Privacy Policy
Last updated: 12 October 2026
This Privacy Policy explains how Morano (“Morano”, “we”, “us” or “our”) collects, uses, shares, transfers, retains and protects personal data when you visit morano.ai (the “Site”), use the Morano product (the “Service”), correspond with us, receive communications from us, or appear in the public sources the Service reads. It also describes the rights you have under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, and how to exercise them.
Please read this policy carefully. If you do not agree with it, do not use the Site or the Service. By continuing to use either, you acknowledge that you have read and understood this policy.
1. Scope and who we are
Morano operates the Site and the Service, a product that records what AI assistants answer to buyers’ questions about a category, which sources those answers cite, and what a brand or its agency can do about it. This policy applies to personal data processed by Morano as a controller, as set out in sections 2 to 4, and describes in section 5 how we handle the data that customers place in the Service.
This policy does not apply to the websites, products or services of third parties, including the AI assistants whose public answers the Service records and the websites those answers cite. Each of those is governed by its own privacy notice.
For the purposes of UK GDPR, the controller of the personal data described in this policy is Morano, trading at morano.ai. Our contact details are in section 15.
2. Personal data we collect
2.1 Information you provide to us
Account information. When an account is created for you, or you are invited into a customer’s workspace, we collect your email address. We use it to sign you in, to send you one-time sign-in codes, and to send invitations and service messages. We do not collect a password: sign-in is by code.
Workspace content. Customers configure the Service with the brands and competitors they track, the questions they ask about them, and their decisions on the actions the Service suggests. This content is described in section 5.
Correspondence. When you email us, book a demo, or otherwise contact us, we collect the information you choose to provide, including your name, email address, organisation and the content of your message.
2.2 Information we collect automatically
Usage information. When you use the Service we record how it is used: sign-ins, which screens are opened, and when a plan or report is copied or printed. This record carries account and workspace reference numbers, never your name, your email address or your clients’ names.
Fault reports. When something breaks we record where in our code it happened, on which screen and in which browser, with your account reference number, so that we can fix it. Email addresses and web addresses are removed from a report before it is sent, and it never includes what is on your screen. On the public pages of the Site, a fault report carries no account reference: the report does not identify you.
Server logs. Our servers keep routine logs of requests, including internet protocol addresses, for security and for finding faults.
Site analytics. On the public pages of the Site we collect the information described in section 10.
2.3 Information from public sources and AI assistants
To show which sources shape an AI answer, the Service puts customers’ questions to AI assistants, records their public answers, reads the public web pages those answers cite, and records an author’s name as it is published there. Where a public answer or a cited page names an individual, that name is recorded as part of the answer or the page. We do not combine it with other information about that individual.
Where we write to you about Morano, we collect your name, role, work email address and organisation from public professional sources, as described in section 11.
3. How we use personal data
We use personal data for the following purposes:
- to provide, operate, maintain and secure the Site and the Service, including signing you in;
- to send you service messages, sign-in codes and invitations;
- to respond to your enquiries, requests and demo bookings;
- to find and fix faults, and to understand how the Service is used so that we can improve it;
- to count visits to the public pages of the Site and understand which parts are read;
- to tell agencies and brands about Morano, as described in section 11;
- to comply with legal obligations, and to establish, exercise or defend legal claims; and
- to keep records of requests made under section 12 and how we answered them.
We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models. We do not make decisions about you by automated means that produce legal or similarly significant effects.
4. Our lawful bases
Under UK GDPR we must have a lawful basis for each use of personal data. We rely on the following:
| Purpose | Lawful basis |
|---|---|
| Providing the Service to a customer and its users, including sign-in and service messages | Performance of a contract (Article 6(1)(b)) |
| Responding to enquiries and demo bookings | Our legitimate interest in answering the people who contact us |
| Usage records, fault reports and server logs | Our legitimate interest in running a secure, reliable product and improving it |
| Counting visits to the public pages of the Site | Our legitimate interest in understanding how the Site is read, subject to the choices in section 10 |
| Recording public AI answers and the public pages they cite | Our legitimate interest in showing customers which sources shape an AI answer |
| Writing to agencies and brands about Morano | Our legitimate interest in telling the businesses it is built for about it, subject to your right to object |
| Keeping records and answering requests under section 12 | Compliance with a legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interest is not overridden by your interests, rights and freedoms. You may ask us for information about that assessment, and you may object as described in section 12.
