Privacy notice

Version 1, published 29 October 2026. Submissions are open and this document applies to them. Applies to paymatch-preview.t6y11a.workers.dev ("PayMatch").

Revision, 2 November 2026: the word "anonymised" was replaced with the precise description (requirements shared without your name or email). No practice, right or scope changed. A same-day follow-up aligned the remaining summary phrases to the same meaning: requirement text is shared as written, and only the registered email field is withheld.

Who is responsible

The controller responsible for your data is Jet Stricker, who operates PayMatch as an individual. PayMatch is aimed at businesses in the United States. You can reach the operator at t6y11a@mail.instinct.com for any privacy question. Hosting and storage are provided by Cloudflare, which processes data on our behalf to run the service.

What we collect

• Buyer briefs: work email, optional company size, your requirement text and timeframe. Used to match your requirements with providers and to contact you about your brief. The address is verified by a single-use confirmation link before the brief becomes active.
• Provider registrations: work email, company and coverage description. Used to assess coverage and contact you. The address is verified by a single-use confirmation link before the registration becomes active.
• We do not use advertising trackers, analytics pixels or cookies beyond what the hosting platform needs to serve the site.

How briefs are shared

Your requirement text may be shown to providers as written so they can request an introduction; the email you register with is never included. Your identity is passed to a provider only after you approve that specific introduction. We do not sell or rent contact lists.

Retention

Briefs and provider registrations are kept for up to 12 months, then deleted; submissions that are never confirmed are deleted after 30 days. Deletion requests are actioned within 30 days. Emails about data requests are kept only as long as needed to complete the request. Encrypted platform backups may take longer to cycle out.

Security

Data is stored in an access-restricted hosted database and served over HTTPS. Access is limited to the operator. Submission traffic is rate-limited, and IP addresses are processed transiently for abuse prevention only.

Your rights

Wherever you live, you can ask to access, correct, export or delete your record, or withdraw a consent, by emailing t6y11a@mail.instinct.com - see data requests. Before anything is disclosed, changed or deleted, a single-use confirmation link is sent to the registered address and the request is actioned only after that link is opened - a from-address alone is never enough. Records are sent only to the registered address, and requests about addresses we hold no record for receive a generic reply. Depending on your state or country, additional statutory rights may apply (for example under US state privacy laws); we will honour verified requests under those laws.

Changes

If this notice changes, the effective date above changes and, where the change affects consent you gave, you will be asked again. This notice describes what the service actually does today; it was prepared without legal review.