)(f) — legitimate interests in understanding which parts of our own website are used. The measurement is not capable of identifying you.

Legitimate interests is a balance, not a blank cheque, and you are entitled to object to it. If you do, we stop — see Your rights.

India. The Digital Personal Data Protection Act, 2023 applies to our processing of personal data. Its implementing Rules were notified in November 2025 and its substantive obligations are being phased in through May 2027. We are treating that date as our compliance deadline and are building toward it rather than waiting for it. Where the DPDP Act requires notice and consent for a processing activity, we will obtain it on the terms the Act requires.

Where we send marketing email, we also observe the local rules on unsolicited commercial messages in the recipient’s country, which in some jurisdictions are stricter than the data protection position described above.

We do not sell personal data, and we never will. We do not share it for advertising, we do not trade or rent contact lists, and we do not pass it to data brokers.

We share data only with the service providers we need to run the business. These are the only ones, named:

Vercel Inc.

Hosts this website and provides the analytics described under Website analytics. Receives the technical data any web server receives, including your IP address, in order to serve the page to you.

Web3Forms

Relays contact form submissions from your browser to us by email.

Resend Inc.

Delivers contact form submissions to our inbox, and sends our transactional email.

Google LLC

Provides the Gmail mailbox at which we receive and store email, including enquiries and replies to our outreach.

We may also disclose data where we are legally required to, for example in response to a valid order from a court or regulator. If that happens we will tell you unless we are prohibited from doing so.

International transfers. These providers operate infrastructure outside India, the UK and the EEA, including in the United States. Where personal data protected by the UK or EU GDPR is transferred, we rely on the transfer mechanisms our providers make available, such as the European Commission’s Standard Contractual Clauses and the UK Addendum. You can ask us for details of the arrangement that applies to you.

Enquiries

24 months from our last exchange with you, then deleted. Where an enquiry becomes a client engagement, the record is kept for the duration of that engagement and for as long afterwards as we are required to retain business records.

Prospect records

12 months from collection. If we have had no reply and no engagement by then, the record is deleted rather than recycled into a later campaign.

Suppression list

Kept indefinitely, and deliberately. If you ask not to be contacted, we must keep enough information — your email address and the fact that you objected — to make sure we do not contact you again. Deleting that would cause the very thing you asked us to prevent. It is used for nothing else.

Analytics

Retained in aggregate by our analytics provider. It contains no identifier for you, so it cannot be traced back to an individual or deleted per person.

Email is the one place these periods are hardest to guarantee, because a thread can be quoted inside a later message. Where that happens we delete what we can identify and tell you honestly what remains.

Subject to the law that applies to you, you can ask us to do any of the following. We will respond within 30 days.

• Access — get a copy of the personal data we hold about you, and be told where we got it.
• Correction — have inaccurate or incomplete data corrected. For prospect records this is often the fastest fix: tell us the right contact and we will update it or remove the record.
• Deletion — have your data erased. For a prospect record we will do this on request, without asking why.
• Objection — object to processing based on legitimate interests, including all marketing and outreach. Where you object to marketing, we stop; there is no balancing test for us to apply.
• Restriction and portability — where the GDPR grants them.
• Withdraw consent — where we relied on consent, withdraw it at any time, without affecting anything done before you did.

Under India’s DPDP Act, 2023 you additionally have the right to nominate another person to exercise these rights on your behalf, and the right to a grievance redressal process. Write to the address in Who we are and we will handle it as a grievance.

You do not have to pay to exercise any of these rights, and you do not have to explain why.

We do not make decisions about you by automated means. No decision that produces legal effects for you, or that otherwise significantly affects you, is made solely by automated processing, and we do not profile you.

Our prospect research is a person reading a company’s published pages and deciding whether it is worth writing to them. We do not score individuals, rank them by predicted behaviour, or use a model to decide who gets contacted.

Reply and say so. That is all it takes. You do not need to use particular wording, quote this policy, or write to a specific address — a reply to the person who emailed you is enough.

When you do, two things happen: we stop, and we add your address to a suppression list so that a later campaign cannot reach you by accident. We treat an unsubscribe request, a reply asking us not to contact you, and a formal objection under data protection law as the same instruction, because there is no useful difference between them.

If you would rather not reply to the sender, email business.maatx@gmail.com with the address you want suppressed.

If we do contact you again after you have asked us not to, that is a failure on our side. Tell us and we will find out why.

This site is served over HTTPS only. Access to the mailbox and the systems holding enquiry and prospect data is restricted to the people who need it and protected by multi-factor authentication.

We keep the amount of personal data we hold deliberately small, because the most reliable protection for data is not to be holding it. We do not store payment card details at any point.

No system is perfectly secure. If a breach affects your personal data and the law requires us to tell you, we will, within the time the applicable law allows and without waiting to be asked.

This site links to other websites — our own social profiles, public repositories, and sources we cite. Those sites set their own cookies and keep their own privacy practices, and we are not responsible for them. This policy covers only what we do.

This is a business-to-business website and our services are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

If we change how we handle personal data, we will update this page and change the date at the top. Where a change materially affects your rights, we will say what changed rather than quietly reissuing the document.

If you are unhappy with how we have handled your data, please tell us first at business.maatx@gmail.com — most problems are faster to fix directly.

You also have the right to complain to a regulator, and you can do that without contacting us at all:

• India — the Data Protection Board of India, once it is operational under the DPDP Act, 2023.
• United Kingdom — the Information Commissioner’s Office, at ico.org.uk.
• European Economic Area — the supervisory authority in the country where you live or work.