5. Customer data and your workspace
A workspace is what a customer sets up in the Service: the brands and competitors it tracks, the questions it asks about them, the AI answers we collect for those questions, the sources the answers cite, and its decisions on the actions we suggest (“Customer Data”). Customer Data belongs to the customer. We process it to provide the Service to that customer and to improve the Service, and for no other purpose. We do not sell it, we do not use it for advertising, and we do not use it to train AI models.
The AI models that read each collected answer on a customer’s behalf run in a cloud provider’s European regions. That provider does not retain the content sent to those models and does not use it to train them.
Customer Data is accessible to the users the customer invites into its account, and to the people who run Morano where this is needed to support the customer or to fix a fault. It is not accessible to anyone else.
A pitch check run by an agency for a prospective client holds the prospect’s brand, its website and what it sells, never a person, and is kept with the workspace of the agency that ran it.
If you are a user of a customer’s workspace and have a question about Customer Data, please contact that customer in the first instance.
6. How we share personal data
We share personal data only as described in this section. We do not sell personal data and we do not share it with anyone for their own advertising.
6.1 Service providers
We use third-party service providers who process personal data on our behalf, under contract, and only to provide their service to us. The categories are set out below. Email us and we will name them.
| Category | What it processes | Where |
|---|---|---|
| A cloud provider | Hosting, the database, sign-in, the emails we send you, and the AI models that read each answer. | London, with the AI models running in its European regions. |
| A product-analytics service | The visit counts and the usage record described above. | The European Union. |
| An error-reporting service | The fault reports described above. | The European Union. |
| A service that collects AI answers | Puts the questions being tracked to the AI assistants and returns their public answers. It receives the questions, and nothing about you or your account. | Nothing personal reaches it. |
| An email and documents provider | Our own email, including anything you send us, and our working documents. | The European Union and the United States, under the UK’s data bridge. |
| A booking service | Demo bookings, if you make one. It shows you its own notice when you book. | The United States, under the UK’s data bridge. |
That is six categories of service provider. The usage records in section 2.2 are held by the product-analytics service and the fault reports by the error-reporting service, each in the European Union, and neither record carries a name.
6.2 Other disclosures
We may disclose personal data where required to do so by law, regulation or legal process; where necessary to establish, exercise or defend legal claims; or where necessary to protect the rights, property or safety of Morano, our customers or others. If Morano’s business is transferred to another organisation, personal data may be transferred to it as part of that transaction, and this policy will continue to apply to it until you are told otherwise.
7. International transfers
We are based in the United Kingdom. Customer Data and account information are held in London. Usage records and fault reports are held in the European Union, which the United Kingdom has found to provide adequate protection for personal data.
Two categories of service provider process personal data in the United States: our email and documents provider, which holds our correspondence and working documents, and the booking service, which processes a demo booking if you make one. Each is certified under the UK Extension to the EU–U.S. Data Privacy Framework, which the United Kingdom recognises as providing adequate protection. You may ask us for a copy of the applicable safeguards.
The service that puts customers’ questions to AI assistants receives the questions and nothing about you or your account, so no personal data is transferred to it.
8. Data retention
We keep personal data for no longer than is necessary for the purposes for which it was collected, and for the periods set out below. Where a period has not been fixed, we state the criteria we use.
| Data | Retention |
|---|---|
| Account information and Customer Data | For as long as the customer relationship continues. Deleted on request, with the last backup expiring fourteen days later. |
| Sign-in cookie | Expires after eight hours, after which you sign in again. |
| Server logs | Kept for thirty days. |
| Usage records and fault reports | Held by the service provider in section 6.1 for its standard retention period. Neither carries a name. |
| Correspondence and demo bookings | For as long as needed to deal with the matter, and afterwards as a record of it. |
| Details of people we write to about Morano | Kept for twelve months after our last message, unless you reply. If you ask us not to write, we keep your email address on a suppression list for as long as needed to honour that request. |
| Public AI answers and the author names in cited pages | For as long as the customer check that recorded them is kept. Removed on request, as described in section 12. |
| Records of requests under section 12 | For as long as needed to demonstrate compliance. |
9. Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. Customer Data and account information are held in a cloud provider’s data centres in London, encrypted at rest and in transit, with daily backups retained for fourteen days and deletion protection on the database. Access is limited to the people who run Morano. Sign-in is by one-time code sent to your email address, and sessions expire after eight hours.
