Privacy policy

What this policy covers

This policy covers the morfo.rest website. It does not cover the third-party services we link to, which have their own policies. Those include our newsletter on Substack, our social media accounts, and our reporting channel.

What we collect, and why

When you fill in a contact form. We collect your name, your email address, your company, your country, and whatever you write in the message field. Depending on which form you use, we also collect the information specific to that request, such as the type of project you are working on or the role you are applying for. We use this to answer you and, if it leads somewhere, to work with you.

When you start a diagnostic request. The diagnostic form has two steps.

We save your answers at the end of the first step, before you reach the second one. If you start the form and do not finish it, the information you already entered is stored.

We do this so you do not lose your work, and so we can follow up if you meant to continue. You can ask us to delete an unfinished request at any time.

When you use MORFINHO, our chat assistant. The messages you type are sent to a third-party model provider so that an answer can be generated. Do not enter personal information, confidential information, or commercial terms in the chat. If you want to discuss something specific to your project, use the contact form or write to us directly.

When you subscribe to our newsletter. The subscription is handled by Substack, on their platform. We receive your email address as a subscriber. Substack's own privacy policy applies to the subscription itself.

When you simply visit. Our hosting provider records technical information in server logs, including your IP address, your browser type, the pages you requested and the time of the request. This is how the website is kept running and protected against abuse.

Your language choice. If you use the language switcher, we store your choice in a cookie so that we do not have to guess again on your next visit.

What we do not do. We do not use advertising cookies. We do not track you across other websites. We do not build profiles. We do not sell or rent your data. We do not use your data to train models.

Why we are allowed to process it

Under the GDPR, we rely on:

• Steps taken before entering into a contract, for contact and diagnostic requests, because you are asking us about working together.
• Your consent, for the newsletter. You can withdraw it at any time using the unsubscribe link.
• Our legitimate interest, for keeping the website running, keeping it secure, and answering questions asked through the chat assistant.

Who else handles your data

We use a small number of service providers. Each one processes data on our instructions and nothing more.

Transfers outside the European Union. Several of these providers process data in the United States. Where that happens, the transfer is covered by the safeguards allowed under the GDPR, either the European Commission's standard contractual clauses or the EU to US Data Privacy Framework, either the European Commission's standard contractual clauses or the EU to US Data Privacy Framework.

We may also share data where the law requires it, for example in response to a valid request from a public authority.

How long we keep it

If we end up working together, information that forms part of the commercial relationship is kept for as long as the law requires us to keep business records.

Cookies

This website sets one cookie, and only if you use the language switcher.

That cookie exists because you asked for something, so we do not need your consent for it and there is no cookie banner on this site.

We do not set advertising cookies. We do not set analytics cookies.

You can delete cookies at any time in your browser settings. Every major browser explains how in its own help pages.

Your rights

If you are in the European Union, the GDPR gives you the right to ask us for a copy of the personal data we hold about you, to have it corrected if it is wrong, to have it deleted, to restrict how we use it, to object to our using it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.

If you are in Brazil, the LGPD gives you the right to confirm that we are processing your data and to access it, to have it corrected, to have it anonymised, blocked or deleted where it is unnecessary or excessive, to receive it in a portable format, to be told who we have shared it with, and to withdraw your consent.

Either way, write to plant@morfo.rest. We will answer within one month. If your request is complex we may need longer, and we will tell you if that happens.

Complaints

If you are not satisfied with how we have handled your data, you can complain to a supervisory authority.

In France, that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

In Brazil, that is the ANPD, gov.br/anpd.

Security

We limit access to personal data to the people who need it to do their work. Our providers are chosen in part for the security they offer. No website can promise absolute security, and we do not.

Changes to this policy

We update this policy when what we do with data changes. The date at the top tells you when it last changed. If a change matters to you, for example a new provider or a new purpose, we will say so on this page rather than change it quietly.

Contact

plant@morfo.rest, or SAS MORFO, 122 rue Amelot, 75011 Paris, France.