Mately
← Back to home

Privacy Policy

Last updated 14 August 2026

This policy explains how Mately Limited ("Mately", "we") handles personal data when you use the Mately app and website. For staff data that a business enters about its team, the business is the data controller and Mately is the processor — see our Data Processing Addendum.

1. What we collect

  • Account data — your name, email, password (hashed), and business details.
  • Your own profile — anything you choose to add: a profile photo, a contact phone number, an emergency contact’s name and number, and your birthday (day and month only — never the year). All optional, and you can clear them at any time. If you add an emergency contact you are giving us someone else’s details, so please tell them.
  • Team data your business enters — staff names, emails, job titles, roles and reporting lines, pay rates and salaries, contracted hours and usual working pattern, employment start dates, payroll references, worked time, leave (including sickness absence, which your employer can see reported over time), documents, and chat messages — including any photos, videos and voice notes shared in chat.
  • Payment data — handled by Stripe; we never see or store your card number. We store a customer/subscription reference, your billing status, the trial and renewal dates, and a card fingerprint from Stripe — a code identifying a card without revealing its number. We keep the fingerprint to stop the same card starting repeated free trials, and for that reason alone it is deliberately kept after an account is deleted. It cannot be turned back into a card number.
  • Technical data — log and diagnostic data needed to run the service securely (e.g. IP address for rate-limiting; the IP address and browser/device information recorded when you create a business account, to detect and prevent bot sign-ups and abuse; device tokens for push notifications).
  • Clock-in presence checks — if your employer switches them on, the app checks at the moment you clock in whether you are connected to the workplace Wi-Fi, or within a set distance of the workplace. Your device sends the Wi-Fi network identifier and/or your position, we compare it against the workplace’s own settings, and we then discard it. We do not store your location or the network you were on, and we do not track you during your shift or at any other time. What is recorded is only that a clock-in happened, and when.

2. Why we use it and our lawful basis

  • To provide the service (performance of a contract).
  • To keep it secure and prevent abuse (legitimate interests).
  • To take payment (performance of a contract).
  • To meet legal obligations (e.g. tax records).

Presence checks at clock-in. Where a business turns them on, Mately verifies at the moment of a clock-in that the person is on the workplace Wi-Fi, or within a distance of the workplace that the business sets. The check runs only when someone actively taps to clock in, only while the app is open in front of them, and the Wi-Fi identifier and position it uses are compared once and then discarded. They are not written to our database, not shown to the employer, and not used to build any record of where anyone has been. There is no background or continuous location tracking in Mately, and there never has been. These checks are off by default and a business can turn them off again at any time. Our lawful basis is the performance of the employment contract between a business and its staff, and the business’s legitimate interests (Article 6(1)(f) UK GDPR) in keeping accurate attendance records; the business is the controller for this and Mately is the processor.

Security and fraud-prevention logging. When you create a business account with us, we automatically record the IP address and browser/device information (user agent) your sign-up came from. We use this only to protect our service — to detect and prevent automated ("bot") sign-ups, fraud and abuse, and to keep our systems secure. It is visible only to our operator and is not used for advertising or profiling. Our lawful basis is our legitimate interests (Article 6(1)(f) UK GDPR) in keeping Mately secure and preventing misuse. We keep these records for up to 90 days, after which they are automatically deleted. We do not share this information with third parties, except our hosting and infrastructure providers acting on our instructions, or where the law requires disclosure. You have the right to object to this processing, and rights of access, erasure and rectification — contact support@mately.co.uk — and you can complain to the Information Commissioner's Office (ico.org.uk).

3. Who we share it with (sub-processors)

We use a small number of trusted providers to run Mately:

  • Render — hosting and database (EU region).
  • Stripe — payment processing.
  • Resend — transactional email (invites, verification, resets).
  • Google Firebase (FCM) — mobile push notifications.
  • Cloudflare — file storage and network protection (where enabled).
  • Sentry — error monitoring, so we find out when something breaks for you before you have to tell us. It receives the technical details of a fault: what went wrong, where in the app, and the account id of whoever hit it. Email addresses, passwords and login tokens are stripped out before anything is sent, and it is never used to watch what people do in the app.

We do not sell personal data.

4. How long we keep it

We keep your data while your account is active. If a subscription ends, data is retained for 30 days and then permanently deleted, so a business can export its records first (employers have their own payroll and working-time record duties). You can request earlier deletion.

Media shared in team chat (photos, videos and voice notes) is automatically deleted 90 days after upload to keep storage lean; the message itself remains, marked as expired. Documents (contracts, signed policies and other files in the Documents area) are never auto-deleted.

Security logs — the IP address and browser/device information recorded when a business account is created (see section 2) — are kept for up to 90 days after sign-up, then automatically deleted.

Clock-in presence checks are not retained at all. The Wi-Fi identifier and position used to confirm someone is at work are compared at the moment of the punch and immediately discarded; there is no retention period because nothing is kept. The time record itself — that a person clocked in and out, and when — is part of your business’s data and is kept as described above.

Reported messages.If someone reports a message in team chat, we keep a record of the report — a copy of the reported message, who wrote it, who reported it, and what your business decided — so the complaint survives the message being deleted, which is usually what happens when a report is upheld. Closed reports are kept for 12 months and then deleted.

5. When someone reports a message

Anyone can report a message in team chat, in the phone app or on a computer. It matters who sees what afterwards, so this is set out in full.

Your employer sees the report. The owners and managers of your business receive the message, who wrote it and your name as the person reporting it— you are told that before you confirm. They decide what happens next, because an employer is the only party that can act on its own staff. A manager is never sent, and can never open, a report about themselves.

Mately is told far less.We receive only the fact that a report exists, which business it belongs to, when it was made and whether it has been dealt with. We do not receive the message, your name, or the name of the person reported. We can act on a business’s account on that alone, and because we can, we do not ask for more.

Mately only reads the message if you send it to us. If nothing is done about your report, email support@mately.co.uk— that is the route today, and nothing sends your message to us automatically.

One thing does happen automatically, and you should know what it is.If the person you reported is the only owner or manager at your workplace, there is nobody there who could review it without it being about themselves. In that case we are notified straight away that a report needs attention — which business it is and when, and nothing else. Not the message, not your name, not theirs. That is enough for us to act on the account if we have to, and because it is enough, we do not ask for more. If you want us to see what was actually said, you have to send it to us. When you do send it, we are acting as a controller of that information in our own right rather than on your employer’s instructions, on the basis of our legitimate interest in keeping Mately safe to use and in meeting the app stores’ requirements. You can object to that processing at any time.

The person reported is not told by Mately.Whether and when to raise it with them is their employer’s decision, as part of its own process. We do not put ourselves in the middle of it.

6. Your rights

You have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Mately provides a one-click data export. If your data was entered by an employer using Mately, contact that employer (the controller) first; we will help them respond.

7. Security

Passwords are hashed with Argon2id, traffic is encrypted in transit (HTTPS/HSTS), two-factor authentication is available, access is scoped per business, and sensitive admin actions are audit-logged.

8. Cookies

We use a single essential cookie to keep you signed in. We don't use advertising or third-party tracking cookies.

9. International transfers

Data is hosted in the EU. Where a provider processes data outside the UK/EEA, we rely on appropriate safeguards such as the UK IDTA or Standard Contractual Clauses.

10. Contact

Questions or requests: support@mately.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO).