This Privacy Policy explains how Morpheus AI Ltd ('Morpheus', 'we', 'us', 'our') collects, uses, and stores personal data. It applies to everyone who interacts with our services, including:
Founders and entrepreneurs who use the Morpheus Founder Service to submit pitch decks and receive fund assessment reports.
Funds and investment firms who use the Morpheus platform to manage deal flow and investment workflows.
Where this policy refers to practices that differ between these two groups, we'll say so clearly. Where it doesn't distinguish, it applies to both.
Morpheus AI Ltd is registered in England and Wales (Company Number 17101516) at Arquen House, 4-6 Spicer Street, St Albans, AL3 4PQ, United Kingdom. We are the data controller for all personal data collected through our services.
If you have any questions about how we handle your data, please contact us at hello@usemorpheus.ai.
1. What Data We Collect
The data we collect depends on how you interact with Morpheus. Here's a breakdown by user type.
If you are a founder using the Morpheus Founder Service
- Your name and email address, provided during form submission
- Your company name and details about your startup, as included in your submission
- Your pitch deck and any supporting materials you upload
- Your payment information, processed via Stripe (we do not store card details directly - these are handled by Stripe)
- Your submission preferences, including which funds you selected and whether you opted in to deck submission
- Communications between you and us, such as emails relating to your report
If you are a fund or investment firm using the Morpheus platform
- Contact details for individuals at your fund, including name, email address, and role
- Information about your fund's investment thesis, sector focus, and preferences, which you provide during onboarding
- Deal flow data, notes, and activity generated through your use of the platform
- Payment and billing information
- Communications between you and us
Data we collect from all users
- Basic technical data such as IP address and browser type, collected when you visit usemorpheus.ai
- Any correspondence you send us directly
What we don't collect
We do not collect special category data as defined under UK GDPR - such as health information, ethnicity, or political opinions - and we have no reason to. If any such data appears incidentally in a pitch deck or submission, it is not processed or stored for any separate purpose.
2. Why We Collect Your Data and Our Legal Basis
We only collect and process personal data when we have a lawful reason to do so under UK GDPR. Here's what that means in practice
To fulfil our services to you (legal basis: performance of a contract)
When you submit a pitch deck or purchase a report, we process your data to deliver what you've paid for. For funds, we process contact and thesis data to set up and run your Morpheus account. Without this data, we can't provide the service.
To process payments (legal basis: performance of a contract)
We collect payment-related data to complete transactions via Stripe. We do not store card details ourselves.
To submit your deck to funds, where you have opted in (legal basis: consent)
If you explicitly choose to submit your deck to one or more funds, we process that data based on your consent. You can withdraw this at any time by contacting us at hello@usemorpheus.ai, though note that if a submission has already been made it cannot be recalled.
To improve and train the Morpheus platform (legal basis: legitimate interests)
We use anonymised, aggregated data derived from submissions and platform activity to improve Morpheus's AI models. This data cannot be used to identify you. If you have concerns about this, you can object by contacting us and we will assess your request.
To communicate with you (legal basis: legitimate interests)
We may contact you to deliver your report, respond to queries, or send relevant updates about our services. We will not send you unsolicited marketing without your consent.
To comply with legal obligations (legal basis: legal compliance)
We retain certain data, particularly payment records, to meet our obligations under UK law.
3. How We Use Your Data
Here's a plain summary of what we actually do with the data we collect, depending on who you are.
If you are a founder
- We use your name, email, and submission details to process your order and deliver your report.
- We use your pitch deck to generate your AI assessment. Your deck is stored securely and is not shared with any fund unless you have explicitly opted in to deck submission.
- If you opted in to deck submission, we use your deck and contact details to reach out to your selected funds as described in our Founder Service Terms.
- We use your email address to send you your report and any follow-up communications relating to your submission.
- We may use anonymised, aggregated data derived from your submission to improve the Morpheus platform and its AI models. This means we might use patterns and signals from submissions - such as how decks are structured or how they score against fund criteria - to make our models more accurate over time. This data is stripped of anything that could identify you or your company before it is used for this purpose.
If you are a fund
- We use your contact and thesis data to configure your Morpheus account and tailor the platform to your fund.
- We use your deal flow activity and feedback to improve how Morpheus learns your preferences over time. This is core to how the product works.
- We may use anonymised, aggregated data derived from fund activity to improve the platform more broadly.
For all users
- We use technical data from website visits to maintain and improve usemorpheus.ai.
- We use contact details to respond to any queries or complaints you raise with us.
What we will never do:
We will never sell your personal data to third parties. We will never use your pitch deck or fund data for any purpose unrelated to delivering our services and improving our platform in the ways described above.
4. Who We Share Your Data With
We do not sell your data or share it for advertising purposes. We share data only where necessary to deliver our services or comply with the law. Here's who that involves:
Tally (tally.so)
We use Tally to power our founder submission form. When you complete a submission, your form data - including your name, email, company details, and any files you upload - is processed by Tally. Tally is an EU-based company (Belgium) and is fully GDPR compliant. Your data is stored encrypted on Tally's servers within the EU. You can read Tally's privacy policy at tally.so/help/privacy-policy.
Stripe
We use Stripe to process payments. When you pay for a report, your card details are handled directly by Stripe and are never stored by Morpheus. Stripe is certified to PCI DSS Level 1, the highest standard for payment security. Stripe may process data in the US, subject to appropriate GDPR safeguards. You can read Stripe's privacy policy at stripe.com/gb/privacy.
