1 Introduction
1.1 HubHutch is owned and operated by Rare Matter Technologies (Pty) Ltd, trading as MatterWorks Software. In this notice, “we”, “us” and “our” refer to that company.
1.2 This notice explains how we collect, use, share and protect personal information in HubHutch’s app and web service. It applies to Businesses, their authorised staff, Customers and other people whose information is included in the service. Free access does not reduce a Customer’s privacy rights.
1.3 We use Business and Customer as defined in the Terms and Conditions. A Business uses HubHutch’s business service. A Customer uses its free customer features for private personal use.
1.4 Our Information Officer is Robert Rossouw. Contact him at hello@matterworkssoftware.com or +27 83 607 5762 about personal information, security concerns or this notice.
2 Responsibility for information
2.1 We are the responsible party under the Protection of Personal Information Act (“POPIA”) for administering Business and Customer accounts, operating Customers’ personal-project features, and managing our subscriptions, account security and support.
2.2 A Business is the responsible party for personal information it uses to manage its work, staff and Customers. When we process that information on its behalf, we act as its operator and follow its lawful instructions. Section 7 of the Terms sets out our processing, confidentiality and security obligations.
2.3 The same record can serve more than one purpose. For example, a Business uses a Customer’s response to manage its work, while we retain the response and associated access records to deliver the service and investigate disputes. We assess responsibility according to the use concerned.
3 Information we collect
Business information
3.1 Business accounts include representative and staff names, contact details, business identity and registration details, permissions and subscription records. Business profiles may include addresses, tax information and bank details used on invoices. We may ask for proportionate evidence of identity or authority to resolve an account-security issue or legal request; merchant verification is handled by the payment provider.
3.2 Work records may include customer and site details, assessments, quotations, variations, jobs, schedules, invoices, photographs, notes, staff assignments, time entries and optional workday routes. Businesses decide what information they add and who within their account may use it.
Customer information
3.3 Customer accounts include names, contact details, account settings, Business relationships and private personal projects. Shared records include invitations, work requests, documents, responses, correspondence and attachments.
3.4 We record project creation and use of storage to apply the fair-use limits. Deleting or closing a project does not remove its creation from the current month’s usage count.
Service information
3.5 We collect the information needed to sign people in, deliver notifications, maintain permissions, investigate faults and protect the service. This may include account identifiers, device and connection details, event times, delivery results, error reports and security logs.
3.6 We receive information directly from you, from a Business or Customer who shares it through HubHutch, and from providers supporting sign-in, subscriptions, communications or connected payments. We also retain the content of support enquiries and the action taken to resolve them.
4 Purposes and lawful grounds
4.1 We use personal information to provide the requested service, administer accounts, manage subscriptions and refunds, deliver communications, enforce access and fair-use controls, resolve enquiries and protect records.
4.2 We rely on the lawful ground appropriate to the use: performance of an agreement, compliance with a legal obligation, protection of a legitimate interest, or consent where required. We assess legitimate interests against the affected person’s rights. Acknowledging this notice is not blanket consent to every use of personal information.
4.3 Required account information is needed to provide the relevant account or feature. A payment provider may require information before activating its payment service. That requirement does not prevent a Business from subscribing to HubHutch or using features that do not depend on the provider. Optional device permissions can be declined; this may limit the feature that needs them.
4.4 We do not sell personal information or use private work records for unrelated advertising. Using HubHutch does not authorise us to use those records to train a general-purpose AI model.
5 Business payments and staff records
Payment accounts
5.1 A Business connects its own Paystack merchant account if it wants to collect online payments. Paystack collects and checks the information required to activate that account under its own terms and privacy notice. We do not require a separate HubHutch merchant-verification application to use the business service.
5.2 We process the connection credentials, identifiers, payment status and security records needed to connect and support the merchant account. Connection credentials are restricted to the services and authorised personnel that need them. They must not be included in ordinary correspondence or support messages.
5.3 We may retain records from an earlier verification process where needed for a legal obligation, security investigation or claim. They remain restricted and are deleted when no longer lawfully needed. HubHutch does not use facial comparison, selfie-based liveness checks or biometric templates in this process.
Staff time and location
5.4 Workday route recording requires the person using it to enable recording, permit location access and start a workday. With background permission, it can continue while the app is in the background or the phone is locked. Recording pauses during a recorded break and stops when the workday ends or recording is switched off.
5.5 Time can be recorded without location. Turning location recording off stops new collection; it does not erase routes already saved. Staff can view their own records. Other Business users need the relevant permission to view them.
5.6 A Business must explain why it uses staff time and location information, establish a lawful basis and limit access and retention to what is needed. HubHutch’s device permission does not replace the Business’s duties to its staff.
