Privacy Policy

1. Who we are and how to contact us

Morganson is operated in the United Kingdom.

• Email: hello@morganson.co
• Website: https://morganson.co

2. The personal data we collect

We collect and process the following categories of personal data:

• Account data: your email address and an encrypted (hashed) password, created when you register. Authentication is handled by our processor, Supabase.
• Profile data: information you add to your profile to personalise job matching, such as your job preferences, target roles, locations, experience level and salary expectations.
• CV and career data: the content of any CV or résumé you upload, and the improved versions generated for you. A CV may contain a wide range of personal data about you (for example your name, contact details, employment history, education and skills), and may sometimes include special category data if you choose to include it.
• Chat and “memories” data:the messages you exchange with the AI assistant and the notes (“memories”) it saves to give you more relevant help over time.
• Job activity data: the jobs and links you save, your searches, and salary queries you run.
• Communications and alerts data: if you opt in to job digests, the email address and/or WhatsApp phone number you provide for delivery, and your alert preferences (frequency, channels).
• Payment data: when you buy credits, our payment processor Stripe collects your payment details. We do not receive or store your full card number — we receive only a confirmation of payment and limited transaction metadata.
• Technical and usage data:limited technical information necessary to run the Service securely, such as authentication cookies and basic request logs. See “Cookies” below.

3. How and why we use your personal data (legal bases)

Under UK GDPR we must have a lawful basis for each use of your personal data. We rely on the following:

• To provide the Service (contract): creating and maintaining your account, storing your profile and CV, running searches, generating AI responses and CV improvements, saving jobs, and processing your credit purchases. This processing is necessary to perform our contract with you.
• To send job digests (consent): where you opt in to email or WhatsApp job alerts, we process your contact details on the basis of your consent, which you can withdraw at any time.
• To keep the Service secure and improve it (legitimate interests): preventing fraud and abuse, debugging, maintaining security, and understanding aggregate usage. We balance these interests against your rights.
• To comply with the law (legal obligation): for example keeping records required for tax and accounting, and responding to lawful requests.

4. Artificial intelligence and automated processing

The Service uses artificial intelligence to answer your questions, improve your CV and help you find roles. AI processing is carried out by our processor, Anthropic, which provides the underlying language models. When you use these features, the relevant content (for example your message or CV text) is sent to Anthropic solely to generate a response for you.

We do not use your personal data, CV content or chat messages to train AI models, and our AI processor operates under contractual terms that restrict use of your data to providing the service to us. AI-generated output (including salary estimates and CV suggestions) may be inaccurate and does not constitute professional, career, financial or legal advice. We do not make solely automated decisions that produce legal or similarly significant effects on you.

Anthropic embeds a machine-readable watermark in text generated by its AI models, in line with EU AI Act transparency rules. The watermark identifies text as AI-generated; it does not contain your personal data. It is applied by Anthropic at the model level and cannot be removed by us. Read more on our AI transparency page.

5. Who we share your personal data with

We do not sell your personal data. We share it only with the service providers (“processors”) that enable us to run Morganson, and only as needed:

• Supabase: database, authentication and file storage. Your account, profile, CV and activity data are stored here. Our database is hosted in the European Union (Central region).
• Anthropic: AI processing of your prompts, CV content and chat messages to generate responses.
• Stripe: secure processing of credit-pack payments.
• Resend: delivery of job-digest and account emails, where you have opted in.
• Meta Platforms (WhatsApp Business): delivery of WhatsApp job digests, where you have opted in and provided a number.
• Vercel: hosting and serving of the website and application.

Each processor may only use your data on our instructions and under a data processing agreement. We may also disclose personal data where required by law, to protect our legal rights, or in connection with a sale or restructuring of the business.

6. International data transfers

Our primary database is hosted in the European Union. However, some of our processors (including Anthropic, Stripe and Meta) may process data outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations — to ensure your data remains protected.

7. How long we keep your data

We keep your personal data for as long as your account is active, so that we can provide the Service to you. If you delete your account (see below), we delete the personal data associated with it, except where we are required to retain limited records for legal, tax or accounting purposes, or to resolve disputes and enforce our agreements. Backups are cycled and overwritten in the ordinary course.

8. Your rights

Under UK data protection law you have the following rights in relation to your personal data:

• the right to be informed about how we use your data;
• the right of access to a copy of the data we hold about you;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure (“the right to be forgotten”);
• the right to restrict processing in certain circumstances;
• the right to data portability;
• the right to object to processing based on our legitimate interests, and to object to direct marketing at any time;
• the right to withdraw consent at any time, where we rely on consent (for example, job digests).

To exercise any of these rights, email us at hello@morganson.co. We will respond within one month. Exercising your rights is free of charge in most cases.

9. Deleting your account and data

You can request deletion of your account at any time by emailing hello@morganson.co. When your account is deleted, the personal data linked to it — including your profile, uploaded CVs, saved jobs, chat history and memories — is removed from our live database. Any remaining credit balance is forfeited on deletion (see our Terms and Conditions).

10. Cookies

Morganson uses only strictly necessary cookies. Specifically, we use authentication cookies set by Supabase to keep you securely signed in. We do not use advertising cookies, third-party tracking cookies or non-essential analytics cookies. Because we use only strictly necessary cookies, no cookie-consent banner is required; you can control or clear cookies through your browser settings, though doing so may prevent you from staying signed in.

11. How we protect your data

We take appropriate technical and organisational measures to protect your personal data, including encryption of data in transit, hashing of passwords, access controls, and reputable infrastructure providers. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

12. Children

The Service is not intended for anyone under the age of 18, and we do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Effective” date at the top and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Complaints

If you have concerns about how we handle your personal data, please contact us first at hello@morganson.coso we can try to resolve them. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk.