Privacy Policy | MatchPO

Last updated: December 17, 2025

Overview

This Privacy Policy describes how MatchPO (“MatchPO”, “we”, “us”) collects, uses, and shares information when you visit our website, create an account, or use our services (the “Services”).

MatchPO is a business service used by finance teams to ingest and process invoices, match them to purchase orders, route approvals, and post to connected accounting systems.

If you are using MatchPO on behalf of a business (our “Customer”), that Customer controls the information submitted to the Services. For example, invoices often contain contact details for vendor representatives or employees. In those cases, MatchPO processes that information to provide the Services to the Customer.

This Privacy Policy is intended to be read alongside our Terms. If there is a conflict between this Privacy Policy and a written agreement with a Customer (for example, a subscription agreement or data processing addendum), that written agreement may control for the Customer’s use of the Services.

Data we collect

Information we collect may include:

Account and workspace information: name, email, role, authentication details, and workspace configuration you provide (such as approver settings).
Customer Content: invoices, attachments, email messages and headers (when you connect an inbox), purchase order data, vendor policies, approval decisions, exception notes, and related workflow metadata submitted to or generated by the Services.
Vendor contact information: information contained in invoices and invoice communications (for example, a vendor AP email address, contact name, phone number, or mailing address).
Integration data: data received from third-party integrations you connect (for example, accounting platforms, email providers, SSO providers, and messaging tools). This may include identifiers (such as external IDs), tokens/credentials (stored as needed to keep the integration connected), and synced records based on your settings.
Support and communications: information you share with us when you request support or communicate with us (for example, emails, chat messages, and troubleshooting logs you send).
Usage and device data: diagnostic and performance information used to operate and secure the Services (such as log data, approximate location derived from IP address, browser type, and device identifiers). We use this to improve reliability and prevent abuse.
Billing information: if you purchase a paid plan, billing details and transaction records. Payment processing is typically handled by third-party payment processors, and we do not store full payment card numbers on our servers.

How we use data

We use information to:

Provide, secure, and operate the Services.
Ingest documents and messages; extract invoice data; match invoices to purchase orders; enforce policies; route approvals; and maintain an audit trail.
Send operational communications related to the workflow, including notifications to Customer users (for example, approval requests via email or messaging tools) and, when enabled by a Customer, follow-up emails to vendors about invoices (for example, requesting missing information or clarifying issues).
Maintain and improve performance, quality, and reliability (for example, debugging, monitoring, and analytics).
Respond to support requests and communicate service updates.
Prevent abuse, fraud, unauthorized access, and other harmful or illegal activity.
Comply with legal obligations, enforce our agreements, and protect the rights, safety, and integrity of MatchPO, our Customers, and other users.

We do not sell Customer Content. We may share information in the following circumstances:

Service providers: we work with vendors who help us run the Services (for example, hosting, storage, email delivery, analytics, logging, and support tooling). These providers are authorized to process information only as needed to provide services to us.
Customer-enabled integrations: when you connect an integration, we may share information with that third party as needed to provide the integration (for example, posting approved invoices to an accounting platform, or sending approvals through a messaging provider).
Vendor follow-ups on Customer instructions: if a Customer enables automated vendor follow-ups, we may send emails to vendors using contact information contained in invoices and may include limited invoice context necessary to complete the workflow.
Legal and safety: we may share information if we believe disclosure is required by law, regulation, court order, or valid legal process, or to protect rights, safety, and integrity, investigate fraud, or respond to claims.
Business transfers: if we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction (subject to appropriate protections).
With your consent or at your direction: we may share information when you ask us to or otherwise consent.

Cookies and analytics

MatchPO uses essential cookies and similar technologies for security and basic functionality (for example, session management, abuse prevention, and onboarding flows). These are required for the website and Services to operate.

We also use optional analytics to understand usage patterns and improve the product. Analytics is only enabled if you choose to allow it.

Essential (required)

Session and security: authentication/session cookies and security protections used to operate the Services.
Abuse prevention: safeguards such as rate limiting and related protections.

Analytics (optional)

Usage metrics: page views and high-level usage signals used to improve performance and understand which features are valuable.
No ads: MatchPO does not run advertising networks on the Services.

You can control cookies through your browser settings. If you disable cookies, certain features may not function properly (for example, login sessions).

To change your analytics preference later, use Cookie preferences in the site footer. That will reset your choice and re-show the consent notice.

Security

We use administrative, technical, and physical safeguards designed to protect information against loss, misuse, unauthorized access, disclosure, alteration, and destruction. However, no system is 100% secure, and we cannot guarantee absolute security.

You play an important role in protecting your account, including choosing strong authentication methods and keeping credentials confidential.

Retention

We retain information for as long as necessary to provide the Services, meet legal obligations, resolve disputes, and enforce agreements. Retention may vary by data type and Customer settings.

When a Customer requests deletion, we will take reasonable steps to delete Customer Content from active systems in accordance with our agreements, while some information may remain in backups for a limited period or be retained where required or permitted by law.

International transfers

We may process and store information in the United States and in other countries where we or our service providers operate. Those countries may have different data protection laws than your jurisdiction. We take appropriate measures designed to protect information when it is transferred.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export certain personal information, and to object to or restrict certain processing.

If you are using MatchPO through a business Customer, requests may need to be made through that Customer (for example, if your personal information appears in an invoice processed on their behalf).

For privacy rights requests or questions, use the Contact page.

Third-party services and links

The Services may integrate with or link to third-party services. Their privacy practices are governed by their own policies, not this Privacy Policy. We recommend reviewing third-party privacy policies before connecting an integration or using a linked service.

Changes

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date above. Your continued use of the Services after changes become effective indicates acceptance of the updated Privacy Policy.

Contact

For privacy questions, reach us via the Contact page.