Privacy Policy

Effective Date: 2026-04-30 | Last Updated: 2026-04-30

This Privacy Policy describes how Chabad at Duke — The Fleishman House ("we," "us," or "our") handles data accessed and processed by Mati, our internal AI assistant.

1. Who We Are

Chabad at Duke — The Fleishman House is a 501(c)(3) tax-exempt nonprofit (EIN: 81-3815268) based in Durham, North Carolina, serving Jewish students at Duke University.

Address: 204 N Buchanan Blvd, Durham, NC 27701
Email: office@chabadatdukeug.com
Phone: (984) 367-9139

2. Scope of This Policy

Mati is an internal AI assistant used by authorized staff and board members of Chabad at Duke to support the organization's operations. This policy describes the data Mati accesses, how it is used, and how it is protected. Mati is not a public-facing application.

3. Data We Access

To support Chabad at Duke's operations, Mati connects to and processes data from the following systems:

Donor and contact records from our CRM (CiviCRM/ChabadSuite), including names, contact information, giving history, communication history, and relationship notes.
Financial records from QuickBooks Online via Intuit's API, including chart of accounts, transactions, customer/vendor records, and standard financial reports. Access is read-only.
Email from authorized staff accounts via Google's OAuth-based APIs, used to read context and draft outbound communications. Outbound sends require explicit human approval.
Calendar events from authorized Google Calendar accounts via OAuth.
Messaging via WhatsApp Business through Twilio.
Phone call transcripts from Bland.ai.
Payment events from Stripe.

4. How We Use This Data

All data accessed by Mati is used solely for the internal operations of Chabad at Duke. We do not:

Sell, rent, or trade any personal data
Share personal data with third parties except the service providers necessary to operate Mati (listed in Section 7)
Use personal data for advertising
Use personal data to train shared or public AI models

5. Data Storage and Security

Data accessed by Mati is stored in:

A PostgreSQL database hosted on Railway (United States), with encryption at rest
Cloudflare R2 object storage (United States), with encryption at rest
Doppler (secret management), with encryption at rest, for OAuth tokens and API credentials

Security measures include credentials stored in dedicated secret management (no plaintext in source code), TLS encryption for all API calls, restrictive file-system permissions on local credential files, automatic token rotation, comprehensive audit logging, and segregation of production data from development environments.

6. Data Retention

Data is retained as long as Chabad at Duke uses Mati and the data remains operationally relevant. We use soft-delete and supersession to preserve audit history while removing inactive records from active retrieval. Personal data may be permanently deleted upon written request to office@chabadatdukeug.com.

7. Service Providers

Mati relies on the following service providers, each of which has its own privacy practices:

Anthropic (AI reasoning)
OpenAI (voice transcription via Whisper)
Twilio (messaging and phone)
Intuit (QuickBooks Online API)
Google (Gmail, Calendar, Drive APIs)
Postmark (transactional email)
Stripe (payment processing)
Cloudflare (storage and content delivery)
Railway (compute and database)
Doppler (secrets management)
Better Stack (operational monitoring)
Bland.ai (phone agent)

8. Your Rights

If you are a person whose data is processed by Mati, you may:

Request a copy of the personal data we hold about you
Request correction of inaccurate data
Request deletion of your personal data
Revoke any OAuth authorization you previously granted, via the granting service's account settings
Contact us with privacy questions or complaints

To exercise these rights, contact office@chabadatdukeug.com.

9. Children's Privacy

Mati is not directed at children under 13 and we do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active users.

11. Governing Law

This Privacy Policy and any disputes arising under it are governed by the laws of the State of North Carolina, United States.

12. Contact

Chabad at Duke — The Fleishman House
Attn: Privacy
204 N Buchanan Blvd
Durham, NC 27701
office@chabadatdukeug.com