Privacy Policy

Last updated: 08/07/2026

1. Who we are

Matchen ("we", "us", "our") operates the Matchen website and kitchen planning platform. This Privacy Policy explains how we collect, use, store and share personal data when you use our services.

For privacy enquiries, contact: info@matchen.co.uk

2. Personal data we collect

Depending on how you use the platform, we may collect:

Account details: email address, password (stored in hashed form), name, phone number, address, postcode, and approximate location coordinates derived from your postcode.
Kitchen preferences: style choices, budget range, timeline, wishlist features, and your three non-negotiable requirements.
Design data: room dimensions, layout, unit selections, finishes, worktops, and related planner content you create in the tool.
Specialist matching data: if you consent on step 5 of the planner, we store your enquiry notes, design summary, preferences snapshot, and which retailers were matched to your project.
Render usage: render session identifiers, credit balances, and design inputs (including any room photos you upload) sent to generate AI visualisations.
Saved visuals & reports:the AI kitchen images you generate are stored on your account so you can view and download them later, together with any personalised Design & Budget Report you create.
Purchase records:a record of the visual credit packs and Project Starter Packs you buy — amount, date, and a payment reference. We never see or store your full card number; payments are handled by Stripe (see “Third-party services” below).
Retailer enquiries: if you apply to join our retailer network, business contact details, showroom information, and the kitchen features you declare you can deliver.
Technical data: session cookies, browser type, and basic usage data needed to operate and secure the service.

3. How we use your data

We use personal data to:

Create and manage your account and keep you signed in.
Save your kitchen design and apply your stated preferences in the planner.
Match you with up to three approved local retailers based on your wishes, non-negotiables, and location.
Share your project enquiry with those matched retailers only when you give explicit consent.
Provide AI render features and process optional paid render purchases.
Respond to retailer partnership applications and administer our retailer directory.
Improve platform reliability, prevent abuse, and comply with legal obligations.

4. Specialist matching and retailer sharing

When you submit the specialist matching form, you are asked to consent before any project details are shared. If you consent:

Your contact details, kitchen design summary, preferences, and non-negotiables are shared only with the three retailers matched to your project by our matching system.
Other retailers shown in the public nearby directory within 10 miles of your postcode do not receive your contact details or design data.
Matching is based on overlap between your wishlist and each retailer's declared capabilities, coverage of your non-negotiables, location, and listing tier.

You can update your preferences at any time from your account. Updating preferences does not automatically withdraw consent for enquiries already shared with matched retailers.

5. Cookies and similar technologies

We use cookies and similar storage for essential platform functions, including:

Session cookies to keep you signed in (kp_user_session).
Onboarding status to confirm account setup is complete (kp_onboarding).
Render session cookies to manage free and purchased render credits.
Session storage for short-lived planner navigation state during your browser session.

We do not use non-essential marketing cookies on the core planner experience described in this policy. If we introduce analytics or advertising cookies in future, we will update this policy and, where required, request consent.

6. Legal bases (UK GDPR)

We process personal data under one or more of the following legal bases:

Contract: to provide the planner, account, and render services you request.
Consent: for specialist matching and sharing your enquiry with matched retailers.
Legitimate interests: to operate, secure, and improve the platform, prevent fraud, and manage retailer listings — balanced against your rights.
Legal obligation: where we must retain or disclose data to comply with applicable law.

7. Third-party services

We use a small number of trusted providers (“sub-processors”) to deliver parts of the service. Each processes data only as needed to perform its function, under its own privacy terms:

Stripe — payment processing for credit packs and Project Starter Packs. Stripe is a PCI-DSS Level 1 certified provider; your card details are entered directly with Stripe and never reach or pass through our servers.
Replicate — runs the AI image model that generates your kitchen visuals from your design inputs and uploaded room photos.
Resend — sends transactional account emails (verification, password reset, receipts, and report-ready notifications).
Netlify — hosts the platform and stores your account data and saved visuals in encrypted storage.
postcodes.io — converts UK postcodes into approximate coordinates and area data for budget estimates and specialist matching.
Plausible (where enabled) — privacy-friendly, cookieless analytics that measures aggregate usage without cookies and without tracking or profiling individuals across sites.

We do not sell your personal data, and we do not use it to train third-party AI models.

International transfers. Some of these providers are based outside the UK (for example in the United States). Where personal data is transferred internationally, it is protected by appropriate safeguards — such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or a recognised adequacy decision.

8. Data retention

We keep personal data for as long as your account is active and as needed to provide the service, fulfil specialist matching, and resolve disputes. Records we are legally required to keep — such as transaction records for accounting and tax — are retained for as long as the law requires (generally up to six years). Enquiry records shared with matched retailers may be retained by those retailers under their own privacy policies once shared.

Deleting your data. You can ask us to delete your account at any time by emailing info@matchen.co.uk from your account email address. We will delete your account, saved designs, and generated visuals, normally within 30 days, except for any records we must retain for the legal reasons above. Deletion is permanent and cannot be undone.

9. Your rights

Under UK data protection law, you may have the right to access, rectify, erase, restrict, or object to certain processing of your personal data, and to data portability where applicable. You may also withdraw consent at any time where processing is consent-based, without affecting prior lawful processing.

To exercise your rights, email info@matchen.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security and children

We apply technical and organisational measures designed to protect your personal data, including:

Encryption in transit: all traffic to and from the platform is served over HTTPS/TLS, with HTTP Strict Transport Security enforced.
Password protection: passwords are stored only as a salted, one-way hash. We never store, display, or email your password in plain text — and nor should anyone ask you for it.
Payment isolation: card details are handled entirely by Stripe and never reach our servers, so we never hold your card number.
Secure sessions: sign-in uses signed, time-limited session cookies that are HttpOnly and Secure, and access controls ensure you can only reach your own account data.
Abuse protection: sign-in and password-reset are rate-limited to defend against automated guessing, and the site sets security headers (including a Content Security Policy) to mitigate common web attacks.
Data minimisation: we collect only what the service needs, and limit who and what can access stored data.

No online service can guarantee absolute security, so please use a strong, unique password, keep it confidential, and contact us promptly if you suspect any unauthorised access to your account.

Matchen is not intended for children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will change when we do. Material changes will be highlighted on the website where appropriate.