Mattermost
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Your employer owns the chats; Mattermost keeps telemetry, can terminate the site anytime, and site ads may track you.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, usage and telemetry, device IDs, IP, cookies, and sometimes location and partner data.
Read the exact line
Privacy policy
“we collect limited information related to end users, such as service and usage data like error and diagnostics information, security alerts, log file reports, and other data associated with device identifiers”
Training
They use it to run and improve the product, market, and (on websites) show interest-based ads.
Read the exact line
Privacy policy
“We may also use information you provide to improve our Sites and Services and to market to you.”
Sharing
Vendors, affiliates, and (on sites) ad networks; they say they do not sell data for money.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer the information described above to unaffiliated third parties for monetary consideration.”
Kept
Kept while your account is active; they say they then delete or within 60 days.
Read the exact line
Privacy policy
“After such time, we will delete, , or aggregate this information within 60 days, unless otherwise required by law.”
Controls
End users should ask their company; others can use a request form, GPC, or marketing unsubscribes.
Read the exact line
Privacy policy
“If your personal information was submitted to us by a Customer or your account is controlled by a Customer, then please contact the applicable Customer directly”
Fine print
They can cut off the website anytime, you them.
Read the exact line
Terms of service
“Mattermost may terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Ask your employer about chat privacy and retention
Contact the Customer that controls your Mattermost workspace
Opt out of interest-based ads with GPC
Visit Mattermost Sites with Global Privacy Control enabled
Submit a request
Complete Mattermost’s request form (or email privacy@ as listed)
Unsubscribe from marketing email
Use the link at the bottom of each marketing message
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If someone sues them because of how you used the site, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and Mattermost, its affiliates, contractors, and its licensors, and their respective directors, officers, employees and agents from and against any and all claims and expenses, including attorneys’ fees, arising out of your use of the Mattermost Website”
For example, if a post you make on their forum leads to a lawsuit, they can ask you to cover their lawyers.
They can shut off your website access instantly and do not have to warn you first.
Read the exact line
Terms of service
“Mattermost may terminate your access to all or any part of the Website at any time, with or without cause, with or without notice, effective immediately.”
For example, your forum login could stop working overnight with no email.
On their websites, third-party ad companies can track you to show targeted ads.
Read the exact line
Privacy policy
“we may partner with ad networks and other ad serving providers (“Advertising Providers”) that serve ads on behalf of us and others on non-affiliated platforms.”
For example, visiting mattermost.com could later show you Mattermost ads on other sites.
They say they do not sell data for cash, but site tracking can still count as a “sale” you can opt out of.
Read the exact line
Privacy policy
“While we do not sell the personal information we collect for money, we may allow certain third parties to collect personal information through our Sites in ways that may be viewed as “sales” under certain state privacy laws.”
For example, a California resident can use Global Privacy Control to opt out of that sharing.
Your company’s settings can send service data to third-party AI tools.
Read the exact line
Privacy policy
“With providers of machine learning and artificial intelligence tools. With respect to information collected through our Services, we make such information available to such providers if they integrate with our Services and only to the extent permitted by our Customers;”
For example, if your admin turns on an AI plugin, that vendor may receive workspace information.
At work, your employer—not you—owns the chats and files you put in Mattermost.
Read the exact line
Privacy policy
“The Customer owns and controls the messages, files, or other content submitted to the Services, including your personal information (the “Customer Data”)”
For example, leaving the company does not mean you can take or delete the team’s message history yourself.
When they no longer need the data, they say they wipe or scramble it within about two months.
Read the exact line
Privacy policy
“After such time, we will delete, , or aggregate this information within 60 days, unless otherwise required by law.”
For example, after an account is closed they claim leftover personal data is gone or within 60 days.
They say they use security steps, but they also say they cannot guarantee the data is fully safe.
Read the exact line
Privacy policy
“We implement a variety of security measures aimed at maintaining the safety of the personal information we collect from loss, misuse, and unauthorized access or disclosure.”
For example, they try to stop leaks, yet a breach is still possible.
Words to know
Legal words from the lines above, in plain English.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
How we got here · grade C · score 40/100 · 15 of 15 policy answers backed by a verified quote · 5 not stated
What does the app collect beyond what it needs to work?
Besides account and content, they collect telemetry, diagnostics, device identifiers, IP addresses, cookies, and site activity.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
Cloud services are not used for ads, but the websites use third-party interest-based advertising and analytics.
Do they sell or share your data, and can you opt out?
They say they do not sell data for money, but site tracking may count as a sale, with GPC and other opt-outs.
What rights do they take over what you type and what the AI makes?
For the cloud product, the customer organization owns messages and files; Mattermost processes them as a provider.
How long do they keep your data after you delete it, and can you delete it in the app?
Deletion for individuals is through a request form or your employer; they say leftover data is deleted or de-identified within 60 days.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe general security measures and say they cannot guarantee absolute safety. No audit or leak history is given.
Is there a real age gate, and are teens protected?
The website is for people 13 or older, with no described age-proofing. They say they do not sell data of kids under 16.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated, but they only say they will post changes on the page, with no promised advance notice.
Can they close your account without warning, and can you get your data out first?
They may end website access at any time, with or without cause or notice.
If something goes wrong, who pays?
The site is “as is,” they disclaim almost all damages, and you must indemnify them for claims from your use.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 6,780 words at a college graduate level (Flesch reading ease 35.1); the terms are 1,312 words at a college graduate level.