Funds, where you have opted in If you have explicitly chosen to submit your deck to one or more funds, we will share your deck and basic contact details with those funds as described in our Founder Service Terms. We will only ever share your deck with funds you have specifically selected. We will never share it without your explicit opt-in.
Law enforcement or regulatory authorities
We may disclose personal data if required to do so by law, court order, or regulatory authority. We will notify you where we are legally permitted to do so.
If Morpheus is acquired or restructured
In the event of a merger, acquisition, or sale of the business, your data may be transferred to the new entity. We will notify you in advance if this occurs and ensure appropriate protections remain in place.
5. Where Your Data Is Stored
Morpheus AI Ltd is a UK-registered company. Our own systems and infrastructure are based in the UK and Sweden, both of which operate under equivalent data protection frameworks - the UK GDPR and the EU GDPR respectively.
Tally stores form submission data on servers within the EU (hosted via Google Cloud in Belgium). All data is encrypted in transit and at rest.
Stripe processes payment data in the United States. This transfer is covered by appropriate GDPR safeguards, including standard contractual clauses, meaning your data is protected to an equivalent standard regardless of where it is processed.
If you are based outside the UK or EU, by using our services you consent to your data being transferred to and processed in the UK and EU in accordance with this Privacy Policy.
We will always tell you if our data storage arrangements change in a way that affects this.
6. How Long We Keep Your Data
We only keep your data for as long as necessary for the purpose it was collected, or as required by law. Here's what that means in practice:
Founder submission data and pitch decks
We retain your submission data, including your pitch deck, for 2 years from the date of submission. After this period, your data will be deleted or anonymised.
Fund contact and account data
We retain contact and account data for funds for 2 years from the date of last activity or contact. If your fund is an active Morpheus customer, we retain your data for the duration of your contract and for 2 years thereafter.
Payment records
We retain payment and transaction records for 7 years from the date of the transaction, as required by UK financial record-keeping law.
Communications
Emails and other correspondence are retained for 2 years from the date of the last communication, unless they relate to a legal dispute or complaint, in which case we may retain them for longer.
AI training data
Anonymised and aggregated data used to improve our platform is not subject to a fixed retention period, as it cannot be linked back to any individual and is therefore no longer personal data under UK GDPR.
Legal disputes
If a complaint or legal dispute arises, we may retain relevant data beyond the periods above until the matter is fully resolved.
If you would like us to delete your data before the end of the applicable retention period, please contact us at hello@usemorpheus.ai. We will action your request where we are not legally required to retain the data.
7. Your Rights Under UK GDPR
Under UK GDPR, you have the following rights in relation to your personal data. These apply to both founders and funds.
Right to access
You can request a copy of the personal data we hold about you at any time. We will respond within one month of receiving your request.
Right to rectification
If any data we hold about you is inaccurate or incomplete, you can ask us to correct it.
Right to erasure
You can ask us to delete your personal data where we no longer have a legitimate reason to hold it. Note that we may not always be able to comply - for example, where we are legally required to retain certain records.
Right to restrict
processing You can ask us to pause the processing of your data in certain circumstances - for example, if you have contested its accuracy and want us to verify it before using it further.
Right to data portability
Where we process your data on the basis of your consent or a contract, you can ask us to provide it in a structured, commonly used format so you can transfer it elsewhere.
Right to object
You can object to us processing your data where we are relying on legitimate interests as our legal basis. We will stop processing unless we have compelling grounds to continue. You can also object at any time to your data being used for direct marketing, with no need to provide a reason.
Rights related to automated decision-making
Morpheus uses AI to generate reports and assessments. While these outputs are AI-generated, no fully automated decision is made about you without a human review process being available. If you have concerns about how an AI-generated output has affected you, please contact us and we will review it.
How to exercise your rights
To make any request under the above, please contact us at hello@usemorpheus.ai. We will respond within one month. We may ask you to verify your identity before actioning your request.
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can reach them at ico.org.uk or by calling 0303 123 1113. We would always prefer the chance to address your concern directly first, so please contact us in the first instance.
8. Data Security
We take the security of your personal data seriously. Here's what we do to protect it:
Access controls
Access to personal data within Morpheus is restricted to those who need it to perform their role. All staff are bound by confidentiality obligations.
Encryption
Data transmitted to and from our services is encrypted in transit. Data stored on our systems and through our third-party providers is encrypted at rest.
Third-party security
We only work with third-party providers who meet appropriate security standards. Tally stores form data encrypted on high-security EU servers. Stripe is certified to PCI DSS Level 1 for payment security.
Data breach response
In the event of a personal data breach that is likely to affect your rights or freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by UK GDPR. Where required, we will also notify you directly without undue delay.
Your responsibility
If you correspond with us by email, please be aware that email is not a fully secure medium. We recommend you do not include sensitive personal information in unsolicited emails to us.
Limitations
While we take all reasonable steps to protect your data, no system is completely secure. We cannot guarantee the absolute security of data transmitted over the internet.
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or how we handle data.
When we make changes, we will update the "Last updated" date at the top of this document. If we make a material change - one that significantly affects how we use your data - we will notify you directly by email where we hold your contact details.
We encourage you to review this policy periodically. Continued use of our services after any changes have been posted constitutes your acceptance of the updated policy.
10. Contact Us
If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how we have handled your personal data, please get in touch:
Morpheus AI Ltd Arquen House, 4-6 Spicer Street St Albans, AL3 4PQ United Kingdom
For complaints, you also have the right to contact the Information Commissioner's Office directly at ico.org.uk.