6 Sharing between Businesses and Customers
6.1 A Business and its authorised staff can access information shared within their relationship with a Customer. That includes the relevant work records, documents, messages, attachments and responses. HubHutch records and transmits a submitted document response to the Business.
6.2 A Customer’s private personal projects and dealings with other Businesses are not automatically shared with a Business. We use private-project information to provide those features, manage access, apply fair use and support the Customer.
6.3 Some document links allow anyone holding the link to view the document. Share them only with authorised recipients. Contact the sender or us if a link is misdirected or access needs to be withdrawn.
6.4 We handle privacy requests about our account administration and Customers’ private personal projects directly. We coordinate requests about Business-controlled work records with that Business. You may contact us about our handling of your information in either case.
7 Providers and other disclosures
7.1 We use providers for hosting, authentication, communications and connected features. Their access must be limited to the work concerned and protected by appropriate confidentiality and security arrangements.
| Provider | Function |
|---|---|
| Google Firebase and Supabase | Sign-in, hosted records and files, permissions and application services. |
| Resend | Email delivery and associated delivery records. |
| Apple | App Store subscriptions and relevant device, notification, location and Maps services. |
| OpenAI Sites | Hosting and delivery of the MatterWorks website. |
| Paystack | The Business’s own connected merchant account and payment service. |
7.2 App Store billing is handled by Apple. Connected payments for a Business’s work are handled by that Business’s payment provider. We receive transaction identifiers, status and other information needed for the connection, reconciliation or support; we do not receive full payment-card details through those payment flows.
7.3 A provider may also process information for its own services, security or legal obligations under its privacy notice. Files you export or save to another service are subject to your choices and that service’s arrangements.
7.4 We may disclose information to advisers, regulators, courts or other recipients where lawfully required or necessary to establish, exercise or defend a legal claim. We limit disclosure to what is needed for that purpose.
8 Storage and international transfers
8.1 The configured Firestore storage location is Johannesburg, South Africa, and the Supabase project location is London, United Kingdom. Firebase Authentication processes information in the United States. Resend sends email from Ireland and stores data in the United States. Provider support, delivery and other operations may involve additional countries.
8.2 Transfers we arrange must meet POPIA’s requirements through appropriate contractual protection or another lawful basis. Our Information Officer can provide information about a transfer and its safeguards.
8.3 The app and browser also keep working information, settings or drafts on your device. Clearing local storage can remove those copies or sign you out; it does not necessarily delete records held by the service.
9 Retention and deletion
9.1 We retain personal information for its stated purpose, a legal obligation or a justified claim. Business work records follow the Business’s lawful instructions. Account, subscription, payment-connection, support and security records have their own purposes; they are not all erased when a subscription ends.
9.2 Customers can delete private personal projects. The current recovery period is 30 days. During that period a deleted project can be restored, subject to the active-project limit. We retain the limited usage history needed to apply the monthly creation allowance.
9.3 Closing an account or ending a Business–Customer relationship does not automatically erase shared records another party may lawfully retain. We assess deletion across records, files and providers, explain any information that must remain and restrict its further use. Copies independently saved by a recipient must be addressed with that recipient.
9.4 Information no longer needed is deleted or de-identified. If deletion remains pending in a provider system or backup, we distinguish that from completed deletion and keep the remaining information protected. Contact the Information Officer for the retention arrangements affecting a particular record.
10 Security and incidents
10.1 We use access permissions, protected connections, restricted administrative access and other appropriate safeguards against loss, unauthorised access and misuse. We investigate reported weaknesses and take corrective action.
10.2 Report suspected unauthorised access to hello@matterworkssoftware.com promptly. Where we act as a Business’s operator, we notify that Business immediately when we have reasonable grounds to believe its personal information has been accessed or acquired without authorisation. Where we are the responsible party, we make the notifications required by POPIA to the Information Regulator and affected people.
11 Rights and complaints
11.1 You may ask whether we hold personal information about you and request access, correction or deletion. You may object to processing where POPIA allows it and withdraw consent where it is the basis for the use. Withdrawal does not undo processing that was lawful before it.
11.2 Contact our Information Officer and identify the information and action concerned. We may request proportionate proof of identity or authority. We will explain any lawful refusal or restriction. These rights remain available after an account closes and do not depend on a paid subscription.
11.3 Confirmation of whether we hold your personal information is free. Any further access charge must be permitted by law. The PAIA Manual explains the formal access process.
11.4 Some limits and security controls operate automatically. You may contact us to challenge a result or request review. Where POPIA restricts a decision based solely on automated processing that significantly affects you, we will provide the applicable explanation and review.
11.5 You may complain to the Information Regulator through its eServices portal, at POPIAComplaints@inforegulator.org.za, or by calling 010 023 5200. Its contact page provides current details.
12 Changes to this notice
12.1 We will update this notice when our information practices change and bring material changes to your attention. Updating the notice does not itself give us consent for a use that requires it.