Global Privacy Policy

This Policy applies to individuals whose personal information MorrnIx processes through the Services or in connection with our business, including:

website visitors; and

individuals whose information is included in customer-provided project or procurement records.

MorrnIx is primarily a business-to-business service. The Services are intended for professional use rather than for children.

MorrnIx may have different privacy roles depending on the processing activity.

For information we process for our own business purposes—such as account administration, website operation, security, support, marketing, and legal compliance—MorrnIx may act as a controller or equivalent role under applicable law.

For customer-controlled project, procurement, supplier, and related business information, MorrnIx may act as a processor, service provider, or equivalent role on behalf of the customer. The customer may determine why that information is processed and how it should be retained.

The applicable customer agreement or Data Processing Agreement may contain more specific terms. This distinction follows the substance of the processing rather than simply the name of the parties or the product involved.

Depending on how the Services are used, MorrnIx may process:

user activity and technical information, such as browser, device, IP address, login activity, timestamps, errors, security events, and feature usage; and

information submitted in support, privacy, security, billing, or other business requests.

We aim to collect and process information that is relevant to the purposes described in this Policy and applicable agreements.

Customer business data may include commercially sensitive information even when it is not personal information.

Examples include procurement schedules, purchase orders, material requirements, supplier commitments, delivery expectations, project records, supplier communications, and procurement outcomes.

MorrnIx uses customer business data to provide the Services, including organizing procurement information, identifying changes or potential risks, supporting follow-up, maintaining relevant history, and providing authorized users with procurement intelligence.

MorrnIx does not treat customer business data as a public or general-purpose data source. Access is intended to be limited according to the customer's account configuration, user permissions, contractual arrangements, and applicable law.

We may receive information:

automatically from use of the Services, including technical and security information; and

from service providers or other third parties where reasonably necessary to provide, secure, support, or operate the Services.

We do not intentionally collect personal information simply because it is publicly available. We seek to process information relevant to the applicable purpose.

Depending on the circumstances, MorrnIx may process information to:

comply with legal obligations and respond to lawful requests; and

establish, exercise, or defend legal claims.

We will not use personal information for a materially incompatible purpose without an appropriate legal basis or other authorization required by applicable law.

MorrnIx may generate derived information from customer-provided procurement records, communications, and other business information. Depending on the Services available at the time, this may include statuses, classifications, alerts, summaries, risk indicators, commitment changes, response information, or other procurement-related outputs.

These outputs are intended to help people identify and respond to procurement problems. They are not a substitute for the customer's professional judgment.

MorrnIx does not make a procurement decision on behalf of a customer. Customers and authorized users remain responsible for decisions involving suppliers, materials, quantities, quality, timing, purchasing, project scheduling, and other business matters.

An alert or other output should not automatically be treated as proof that a supplier will fail or that a project will be delayed. Users should review the underlying information before taking material action.

Where implemented in a particular Service, MorrnIx may use rules-based automation, statistical methods, natural-language processing, machine-learning, artificial intelligence, or similar computational methods to organize information, extract relevant information, classify communications or records, generate summaries, identify patterns, or support procurement analysis.

Capabilities change as the product develops. A description of a possible or planned capability does not mean that the capability is currently available in every account.

Where automated processing is used, MorrnIx designs the Services to support human review and business decision-making rather than to transfer responsibility for procurement decisions to an automated system.

Customers should not submit information to an automated feature unless they are authorized to do so and understand the relevant customer agreement and feature documentation.

Where a customer enables a supported email or communication integration, MorrnIx may process information necessary to provide that integration.

Depending on the integration and permissions granted, this may include message content, sender and recipient information, timestamps, subject lines, attachments, message identifiers, delivery information, or other metadata.

MorrnIx may use communication information to support procurement follow-up, identify relevant changes or responses, maintain evidence and history, and provide features requested by the customer.

MorrnIx does not represent that every email provider or every possible mailbox feature is supported. The actual scope of access depends on the integration and permissions that are implemented and authorized.

Customers should review the permissions presented during an integration connection and disconnect an integration when it is no longer required.

GOOGLE ACCOUNT AND GMAIL DATA

When you connect a Google account to MorrnIx and authorize Gmail access, MorrnIx requests the Gmail gmail.send permission to allow you to send procurement-related emails from your connected Gmail account through MorrnIx.

