This Privacy Policy explains how The Matterworks LLC (“Grip,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the Grip software platform, websites, and related services (the “Platform”). It applies to the agencies, studios, and production companies that use the Platform (“Customers”) and to the individuals whose information is processed through it.
Grip is a business-to-business tool. We are a software provider — not a bank, money transmitter, escrow agent, or custodian of funds. Movement of money is performed by Stripe under your direction and your agreement with Stripe. This Policy should be read together with our Terms of Service.
1. Data-Minimization by Design
Grip is built to handle as little sensitive financial and identity data as possible. In particular:
- No raw financial credentials.We do not ask for, and do not store, your or your Payees’ bank account numbers, routing numbers, full payment card numbers, or Stripe secret keys. Those are collected and held by Stripe.
- Tokenized identity. Sensitive tax and identity information (such as SSNs and EINs) used for payouts and tax forms is submitted to and vaulted by Stripe. Where this information is entered through a Grip interface, it is transmitted to Stripe for tokenization rather than retained by us in raw form.
- Reference handles, not secrets. What we retain is generally limited to non-sensitive references — for example, a Stripe connected-account identifier (
acct_…) — that let the Platform coordinate with Stripe without holding the underlying credentials.
This design reduces, but does not eliminate, the data we process. The sections below describe what we do collect.
2. Information We Collect
2.1 Information You Provide.
- Account & profile data: name, work email, password or magic-link credentials, company/agency name, role, and team membership.
- Project & financial-structure data: budgets, quotes, line items, allocation/waterfall logic, AICP codes, rates, overtime, and reimbursements — all stored as integer cents.
- Payee data you submit: the names, contact details, roles, and payout allocations of the crew, vendors, and contractors you designate. You are responsible for having a lawful basis and any necessary consents to share this with us and with Stripe.
- Communications: messages you send to support and related correspondence.
2.2 Information Collected Automatically.
- Usage & device data: log data, IP address, browser/device type, pages viewed, and actions taken, used to operate and secure the Platform.
- Cookies & similar technologies: session and preference cookies necessary to authenticate you and run the service. See Section 8.
- Error & performance telemetry: diagnostic data (e.g., via our error-monitoring provider) to detect and fix issues.
2.3 Information From Third Parties.
We receive limited information from integrated services — for example, connected-account status, transfer/payout events, and reconciliation metadata from Stripe via webhooks, and accounting-sync metadata from general-ledger integrations you enable.
3. How We Use Information
- To provide, operate, secure, and maintain the Platform.
- To calculate allocations and waterfalls and to format and transmit Payout Instructions to Stripe at your direction.
- To authenticate users, manage teams and roles, and enforce access controls.
- To communicate transactional and operational messages (e.g., magic links, payout and webhook notifications) via email and SMS providers.
- To monitor, debug, and improve the Platform, including aggregated and de-identified analytics that do not identify any individual.
- To comply with legal obligations and to enforce our Terms and protect against fraud, abuse, and security risks.
4. Legal Bases for Processing
Where applicable law (such as the GDPR or UK GDPR) requires a legal basis, we rely on: performance of a contract (to provide the Platform); our legitimate interests (to secure, operate, and improve the service); compliance with legal obligations; and consent where required (for example, certain cookies or communications). For Payee personal data that the Customer uploads, the Customer is the controller and Grip acts as a processor on the Customer’s instructions.
5. How We Share Information
We do not sell personal information. We share information only:
- With Stripe, to set up connected accounts, tokenize identity data, and execute the payouts you direct.
- With service providers (subprocessors) who process data on our behalf under contract — for example, hosting and database infrastructure, error monitoring, and transactional email/SMS delivery — solely to provide the Platform.
- Within your organization, with other authorized users of your team, according to the roles and permissions you configure.
- For legal reasons, to comply with law, respond to lawful requests, enforce our agreements, or protect the rights, safety, and security of Grip, our users, or the public.
- In a business transfer, in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
6. Stripe and Other Third-Party Services
Funds, payment credentials, and vaulted identity data are handled by Stripe under Stripe’s own agreements and privacy policy. Other services you connect (e.g., accounting or e-signature integrations) are governed by their own terms and privacy policies. We are not responsible for the privacy practices of third parties, and we encourage you to review them.
7. Data Retention
We retain information for as long as your account is active and as needed to provide the Platform, then for the period necessary to comply with legal, tax, accounting, and reporting obligations, resolve disputes, and enforce our agreements. We may retain aggregated or de-identified data indefinitely. You may request deletion as described in Section 9; some records may be retained where required by law. [Insert specific retention periods as finalized.]
8. Cookies and Tracking
We use cookies and similar technologies that are strictly necessary to authenticate sessions and operate the Platform, and limited analytics to understand usage. You can control non-essential cookies through your browser settings or any consent controls we provide. Disabling necessary cookies may prevent the Platform from functioning.
9. Your Rights and Choices
Depending on your jurisdiction (e.g., under the GDPR/UK GDPR or U.S. state privacy laws such as the CCPA/CPRA), you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object to certain processing or withdraw consent. To exercise these rights, contact us at legal@thematterworks.com. We will respond as required by applicable law. Where Gripprocesses Payee data on a Customer’s behalf, we will refer requests to the relevant Customer (controller) and assist as required.
10. Security
We use administrative, technical, and organizational measures designed to protect information, including encryption in transit, access controls, and tenant isolation enforced at the database layer. By routing payment credentials and identity data to Stripe, we reduce the amount of sensitive data in our own systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. International Data Transfers
We and our service providers may process information in the United States and other countries. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers of personal data.
12. Children’s Privacy
The Platform is a B2B service not directed to children and is not intended for anyone under the age of majority. We do not knowingly collect personal information from children.
13. Changes to This Policy
We may update this Policy from time to time. We will post the updated version and revise the “Last updated” date, and provide notice of material changes via email or in-app notification. Your continued use of the Platform after the effective date constitutes acceptance.
14. Contact Us
Questions or requests regarding this Policy or your information can be directed to:
The Matterworks LLC · [Insert Business Address]. legal@thematterworks.com.