How MatterVine handles your information.

MatterVine is an artificial-intelligence-assisted intake and attorney-matching service for individuals in the United States who may have a personal-injury claim. The Service covers a range of personal-injury matters, including motor-vehicle accidents, slip-and-fall and premises-liability incidents, medical malpractice, dog bites, defective products, nursing-home neglect, and wrongful death. We help you describe your situation through a conversational intake, evaluate basic eligibility against publicly available verdict data, and connect you with one personal-injury attorney licensed in your state.

MatterVine is operated by MatterVine LLC, a Wyoming limited liability company. References to "we," "us," "our," "MatterVine," or "the Service" mean that entity and the website at mattervine.com.

MatterVine is not a law firm. Information you provide to us is not protected by the attorney-client privilege. We do not provide legal advice. The choice of an attorney is an important decision that should not be based solely on our matching service.

a) Information you provide

• Your first and last name, phone number, and email address.
• The full contents of your intake conversation, including descriptions of the accident, injuries, medical treatment, fault observations, witness information, insurance involvement, lost wages, and similar facts you choose to share.
• Sensitive information you choose to share, including but not limited to medical information, health status, current pain levels, mental health information, and physical disabilities.
• Communications you send to us (email replies, support requests).
• Your affirmative consent to be contacted (TCPA consent), the verbatim text of the consent prompt shown to you, the time you consented, and the IP address from which you consented.
• If you are an attorney accessing the portal at app.mattervine.com: your email address, IP address, browser user-agent string, the case page you were viewing, the date and time you verified your email, and whether you opted in to marketing communications. This information is collected when you submit your email on the portal sign-in page and is used to authenticate your session, prevent abuse, understand portal engagement, and (if you opted in) send you marketing emails about new cases and marketplace features.

b) Information collected automatically

• Internet Protocol (IP) address.
• Approximate geographic location (country, state, city) derived from your IP address.
• Device type, browser, and operating system.
• Pages you visit on the Service, time spent on each, the page that referred you to us, and search terms (if any) used to find us.
• Marketing campaign attribution parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) included in the URL that brought you to the Service.
• Advertising click-through identifiers, including the Google Ads click identifier (gclid) and the Meta click identifier (fbclid), when present in the URL that brought you to the Service.
• Advertising and analytics cookies set by Google and Meta when their pixel or tag fires on your browser, including the values used to measure ad conversions. The specific cookies are inventoried in Section 7.

c) Email-verification data

When you provide your email address during intake, we transmit it to a third-party email-verification provider (currently Kickbox, Inc.) to check whether the address is deliverable. We store the provider's result (such as "deliverable," "risky," or "undeliverable"), the reason code, and the time the check ran. This helps us avoid sending case overviews to addresses that will bounce.

d) Advertising conversion signals

In addition to client-side advertising cookies, we transmit "conversion" events to advertising platforms so that we can measure the effectiveness of our ads (currently Google Ads and Meta's Conversions API; TikTok's Events API is planned). These events include hashed identifiers — never your raw email or phone:

• Meta's Conversions API — server-to-server, we transmit a hashed (SHA-256) version of your email address, phone number, name, city, state, and country, together with your IP address, browser user agent, an internal session identifier, and the Meta click and browser cookie values where available.
• Google Ads Enhanced Conversions — we transmit a hashed (SHA-256) version of your email address and, once we have it, your phone number, at two milestones: when you confirm a deliverable email during intake, and on the results page after you complete an intake. These values are always hashed before they are sent to Google — we never transmit your email or phone to Google in unhashed form. For the completed-intake event the hashing happens on our server, so the raw values are never placed on the results page; for the email-confirmation event the address you just entered is hashed in your browser. If your browser sends a Global Privacy Control signal, we suppress these identifiers entirely (see Section 5).