No method of transmission over the internet or of electronic storage is completely secure. If you believe your account has been compromised, please contact us at once using the details in section 15.
10. Cookies, local storage and analytics
10.1 Strictly necessary cookies
When you sign in to the Service we set a cookie that signs you in and keeps you signed in for up to eight hours. It is required for the Service to work. We set nothing for advertising or tracking.
10.2 Analytics on the public pages of the Site
We count visits to these public pages, to see which parts are read. A visit records the page you opened, how far down it you read, which buttons and links you pressed, the site that sent you here, and your kind of browser and device. A product-analytics service in the European Union keeps the count for us and works out roughly where a visit came from, by country and city, from your internet address.
To tell a returning visitor from a new one, a random number is kept in your browser’s storage. It is not an advertising cookie, it holds nothing about you, and nothing on these pages follows you to other sites. If your browser asks sites not to track you, we count nothing. You can also switch it off here:
No analytics run inside the Service once you have signed in, and no visit to a page that names a customer or a client is counted.
10.3 Third-party services
If you book a demo, a booking service handles the booking and shows you its own notice. If a page breaks in your browser, it sends us a report of the fault: where in our code it happened, and in which browser. The report does not identify you.
11. Marketing communications
Morano is built for agencies and the brands they work with, and we may write to the people who run them to tell them about it. If you hear from us in this way, your name, role, work email address and organisation came from public professional sources, such as your organisation’s website, its press coverage, or your professional profile. With them we may hold one check of what AI assistants say about your organisation, or a client it names publicly, so that the message says something true.
We rely on our legitimate interest in telling agencies and brands about a product made for them (section 4). Every message identifies the sender, links to this policy and explains how to opt out. We keep your details for twelve months after our last message, unless you reply.
You have an absolute right to object to direct marketing. To exercise it, reply “no thanks” to any message or email jess@morano.ai. We will not write to you again, and we will keep your email address on a suppression list for that purpose only.
12. Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Access: to ask for a copy of the personal data we hold about you, and information about how we use it.
- Rectification: to ask us to correct personal data that is inaccurate or incomplete.
- Erasure: to ask us to delete your personal data in certain circumstances, including where it is no longer necessary for the purpose it was collected for.
- Restriction: to ask us to restrict how we use your personal data in certain circumstances.
- Portability: to receive the personal data you provided to us in a structured, commonly used, machine-readable format, where we process it by automated means on the basis of a contract.
- Objection: to object to processing based on our legitimate interests, and at any time to object to direct marketing.
If you are named in a public source that the Service has recorded and would like your name removed from our records, you may ask us under the same rights.
To exercise any of these rights, email jess@morano.ai. We may need to verify your identity before acting on a request. We will respond within one month of receiving it, or tell you within that time if we need longer and why. These rights are not absolute and may be subject to exemptions under the Data Protection Act 2018; where we rely on one, we will tell you.
If you are unhappy with how we have handled your personal data or your request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by telephone on 0303 123 1113. We would appreciate the chance to deal with your concern first.
13. Children
The Site and the Service are intended for businesses and their personnel. They are not directed to children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time to reflect changes in the Service, in the law or in our practices. When we do, we will revise the “Last updated” date at the top of this page. Where a change materially affects how we use personal data, we will notify the owners of customer accounts by email before it takes effect. The current version of this policy is always available at morano.ai/privacy.
15. Contact us
Questions, requests and complaints about this policy or about how we handle personal data should be sent to jess@morano.ai. We aim to acknowledge every message within five working days.