Privacy Notice

Your business files stay with you.

Last updated: August 13, 2026.

Who is responsible

Knurl LLC provides MatchThree and is the controller for personal data that it collects through this website and product.

For privacy questions or requests, email support@knurlworks.com.

Business files stay in your browser

MatchThree reads CSV and XLSX files and generates the AP Exception Pack locally in your browser. Knurl does not receive or retain uploaded spreadsheet contents, filenames, vendors, product names, SKUs, prices, quantities, invoice numbers, employee names, customer names, or analysis results. You control where the downloaded workbook is stored and shared.

Personal data we may process

• Site and security data: IP address, request time, requested path, browser or user-agent information, and coarse error or security signals processed when your browser requests the site.
• Support data: your email address and the information you choose to include when contacting us. Please do not send spreadsheets or business values.
• Account data: your email address, authentication session data, and a stable opaque account identifier used to sign you in and associate paid access with the same person across supported Knurl products. MatchThree does not create customer profiles, saved projects, or uploaded-file records.
• Purchase and entitlement data: the opaque account identifier, Paddle transaction identifier, transaction status, billed time, adjustments such as refunds or chargebacks, quantity, MatchThree price identifier, entitlement identifier, entitlement dates, and the receipt email address needed to issue, restore, and send one expiry reminder for a 14-day Correction Pass. Knurl does not receive full payment-card details.
• Anonymous funnel events: MatchThree has a fixed vocabulary for coarse events such as demo start, analysis complete, checkout start, and export success. No analytics endpoint is enabled by default. If anonymous measurement is enabled, it accepts only an event name, page path, and coarse error code—never filenames or business data.

Why we process it

• To deliver the website, verify a purchase, restore paid access, send one reminder 48 hours before an eligible pass expires, and provide requested support, where processing is necessary to perform our agreement with you.
• To secure, diagnose, and maintain a reliable service, based on our legitimate interests in preventing abuse and operating MatchThree safely.
• To keep financial or legal records and respond to lawful requests where required by law.
• Where consent is legally required for an optional technology, based on that consent. MatchThree does not use personal data for behavioral advertising.

Who receives data

• Cloudflare provides hosting, content delivery, request logging, and security services and may process site and security data for those purposes.
• Supabase provides passwordless authentication and stores your email address, opaque account identifier, and authentication records.
• RevenueCat associates the opaque account identifier with Paddle transaction and entitlement records so paid access can be restored across browsers and supported Knurl products.
• Paddle independently acts as Merchant of Record and controller for checkout, payment, fraud prevention, tax, invoicing, buyer support, and refunds. Paddle receives the MatchThree price identifier and the information it needs to complete the transaction. See Paddle's Privacy Policy.
• Resend delivers passwordless sign-in messages and the single Correction Pass expiry reminder. The reminder contains the receipt email address, expiration date and time, and a link to MatchThree, but no spreadsheet or analysis data.
• Professional advisers may receive limited information when reasonably necessary for legal, accounting, audit, or security advice.
• Authorities or other parties may receive information when required by law or reasonably necessary to protect rights, safety, and service security.

Knurl does not sell personal data and does not send spreadsheet contents or sensitive business values to Cloudflare analytics, Supabase, RevenueCat, Paddle metadata, Resend, or advertising services.

Cookies and local storage

The free MatchThree workflow does not require an account, and MatchThree does not intentionally set advertising or marketing cookies. A passwordless account is required only to purchase, restore, or use paid export access. Cloudflare may use strictly necessary security technologies, Supabase stores an authentication session in browser storage, and Paddle Checkout may use essential checkout and fraud-prevention technologies under Paddle's notice. MatchThree does not store customer projects, spreadsheet files, filenames, mappings, analysis values, or generated reports in browser storage. Clearing browser storage signs you out; signing back into the same account restores eligible paid access.

Retention

Knurl has no customer project database and does not retain uploaded files or generated reports. Supabase retains account and authentication records while the account remains active. RevenueCat retains the opaque account identifier and commerce entitlement history needed to restore or revoke access. Paddle remains the system of record for the transaction, receipt email, and billed time. Cloudflare temporarily retains the opaque account ID, Paddle transaction ID, and reminder and expiration timestamps while the reminder waits to run; it does not store the email address in reminder state. Resend retains delivery records according to its service policies. Support correspondence is retained only as long as reasonably necessary to resolve the request, prevent repeat issues, and meet legal obligations, then deleted or anonymized. Infrastructure security logs are retained according to configured operational needs and provider terms, then deleted or aggregated. Paddle retains transaction records under its independent legal obligations and policies.

International processing

Knurl is based in the United States. Cloudflare, Supabase, RevenueCat, Paddle, Resend, and their service providers may process personal data in the United States and other countries. Where required, those providers use recognized transfer safeguards such as adequacy decisions or contractual protections.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data; object to certain processing; withdraw consent where processing relies on consent; and complain to your local data-protection authority. These rights may be subject to lawful exceptions.

Send a request to support@knurlworks.com. We may need to verify that the request concerns you. Account deletion removes the Supabase identity and associated RevenueCat customer where legally appropriate; Paddle may retain transaction records it is legally required to keep. We will respond within the period required by applicable law, including within one month where UK or EEA law applies unless a lawful extension is available. For payment data controlled by Paddle, contact Paddle buyer support directly.

Security

We use proportionate technical and organizational measures, including browser-local file processing, passwordless authentication, server-side access-token validation, verified payment webhooks, encrypted HTTPS transport, restricted deployment credentials, and minimal account and payment data. No internet service can guarantee absolute security.

Changes to this notice

We may update this notice when MatchThree, its providers, or legal requirements change. The date above identifies the current version.