We send these identifiers only when you reach a conversion milestone in our funnel (a validated email or a completed intake). We do not send the contents of your intake conversation, your case narrative, or the AI-generated assessments to any advertising platform.

e) AI-generated information about you

We use artificial intelligence (currently Anthropic, PBC's Claude family of models) to conduct your intake conversation, extract structured facts from what you tell us, generate a narrative summary, and produce eligibility and quality assessments. A separate AI pass (Anthropic's Claude Haiku) reviews the narrative summary for personal identifiers before it is displayed to the matched attorney in our portal. These AI-generated outputs become part of our records about you and are shared with the matched attorney.

Important: the AI does not predict the outcome of your specific case, does not give legal advice, and is not a substitute for evaluation by a licensed attorney.

f) Information we do NOT collect

We do not knowingly collect Social Security numbers, full dates of birth, financial account numbers (bank accounts, credit or debit card numbers), or driver's license numbers. Please do not provide this information. If you do, we will delete it without using or sharing it.

We use information about you to:

• Conduct your intake and evaluate basic eligibility.
• Match you with one personal injury attorney licensed in your state, and share the information described in Section 4 with them.
• Communicate with you about your intake, including by phone, SMS, and email, as authorized by your TCPA consent.
• Send you transactional emails such as your case overview.
• If you are an attorney who opted in to marketing communications on the portal sign-in page, send you promotional emails about new case inventory, marketplace features, and requests for feedback. You can unsubscribe at any time via the link in any such email.
• Operate, secure, maintain, debug, and improve the Service — including improving the accuracy of our intake AI, attorney matching, and verdict-data presentation.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.
• Detect, prevent, and respond to fraud, abuse, security incidents, and other technical issues.
• Conduct analytics about how the Service is used (in aggregate or pseudonymized form where possible).

a) With the attorney we match you with

The core of the Service is sharing your information with one personal injury attorney we match you with. This sharing includes: the full transcript of your intake; our AI-generated summary, fact extractions, and quality assessments; your contact information; and the fact and timing of your TCPA consent.

We receive consideration from attorneys for these matches. See Section 5 below — this means our model legally constitutes the "sale" or "sharing" of personal information under several state privacy laws.

b) With our service providers

We share information with third-party service providers that help us operate the Service. Each is bound by terms of service that describe how it may use the information we provide. These providers currently include:

• Anthropic, PBC — model inference for the intake conversation (Claude Sonnet) and for the narrative- sanitization pass (Claude Haiku). Anthropic processes inputs per its commercial data terms and does not use customer inputs to train its models by default.
• Supabase, Inc. — managed Postgres database and authentication infrastructure where lead and session data is stored.
• Cloudflare, Inc. — hosting, content delivery, edge compute, DNS, and bot-management. Cloudflare receives request metadata (IP, user agent, headers) inherent to serving the Service.
• Resend, Inc. — transactional email delivery, including the case-overview email to you and the case-file email to your matched attorney.
• Kickbox, Inc. — real-time email deliverability verification of the address you provide during intake.
• Stripe, Inc. — payment processing for the attorney side of the marketplace (when an attorney reserves your case). Stripe receives only attorney billing information and an internal case identifier; we do not transmit your name, email, phone, or case narrative to Stripe.
• Slack Technologies, LLC — internal operations channel used to notify our team in real time when a new lead, payment, or email event occurs. We send a short summary (vertical, location, tier, contact email/phone, session id) into a private team workspace.
• Google LLC — Google Ads conversion measurement via the Google tag (gtag.js) on our pages, including Enhanced Conversions, for which we provide a hashed (SHA-256) version of your email address and phone number (always hashed first; never sent in the clear) so Google can match a conversion to the ad you clicked. We also use Google Search Console, which receives only aggregated search-query and impression data, never your input, and Google Analytics if and when enabled.
• Meta Platforms, Inc. — measurement of our ad campaigns through Meta's server-side Conversions API. We send hashed (SHA-256) user identifiers plus the data items itemized in Section 2(d). We do not send your case narrative to Meta.

