Draft — not yet in force. These terms take effect when the operating legal entity is registered and this page carries its name and an effective date. Nothing here is presented as an executed agreement.

Privacy Policy

Effective date: to be set at entity registration. Data controller for your account data: the Morna operating entity (registration pending), registered address: pending. This policy explains what we collect, why, and the choices you have.

1. The short version

We collect the minimum needed to run the service for you. We do not sell your data, we do not use it to train third-party models, and we do not share one customer’s data with another — isolation is enforced at the database and in the API. You can export everything and erase your workspace at any time.

2. What we collect

Account: your email address, used for passwordless sign-in and service notices.
Workspace: the business facts you provide and the content your connected sources return, processed to run the service for you.
Connection tokens: OAuth tokens for the tools you connect, stored encrypted at rest (AES-256-GCM) and used only to read and, on your approval, act within the scopes you granted.
Operational records: a hash-chained decision log of what was drafted, proposed, and approved, kept so the record is tamper-evident.
Usage and technical: counts and diagnostics for billing, security, and abuse limits, and standard technical data (such as IP address and device/browser information) needed to deliver and secure the service.

3. How we use your information

We use it solely to provide and improve the service for you: to read your sources, draft work, and — only on your approval — act through your connected tools; to bill accurately; to secure the service and prevent abuse; and to communicate with you about your account. We do not use your workspace content for advertising, and we do not sell it.

4. Legal bases (EEA/UK)

If you are in the EEA or UK, we process personal data on these bases: performance of a contract (to provide the service you asked for), legitimate interests (to secure the service, prevent abuse, and support you, balanced against your rights), legal obligation (for example tax and accounting), and consent where we ask for it (which you may withdraw).

5. Model processing

Drafting uses a language-model provider through our proxy. Content sent for drafting is processed to generate the draft and is not used to train third-party models where the provider offers that control. We send the minimum context needed for the task. [Confirm the provider’s data-use terms and name the provider here.]

6. How we share information

We share personal data only with sub-processors that help us run the service (for example hosting, database, language-model proxy, and email delivery), each under contractual data-protection terms; when required by law or valid legal process; and in connection with a merger or acquisition, with notice. We never sell your data. A current list of sub-processors is available on request; the data-processing terms are in the DPA.

7. Security and isolation

Each customer’s data is sealed to their workspace: tenant isolation is enforced by row-level security at the database and re-checked in the API, so one customer’s data cannot reach another. Credentials are encrypted at rest, the request path runs on a least-privilege role, the decision log is append-only and hash-chained, and irreversible actions (“the floor”) require a human approval that no automation can bypass. Access by our staff is on a need-to-know basis.

8. International transfers

Where personal data is transferred outside your region, we rely on appropriate safeguards, such as Standard Contractual Clauses. [State your primary hosting region and confirm the transfer mechanism with counsel.]

9. Retention and erasure

We keep workspace data while your account is active. You can erase everything at any time (Settings → Erase the workspace); this removes credentials, workspace state, and durable records. Backups are purged on the backup rotation thereafter. We retain limited records where we have a legal obligation to do so.

10. Your rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict the processing of your personal data, and to object to certain processing. Export and deletion are self-serve in-product; for anything else, contact [privacy@yourdomain]. We will not discriminate against you for exercising these rights. If you are in the EEA or UK, you may also complain to your local supervisory authority.

11. Health data and regulated practices

Morna is not a HIPAA business associate today, and we do not sign BAAs. If you run a medical, dental, or other regulated practice, keep protected health information (PHI) out of the workspace. The product is built to help you hold that line: regulated workspaces run draft-only on every outbound message, appointment reminders carry the time, never the treatment, and a deterministic check blocks clinical content from leaving in a draft. Use the service for scheduling, reminders, reviews, and front-desk logistics — never for clinical records or treatment communication. A BAA-capable tier is on the roadmap; until it ships, this is the honest boundary.

12. Cookies

We use only the cookies and local storage needed to sign you in and keep the service secure and working. We do not use advertising or cross-site tracking cookies. [If you add analytics, disclose it here and offer a choice where required.]

13. Children

The service is for businesses and is not directed to children under 16. We do not knowingly collect their personal data; if you believe a child has provided us data, contact us and we will delete it.

14. Changes

We may update this policy; we will post the new effective date and, for material changes, give notice. Your continued use after the effective date constitutes acceptance.

15. Contact

Privacy questions and requests: [privacy@yourdomain]. The Morna operating entity (registration pending), registered address: pending. [If you are required to appoint a Data Protection Officer or EU/UK representative, name them here.]