Data Protection & Security Notice
Last updated: October 17, 2026 · MorSal Technologies LLC
This notice describes how MorSal Technologies LLC protects personal and business data. It supplements our Privacy Policy and applies to website visitors, prospects and customers. Specific projects may be governed by a signed agreement (for example a Master Services Agreement, Statement of Work or Data Processing Addendum), which prevails over this notice if they conflict.
1. Our roles
Website visitors and prospects: MorSal decides why and how this personal information is used (a “business” or “controller”).
Customer data in our services: when we build, host or operate software, SaaS or AI solutions for a customer, we process the customer’s data on the customer’s instructions as a “service provider” or “processor,” under a written agreement. The customer remains responsible for having a lawful basis to provide that data to us.
2. Security program
We maintain safeguards appropriate to the sensitivity of the data. Measures we apply or require from our providers include, as applicable:
- encryption in transit (HTTPS/TLS with HSTS) and encryption at rest for managed data stores where available;
- role-based access, least-privilege principles and strong authentication for administrative systems;
- separation of customer environments and secrets management for credentials and API keys;
- logging and monitoring of critical systems, and timely application of security updates;
- backups and recovery procedures for production systems;
- security review of third-party providers and code dependencies;
- confidentiality obligations for personnel and contractors.
Security is a shared effort: customers must protect their own credentials and notify us promptly of suspected misuse.
3. Customer data and AI
When we implement AI for a customer:
- we use the customer’s data only to deliver and support the contracted services, unless the customer agrees otherwise in writing;
- unless agreed in writing, we do not use Customer Data to train general-purpose models that we offer to other customers;
- we apply data minimization: we ask for, and keep, only the data needed for the use case;
- AI outputs can be incomplete or wrong; human review is recommended for decisions that affect people’s rights or finances;
- we design solutions to avoid unlawful discrimination and to be explainable at a level appropriate to the use case;
- if third-party AI model providers are used, we will identify them in the project documentation and select terms that restrict their use of the data to providing the service.
4. Subprocessors and service providers
We use vendors to run our business and, where applicable, customer projects. For this website they currently include:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | DNS, CDN, security and performance | United States / global network |
| EmailJS | Delivery of contact-form messages to our mailbox | Third-party service |
| Our web hosting provider | Hosting of website files | Provided on request |
| Our email/productivity provider | Corporate mailbox and collaboration | Provided on request |
| Google LLC (Google Analytics 4) | Website analytics — only with your consent | United States |
| Meta Platforms, Inc. (WhatsApp) | Messaging, only if you contact us there | Global |
Project-specific subprocessors are listed in the relevant agreement or provided on request. We require our providers to protect the data and to use it only for the agreed purposes.
5. International transfers
Data may be processed in the United States and, through our affiliate MorSal S.A.S., in Colombia. We rely on contractual commitments and, where required by law for specific projects, recognized transfer mechanisms.
6. Security incidents and breach notification
We maintain an incident-response process: contain, investigate, remediate, and notify. If an incident compromises personal information, we will notify affected individuals, customers and regulators as required by applicable law, including state data-breach laws such as the Florida Information Protection Act (Fla. Stat. § 501.171), and, for customer data, within the time set in the customer’s agreement. To report a vulnerability or incident, email [email protected] (see also security.txt).
7. Retention and deletion
We keep data only as long as needed for the purposes described in the Privacy Policy or the customer agreement. At the end of an engagement, customer data is returned or deleted on request and otherwise deleted within a reasonable period (generally within 90 days), except where law requires retention. Backups age out on their normal cycle.
8. Requests from individuals
To access, correct, delete or otherwise exercise your privacy rights, follow the process in the “Your privacy choices and rights” section of our Privacy Policy. If we hold your data only as a service provider for one of our customers, we will direct your request to that customer.
9. Information you should not send us
Please do not send through the website or unsolicited email: Social Security numbers or other government IDs, payment card numbers, bank credentials, passwords, or protected health information. If a project requires regulated data (for example health data under HIPAA or card data under PCI DSS), we will agree on the required terms and secure channels first.
10. Contact
Data protection and security inquiries: [email protected] · +1 786 435 0808.
Notices address: MorSal Technologies LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.