Planned providers. We expect to add TikTok Pte. Ltd. (TikTok's server-side Events API) for similar ad- measurement purposes. When we add it, the data sent will be of the same kind described in Section 2(d) for Meta. We may also add a voice or SMS provider (such as Twilio Inc.) in the future; when we do, we will update this Policy.

c) For legal and safety reasons

We may share information when we believe in good faith that disclosure is necessary to: comply with applicable law, regulation, or legal process; respond to lawful requests from public authorities; enforce our Terms of Service; protect the rights, property, or safety of MatterVine, our users, or the public; or detect, prevent, or address fraud or security issues.

d) In connection with a business transfer

If MatterVine is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will provide notice on the Service if such a transfer occurs.

e) With your consent

We may share information for other purposes with your explicit consent.

Several U.S. state privacy laws (including the California Consumer Privacy Act as amended by the CPRA, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, the Iowa Consumer Data Protection Act, the Tennessee Information Protection Act, the Indiana Consumer Data Protection Act, the Delaware Personal Data Privacy Act, the New Jersey Data Privacy Act, the New Hampshire Data Privacy Act, the Maryland Online Data Privacy Act, the Kentucky Consumer Data Protection Act, the Minnesota Consumer Data Privacy Act, and the Rhode Island Data Transparency and Privacy Protection Act) define the "sale" or "sharing" of personal information broadly. Two of our practices may fall within those definitions:

• Sharing with the matched attorney. Because we receive consideration from personal-injury attorneys in exchange for matching them with you, our transmission of your intake details and contact information to a matched attorney may constitute a "sale" or "sharing" of personal information under these laws.
• Sharing with advertising platforms. Because we transmit a hashed slice of your identifiers and certain device- level identifiers to advertising platforms (Google, Meta, and in the future TikTok) to measure ad effectiveness — as described in Section 2(d) — this practice may constitute "sharing" for cross-context behavioral advertising under the CCPA/CPRA and similar laws.

You have the right to opt out of both of these. To exercise this right:

• Email us at [email protected] with the subject line "Do Not Sell or Share." You can request to opt out of one or both flows (attorney-matching sharing, advertising-tech sharing) — please tell us which.
• Where technically feasible, we treat a Global Privacy Control (GPC) browser signal as an opt-out request for the advertising- technology flow. Because GPC is a browser-level signal, it cannot identify whether you have started, finished, or completed an intake; opting out of attorney-matching sharing requires the email request above.

Important: opting out of attorney-matching sharing before completing your intake means we will not match you with an attorney, since matching is the Service. If you have already been matched, opting out will prevent further sharing but cannot recall information already provided to the matched attorney; for that you may also need to contact the attorney directly. Opting out of advertising-technology sharing will not affect your ability to use the Service.

Sensitive personal information. Residents of California, Colorado, Connecticut, and several other states have the right to limit our use of sensitive personal information (which may include health information you provide in intake) to what is reasonably necessary to provide the Service. We do not use sensitive information you provide during intake for advertising or analytics: the hashed identifiers we send to advertising platforms do not include the content of your intake conversation, your case narrative, or any health information. Email the address above to exercise this right with respect to any other use.

Minors. We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not direct advertising at minors.

During intake we ask for your express written consent under the Telephone Consumer Protection Act (TCPA). By saying "yes" to that prompt and providing your phone number and email, you authorize MatterVine and the matched attorney to contact you at the contact information you provided, including by:

• Telephone calls, including using automated dialing systems or artificial or prerecorded voice messages;
• SMS or text messages, including by automated text message technology;
• Email; and
• Any combination of the above.

Consent is not a condition of obtaining the Service. Message and data rates may apply. Message frequency varies based on attorney engagement with your case (typically 1–10 messages over the first 30 days after intake).

How to opt out. To stop SMS, reply STOP to any text message. To unsubscribe from email, click the unsubscribe link in any message we send. To opt out of all communications from MatterVine, email [email protected]. Opting out of communications from MatterVine does not opt you out of communications from the matched attorney; for that, contact the attorney directly.

We maintain an internal Do-Not-Call list and honor opt-out requests across our systems.

