Privacy Policy
This policy explains what personal information Moraph collects through its websites (www.moraph.com and the other moraph.com sites, including careers, documentation, the Academy, the Trust Center and service status) and through the client, partner, supplier and candidate portals; why we use it; who processes it for us; and how long we keep it. Information that clients put into Moraph software and managed platforms is handled under each client’s Master Services Agreement and Data Processing Addendum, which take precedence over this policy for that information.
1. What we collect
Account and sign-in information: your name, email address, phone number, organization and role when you create an account or are invited to one. Passwords are never stored in readable form: we keep only a salted PBKDF2-SHA256 hash of each password. Two-step verification secrets are stored encrypted. For security we keep sign-in records: when sessions start and end, your browser type, and a salted hash of your IP address that changes every day.
What you send us: enquiries and requests made through our forms, support tickets, messages, documents you upload, job applications, and feedback.
Technical information: our sites are hosted by Cloudflare, which processes your IP address and request details to deliver pages and protect them from attacks. With your consent, our own analytics records the pages you view, the referring site, campaign tags, your approximate country and your device type (it does not store IP addresses). Google Analytics sets cookies only with your consent; without it, it receives cookieless page-view signals with no identifier, as described in our Cookie Policy. We do not use device fingerprinting.
Business records: contracts, invoices and, for suppliers, payment details (bank details are stored encrypted). We do not take card payments on our websites.
2. Why we use it
To provide our services: to set up and run accounts, portals and the Moraph software and platforms our clients use.
To support you: our support teams in the Philippines, India and the United States use it to answer questions, handle incidents and help clients use our services.
To keep our services secure: to detect and stop misuse, fraud and attacks, using sign-in records and aggregated statistics.
To tell you about our services: service notices such as scheduled maintenance, security updates and changes to your account, and, where you have agreed, updates relevant to your sector.
To meet our legal obligations: under the laws that apply to us in each country where we operate, including data protection laws such as the GDPR and the CCPA, and the record-keeping rules that apply to our clients’ regulated activities (for example FINRA rules and HIPAA).
3. How we contact you
We may contact you by email, telephone, text message or post about your account, a support request, billing, or our agreements with you, and occasionally to ask for feedback. Marketing messages are sent only where the law allows and you can opt out at any time.
4. Data Retention & Control
We keep personal information only for as long as we need it for the purpose we collected it for, and longer only where the law requires. The periods below cover information collected through this website and our recruiting system; most are enforced by automatic deletion.
| Information | How long we keep it |
|---|---|
| Website analytics (pages viewed, referring site, campaign tags, approximate country, device type) | 13 months, then deleted automatically. Our own analytics does not store IP addresses. |
| Cookie consent records (your choices and an anonymous consent ID) | 25 months, then deleted automatically, so we can show which choice applied at the time. |
| Enquiries sent through our contact, get-started and evidence-request forms | As long as we need them to respond and to manage any resulting business relationship. We review enquiry records at least every 24 months and delete those we no longer need. |
| Job applications, including CVs, interview notes and voluntary self-identification answers | Deleted automatically two years after the application closes (withdrawn, not selected or hired), unless the law requires us to keep records longer. See our Candidate privacy notice. |
| Hiring-system sign-in and security records | Sign-in sessions expire after 12 hours. Expired invitation, password-reset and candidate status links are deleted 30 days after they expire. Audit logs are deleted after 24 months. |
| Contracts, invoices and billing records | For the period required by applicable tax, accounting and contract law. |
| Client data processed in our SaaS products and managed platforms | As set out in the client’s Master Services Agreement and Data Processing Addendum, including return and deletion at the end of the engagement. |
If you would like us to delete your information sooner, or to stop processing it, email our Data Protection Office at privacy@moraph.com. If we must keep certain records for legal or audit reasons, we will tell you which ones and why.
5. Changes to this policy
We may update this policy when our services or the law change. The date at the end shows when it last changed. If we make a material change, we will say so on this page and, where appropriate, tell account holders directly before the change takes effect.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to complain to your data protection authority. To use any of these rights, email privacy@moraph.com with the subject line “Data subject request”. If you use Moraph software through your organization, we may refer your request to your organization, which controls that information.
Last updated October 15, 2026.
Cookies
How we use cookies and similar technologies, and how to change your choices, is explained in our Cookie Policy.