MorrnIx uses this permission only to provide the email-sending functionality you initiate within the Services. For example, an authorized user may review, modify, approve, and send a procurement-related message to a supplier from MorrnIx.

MorrnIx does not use the gmail.send permission to read your Gmail inbox, search your Gmail messages, or access unrelated Google Account data. MorrnIx does not use Google user data for advertising or sell Google user data.

Google user data accessed through this permission is used only to provide the functionality described above and is handled in accordance with Google's applicable API Services User Data Policy and Limited Use requirements.

The Services may support multiple users within an organization. MorrnIx may process information about organization membership, roles, permissions, project access, and account administration to provide appropriate access and maintain security.

Customer administrators are responsible for configuring access appropriately and removing access when a person no longer requires it.

MorrnIx may log authentication, authorization, and security events to protect accounts and investigate suspected misuse or unauthorized access.

A supplier or other external business participant does not automatically become a MorrnIx user merely because its information appears in a customer's procurement records.

MorrnIx may use cookies, local storage, logs, SDKs, or similar technologies for authentication, security, preferences, service operation, performance measurement, troubleshooting, and analytics where implemented.

Technical information may include IP address, browser type, operating system, device information, timestamps, login activity, feature usage, error information, and security events.

Where applicable law requires consent for a particular technology, MorrnIx will use an appropriate consent mechanism. Browser or device controls may also allow certain technologies to be limited, although doing so can affect functionality.

Depending on the jurisdiction and processing activity, MorrnIx may rely on:

protection of vital interests where legally applicable; or

another lawful ground recognized by applicable law.

Where processing is based on consent, consent may generally be withdrawn, subject to legal limitations and the circumstances of the processing.

MorrnIx may use third-party providers for functions such as hosting, cloud infrastructure, authentication, communications, email delivery, data storage, security, monitoring, analytics, support, and other operational services.

A provider may process information only to the extent reasonably necessary for its contracted function and subject to appropriate contractual, security, and privacy safeguards.

For customer-controlled personal information processed as a processor, the use of subprocessors will be governed by the applicable customer agreement or Data Processing Agreement where required.

MorrnIx may provide or support integrations with third-party systems. When a customer enables an integration, information may move between MorrnIx and the third-party system according to the permissions, configuration, and feature involved.

Third-party services operate under their own terms and privacy practices. MorrnIx does not control independent processing performed by a third party outside MorrnIx's systems.

Customers should review the relevant third party's privacy documentation and permission model before enabling an integration.

MorrnIx and its service providers may process information in countries other than the country where an individual or customer is located.

Where applicable law restricts international transfers, MorrnIx will use a legally recognized transfer mechanism or other lawful basis appropriate to the relevant transfer.

Depending on the jurisdiction, safeguards may include an adequacy decision, contractual safeguards, consent where legally valid, or another mechanism recognized by applicable law.

Specific customer data-location or transfer requirements may be addressed in a customer agreement or Data Processing Agreement.

MorrnIx does not apply one universal retention period to every type of information. Retention depends on the purpose, nature, sensitivity, contractual requirements, security needs, legal obligations, and operational requirements applicable to the information.

For example, temporary security or diagnostic records may have different retention requirements from customer procurement history that is needed to understand project activity over time.

When information is no longer required for an applicable purpose, MorrnIx will delete, anonymize, de-identify, or otherwise securely dispose of it where appropriate, subject to legal obligations, contractual requirements, legitimate dispute or security needs, and backup or disaster-recovery processes.

Where MorrnIx processes customer-controlled information as a processor, customer retention and deletion instructions may be governed by the applicable agreement or Data Processing Agreement.

MorrnIx uses technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, loss, destruction, or other inappropriate processing.

Depending on the Service and information involved, safeguards may include authentication and access controls, permission management, encryption, logging, monitoring, rate limiting, secure infrastructure, backup and recovery controls, and other security practices.

Security controls are continuously subject to operational and technical change. No internet transmission or storage system can be guaranteed to be completely secure.

Customers and users also have responsibilities, including protecting credentials, limiting account access, configuring permissions appropriately, and reporting suspected security incidents.