Attorney marketing communications

If you are an attorney using the portal at app.mattervine.com and you checked the marketing opt-in box during sign-in, we may send you promotional emails about new case inventory in your area, marketplace feature announcements, and requests for feedback on the portal experience. These messages are sent under CAN-SPAM (not TCPA) because they go to the professional email address you provided voluntarily.

How to opt out. Click the unsubscribe link in any marketing email, or email [email protected]. We will process your request within 10 business days. Opting out of marketing emails does not affect transactional emails related to cases you have reserved (payment receipts, case-file delivery, etc.).

We use cookies, browser local-storage, and similar technologies in three categories: strictly necessary, advertising/measurement, and analytics.

a) Strictly necessary (first-party)

These keep the Service functional and are not used for advertising or analytics. They cannot be disabled without breaking core functionality.

• mv:pendingIntake (sessionStorage) — temporarily holds the first message you typed on the landing page so we can replay it after the chat page loads. Cleared after one use or when you close the tab.
• mv:gconv:lead:<sessionId>, mv:gconv:email:<sessionId> (sessionStorage) — flags that prevent the same Google Ads conversion event from firing twice on a page reload. Cleared when you close the tab.
• mv_portal_auth (HttpOnly cookie) — set when an attorney verifies their email to access case details on the attorney portal (app.mattervine.com). Contains a cryptographically signed session token that includes the attorney's email address and an expiry timestamp. Expires after 7 days. Not used for advertising or analytics.
• Cloudflare bot-management cookies (such as __cf_bm) — set by our hosting provider to distinguish humans from bots. Expire within 30 minutes of inactivity.

b) Advertising and conversion measurement

We load the Google tag (gtag.js) on every public page to measure Google Ads conversions. Google sets one or more of the following cookies on your browser:

• _gcl_au, _gcl_aw, _gcl_dc, _gcl_gb, _gcl_gf, _gcl_ha — Google Ads conversion linker cookies; persist 90 days by default. They store an opaque advertising click identifier so Google can attribute a conversion to the ad you clicked.
• _gac_* — Google Analytics campaign cookies, when Analytics is enabled.

Beyond cookies, the Google tag also transmits hashed identifiers for Enhanced Conversions at two points: when you confirm a deliverable email during intake (your email, hashed in your browser), and on the results page after you complete an intake (your email and phone, hashed on our server and passed to the tag as digests only). In both cases only the SHA-256 hash is sent — your email and phone are never sent to Google unhashed, and we never send your intake content. If your browser sends a Global Privacy Control signal, we omit these hashed identifiers (see Section 5).

We do not run the client-side Meta Pixel today, so MatterVine does not set the _fbp or _fbc cookies on its own. However, if you arrive on the Service from a Meta ad, the Meta click identifier (fbclid) is present in the URL and we record it; we also read any pre-existing _fbp or _fbc cookies set by other sites that have the Meta Pixel installed. We send these values to Meta's server-side Conversions API as described in Section 2(d) so Meta can match conversions to ads.

When we add TikTok ad tracking, TikTok's pixel may set the _ttp cookie and similar identifiers. This Policy will be updated at that time.

c) Analytics

If we enable Google Analytics or a similar product, Analytics cookies (such as _ga and _ga_*) collect aggregated usage data. We will keep this Section up to date as analytics technologies are turned on or off.

d) Choices

Most browsers let you refuse or delete cookies. You can also opt out of personalized advertising at the industry level via the Digital Advertising Alliance's consumer choice page (optout.aboutads.info) and on the Network Advertising Initiative's opt-out page (optout.networkadvertising.org). Google offers an opt-out at adssettings.google.com; Meta at accountscenter.facebook.com.

Global Privacy Control. Where technically feasible, MatterVine treats a GPC signal sent by your browser as a request to opt out of the "sharing" described in Section 5(b) above (advertising-technology sharing). GPC does not affect the attorney-matching sharing described in Section 5(a) — to opt out of that flow, use the email instructions in Section 5.

No cookie consent banner. MatterVine is offered only in the United States and does not currently target users in jurisdictions that require an affirmative cookie banner (such as the EEA and the UK under ePrivacy / GDPR). If you are accessing the Service from outside the United States, please review Section 12.

