Legal

Privacy Policy

Last updated: 7 September 2026

1. Who we are

Nymetric Match is a business-to-business name-comparison and decision-support service. Privacy questions may be sent to privacy@nymetric-match.com.

2. Our roles

For customer and cardholder names submitted by a merchant to the matching API, the merchant is the controller and Nymetric acts as its processor, processing the data on the merchant's instructions to provide the service. Nymetric acts as a controller where appropriate for its own account administration, business contacts, contracts, security, abuse prevention, billing, legal compliance and website enquiries.

3. Information we process

• Names supplied to the API for comparison.
• Match metadata, including request and merchant identifiers, an optional merchant reference, environment, result, score, reason codes, matcher version, processing time and timestamp.
• Merchant and administrator account information, including names or business email addresses, roles, status and authentication/security records.
• Security and technical information such as login IP addresses, request identifiers, timestamps and service logs.
• Contact enquiries: name, business email, optional company, enquiry type and message.

A merchantReference must be an opaque merchant-generated correlation identifier and must not contain names, email addresses, telephone numbers, postal addresses, payment credentials or other directly identifying customer information.

4. API name processing

For API name-comparison requests, customer and cardholder names are processed transiently to calculate the result and are not stored in Nymetric's match-request database. Raw names and derived normalized, tokenized or transliterated name strings are not persisted there. Match metadata is retained as described below.

The Nymetric Match name-matching engine is deterministic and does not send customer or cardholder names to an external AI model for name matching.

5. Why we use information

We use information to provide and secure the service, administer accounts and contracts, respond to enquiries, prevent abuse, maintain audit records, meet legal obligations and establish or defend legal claims. When Nymetric acts as controller, the relevant basis may be performance of a contract, legitimate interests in operating and securing a B2B service, compliance with legal obligations, or consent where required. Merchants are responsible for identifying an appropriate basis for data they instruct us to process.

6. Contact and email

The contact form sends enquiries through SpaceMail to a Nymetric business mailbox; it does not create a contact-submission database record. Correspondence may remain in our mailbox and provider systems. General enquiries are normally retained for up to 12 months after resolution, unless they form part of an ongoing customer relationship, contract, legal matter, rights request, security incident or another record that reasonably requires longer retention.

SpaceMail processes transactional and business email and applies automated security scanning. Its published terms permit trusted AI technologies, including OpenAI Moderation, to scan limited portions of email content for spam, phishing or other harmful activity; according to those terms, moderation data is not used to train OpenAI models and short-term abuse/security logs may be kept for up to 30 days. Provider backups may be kept for up to four weeks.

7. Providers and international transfers

We use Google Cloud for hosting, load balancing, logging and deployment services; Neon for PostgreSQL; Upstash for Redis-based throttling; and Spaceship / SpaceMail for email. The primary selected production regions for Cloud Run, Neon and Upstash are London, but this does not mean all provider processing, support or subprocessing occurs only in the UK. Where personal data is transferred internationally, appropriate safeguards are used where required. See our Subprocessor Notice.

8. Retention

• Match metadata, including merchant references: 90 days.
• General audit/security events: 12 calendar months; raw login IP values are removed after 90 days.
• Expired or revoked sessions and used or expired account tokens: deleted after a 30-day grace period.
• Revoked API-key records: deleted 90 days after revocation.
• Active account and credential records: retained while the account or service relationship remains active and thereafter as reasonably required for termination, legal or operational purposes.

Deletion from backups and provider systems follows applicable backup cycles and legal obligations. Full tenant export/deletion and targeted personal-data deletion are currently handled operationally rather than through self-service tooling.

9. Security

We use proportionate controls including encryption in transit, hashed passwords and credentials where applicable, role-based access, tenant-scoped authorization, rate limiting, audit logging and retention controls. No internet service can promise absolute security.

10. Your rights

Depending on the circumstances, individuals may have rights to access, correct, erase or restrict personal data, object to processing, or receive portable data. For information submitted by a merchant, contact that merchant first; we assist merchants with valid requests. You may also contact us at privacy@nymetric-match.com. You may complain to the UK Information Commissioner's Office at ico.org.uk.

11. Sensitive data and TEST use

Do not deliberately submit special-category or criminal-offence data unless expressly authorised in a written agreement. The TEST environment must not be used with real personal data.

12. Changes

We may update this notice as the service or legal requirements change. The current version and effective date will be shown on this page.

Contact

Privacy: privacy@nymetric-match.com. General support: support@nymetric-match.com.