MorrnIx may disclose information when reasonably necessary to provide the Services, operate our business, or comply with law. Recipients may include:

parties involved in a corporate transaction; and

other recipients where disclosure is authorized by the customer or individual or otherwise permitted by applicable law.

MorrnIx does not sell customer procurement information as a commercial data product.

We do not disclose customer procurement information to unrelated third parties merely because it may have commercial value.

Where permitted by applicable law and contractual commitments, MorrnIx may create aggregated, statistical, or de-identified information from information processed through the Services.

Such information may be used for legitimate purposes such as understanding service performance, improving products, developing services, identifying trends, security analysis, and business analytics.

Where information is represented as de-identified, MorrnIx will apply measures appropriate to the circumstances to reduce the risk that an individual can be identified from that information.

MorrnIx may send business or marketing communications where permitted by applicable law.

You may opt out of marketing communications using the unsubscribe mechanism in the communication or by contacting us.

Opting out of marketing does not stop transactional, administrative, security, account, or service communications that are necessary to provide the Services.

Depending on where you live and the applicable law, you may have rights including:

rights concerning certain automated decision-making; and

submission of a complaint to a relevant privacy or data-protection authority.

Additional rights may apply under regional laws, including laws that provide specific rights concerning sale or sharing of personal information, sensitive personal information, or targeted advertising.

Not every right applies in every jurisdiction, and lawful exceptions may apply.

If your information appears in a customer's project, supplier, procurement, or communication records, that customer may be the organization responsible for determining the purposes and means of processing.

For those requests, MorrnIx may direct you to the relevant customer or assist the customer as required by the applicable agreement and law.

For information MorrnIx controls directly, you may contact us using the details below. We may request information reasonably necessary to verify identity and protect personal information from unauthorized disclosure.

We will respond within the period required by applicable law. If we cannot fulfill a request, we will explain the reason where required or appropriate.

Where a regional privacy law applies to MorrnIx, we will provide the rights, disclosures, and request mechanisms required by that law.

For example, applicable California law may provide rights concerning knowing about personal information collected and used, deletion, correction, opting out of sale or sharing where applicable, limiting certain uses of sensitive personal information, and non-discrimination for exercising applicable rights.

MorrnIx does not state that every regional privacy law applies to every customer or processing activity. Applicability depends on the relevant jurisdiction, organization, individual, thresholds, Services, and processing activities.

The Services are intended for businesses and professional users and are not directed to children.

MorrnIx does not knowingly seek to collect personal information from children in circumstances where collection is prohibited by applicable law. If you believe that a child has provided information to MorrnIx in circumstances where it should not have been collected, please contact us.

If MorrnIx determines that a security incident has affected personal information, we will assess the incident and take reasonable steps appropriate to the circumstances.

Where applicable law or a customer agreement requires notification, MorrnIx will notify the appropriate party within the required timeframe or as otherwise required by the applicable agreement.

Where MorrnIx acts as a processor, we may notify the relevant customer so that the customer can meet its own legal and contractual obligations.

Personal information may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, dissolution, or similar corporate transaction, subject to applicable law.

MorrnIx may also disclose information when reasonably necessary to comply with law, respond to valid legal process, enforce agreements, investigate fraud or abuse, protect the security of the Services, or protect the rights, property, or safety of MorrnIx, customers, users, or others.

MorrnIx may update this Policy to reflect changes in the Services, processing practices, technologies, legal requirements, or business operations.

The “Last Updated” date at the beginning of this Policy identifies the current version.

Where a material change requires notice under applicable law, we may provide notice through the Services, website, email, or another appropriate method.

For privacy questions, privacy-rights requests, or concerns about our handling of information, contact:

MorrnIx

Privacy Contact: hello@morrnix.site

Website: MorrnIx website

If MorrnIx appoints a Data Protection Officer, privacy representative, or jurisdiction-specific privacy contact, the relevant contact information may be provided through applicable customer documentation or a jurisdiction-specific notice.

This Policy is intended to describe MorrnIx's privacy practices at a global baseline level. It is not a representation that MorrnIx automatically satisfies every privacy or data-protection requirement in every jurisdiction.

Legal compliance depends on the specific Services used, the data processed, the customer relationship, contractual arrangements, technical controls, organizational practices, and applicable law.

Customer-specific processing requirements may therefore be addressed through a Data Processing Agreement, security documentation, or other contractual terms.