We retain personal information for as long as needed to provide the Service, satisfy our legal obligations and those of attorneys we have matched you with, and defend or assert legal rights. Specifically:

• Intake transcripts, lead records, and TCPA consent records are retained indefinitely as part of attorney case files and as legally required evidence of consent. We are unable to delete consent records unilaterally because they are evidence of compliance with federal law.
• Contact information and account data are retained until you request deletion, subject to legal hold and similar retention obligations.
• Analytics data is retained per the policies of the applicable analytics provider.
• Backups and logs may persist for a reasonable period after deletion of live records and are securely overwritten in the ordinary course.

We implement reasonable technical and organizational measures designed to protect your information against unauthorized access, use, alteration, or destruction. These include:

• HTTPS/TLS encryption of all data in transit;
• Encryption at rest of database and storage at our infrastructure providers, as part of their standard offerings;
• Default-deny row-level security on our database, with privileged credentials available only to server-side code;
• Hashing (SHA-256) of personal identifiers before they are transmitted to advertising platforms;
• Append-only consent logs for TCPA consent, retained as regulatory evidence;
• Use of established third-party processors that publish their own security and privacy commitments (we rely on those commitments rather than conducting independent vendor audits); and
• Internal access controls, role-scoped credentials, and request- level logging.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

Depending on where you live, you may have the following rights with respect to your personal information:

• Right to know / access — request the categories and specific pieces of personal information we have about you.
• Right to delete — request that we delete your personal information, subject to legal retention requirements.
• Right to correct — request that we correct inaccurate personal information.
• Right to portability — receive a copy of your personal information in a portable format.
• Right to opt out of sale or sharing — see Section 5.
• Right to limit use of sensitive personal information — California residents.
• Right against automated decision-making — request human review of significant decisions made about you using AI, where applicable.
• Right to non-discrimination — we will not discriminate against you for exercising these rights.
• Right to appeal — if we deny a request, you may appeal by replying to our denial email.

How to exercise your rights. Email [email protected] with the right you wish to exercise and enough information for us to verify your identity (typically your full name, the phone number, and the email address used during intake). We will respond within the timeframe required by applicable law (generally 30–45 days).

Authorized agents. California residents may use an authorized agent to submit requests. We require proof of the agent's authority and may require you to verify your own identity directly.

California "Shine the Light" (Civil Code § 1798.83). California residents may request information about our disclosure of personal information to third parties for direct marketing purposes by emailing the address above.

Nevada residents. Under Nevada SB 220, Nevada residents may submit a verified request to opt out of the sale of covered information.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, and similar states. You have rights under your state's comprehensive privacy law substantially similar to those above. Email the address above to exercise them.

The Service is intended for adults 18 years of age or older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have collected information from your child under 13, please contact [email protected] and we will delete it.

If you are between 13 and 17 years old, you may use the Service only with the involvement and consent of a parent or legal guardian.

MatterVine is operated from and intended for users physically located in the United States. Information you provide is processed in the United States and may be transferred to and processed in other countries by our service providers as part of normal cloud operations (for example, Cloudflare's global content-delivery network). The privacy laws of the United States may differ from those of your country of residence.

Residents of the European Economic Area, United Kingdom, or Switzerland: We do not actively offer the Service to residents of these regions. If you choose to use the Service from one of these regions, you do so at your own initiative, and you consent to the transfer and processing of your information in the United States.

We may update this Privacy Policy from time to time. The "Effective" date at the top of this page reflects the most recent revision. If we make material changes, we will notify you by email (if we have your email address) or by a prominent notice on the Service before the changes take effect. Continued use of the Service after the effective date of a revised Policy constitutes acceptance of the revised Policy.

For any questions, concerns, or requests regarding this Privacy Policy or our handling of your information, contact us at:

MatterVine LLC (a Wyoming limited liability company)
Privacy: [email protected]
General support: [email protected]
Mail: MatterVine LLC, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801