1. Who we are
Morpheus AI Ltd ("Morpheus", "we", "us") is a company registered in England and Wales, company number 17101516. Our registered office is Arquen House, 4–6 Spicer Street, St Albans, AL3 4PQ, United Kingdom. We are registered with the Information Commissioner's Office under number ZC199397.
Our CEO is our Privacy Lead and is responsible for how we handle personal data. We have not appointed a Data Protection Officer, because the law does not require one for a business of our type and size.
To ask a question about this policy or your personal data, email hello@usemorpheus.ai or write to us at our registered office.
2. What this policy covers
This policy explains how we handle personal data across three services:
- our website, usemorpheus.ai;
- the Morpheus investor platform at app.usemorpheus.ai, which venture funds use to assess the deals they receive;
- the Morpheus founder service at founders.usemorpheus.ai, which founders use to get AI assessments of their pitch deck and, if they choose, submit it to funds.
Where we decide how data is used, we are the controller. That covers website visitors, people with an account on either service, founders who use the founder service, and anyone who contacts us.
Where we act for a fund, the fund is the controller. When a fund uploads deal data to the investor platform, such as pitch decks and other documents about a company and its team, we process it only to provide the platform to that fund. This includes everything we generate from it, such as extracted facts, screening results, reports and enrichment. The fund decides how that data is used, and its own privacy notice applies. This policy explains how we handle it on the fund's behalf.
When a founder chooses to submit a deck to a fund that uses Morpheus, the deck enters that fund's workspace, and from then on the fund controls it.
3. Personal data we collect
| Whose data | What we collect | Where it comes from |
|---|---|---|
| Website visitors | Technical data needed to deliver the page, such as your IP address and browser type. The website has no analytics. | Your browser, through our hosting provider |
| People who send us an enquiry through our website | The details you enter: your name, email address, company and any message | You |
| Investor platform users | Name, email address, firm, role, sign-in records (which can include your IP address), and what you do in the platform: uploads, questions in chat and settings | You, or your firm's admin when they invite you |
| Firms requesting access | Name, email address and firm name | You |
| Founders using the founder service | Name, email address, company details, your pitch deck, your LinkedIn profile, the funds you choose, your submission preferences, payment status, and emails with us | You, through our website and submission form, and Stripe for payment status. We never see your full card details. |
| People named in deal data, such as founders and team members | Whatever the documents contain, such as names, roles, work and education history and contact details, plus public professional information such as job history and LinkedIn profile | The fund that uploads the documents, our enrichment provider, and public web search |
| People at funds and firms we contact | Business contact details and public professional information | Public sources, introductions and professional networks such as LinkedIn |
| People who book or join a meeting with us | Name, email address, the time and subject of the meeting. If the meeting is recorded: your voice, your image if your video is on, what is said, and the transcript and notes made from it. | You, through our booking link or the meeting invitation |
| People who apply to work with us, or who work with us as interns or contractors | Name, email address, CV, date of birth and other details needed to recruit and engage you | You |
| Anyone who contacts us | Name, email address and what you tell us | You |
We do not ask for special category data, such as health or ethnicity. If a document contains it, we do not use it for any purpose of its own.
4. How we use personal data and our lawful bases
| What we use it for | Lawful basis |
|---|---|
| Running the investor platform for your firm: accounts, invitations, access requests, notifications and support | Our contract with your firm, and our legitimate interest in providing the service to its users |
| Processing a fund's deal data: reading documents, extracting facts, screening, enrichment, reports and chat | We act on the fund's instructions (section 2), and the fund decides the lawful basis |
| Running the founder service: your account, your reports, taking payment and emailing you your reports | Our contract with you |
| Submitting your deck to the funds you select | Your consent. You can withdraw it for future submissions, but we cannot recall a deck we have already sent. |
| Contacting a fund that does not use Morpheus, when a founder asks us to | Our legitimate interest in carrying out the founder's request |
| Contacting funds and other businesses about Morpheus | Our legitimate interest in telling businesses about a service relevant to their work |
| Booking and holding meetings with you | Our legitimate interest in running our business, and taking steps at your request before a contract |
| Recording and summarising meetings with an AI notetaker | Our legitimate interest in keeping an accurate record of what was agreed. We tell you at the start of the meeting, and we stop recording if you object. |
| Recruiting and engaging people who work with us | Taking steps at your request before a contract, our contract with you, and our legitimate interest in running our business |
| Keeping our services secure, preventing misuse and fixing problems, including through logs | Our legitimate interest in running safe, reliable services |
| Replying when you contact us | Our legitimate interest in answering you |
| Keeping financial records and responding to lawful requests from authorities | Legal obligation |
We do not sell personal data. We contact funds and other businesses about Morpheus using their business contact details, and every message tells you how to ask us to stop. We do not send marketing emails to individuals unless they have agreed to receive them.
5. Deal data and AI
Both services use AI models to read and assess documents. On the investor platform:
- Microsoft's Document Intelligence reads uploaded documents. AI models we use through Microsoft Azure then analyse them: OpenAI and Mistral models run by Microsoft, and Claude models from Anthropic.
- Anthropic, not Microsoft, processes the requests sent to Claude, and can do so outside Europe.
- For deals that pass a fund's screening, we send the company's website address or name, and founders' names, LinkedIn addresses, past employers and schools, to Crustdata. Crustdata returns public company and team information.
- Chat and analysis can search the web through Tavily. A search can include the names of companies and people.
On the founder service, AI models used through Microsoft Azure, including Claude, assess your deck. They compare it against our profiles of funds, which we build from public information about each fund, such as its published thesis and past investments.
When we record a meeting, Fathom uses AI models to transcribe and summarise it.
No AI training on personal data. We do not use personal data to train AI models. Under their terms with us, Microsoft and Anthropic do not use the data we send them to train their models.
People make the decisions. Our AI produces assessments, scores and screening verdicts to help people decide. We make no decision about anyone, based solely on automated processing, that has legal or similarly significant effects. Funds decide whether to invest, and a founder report is information for the founder.
6. Who we share personal data with
We use the service providers below to run our services. Each one handles personal data only to provide its service to us. For deal data we hold for a fund, these providers are our sub-processors. We tell the fund before we add or replace a provider that handles its data, and the fund can object.
| Provider | What it does for us | Personal data it receives | Where it processes data |
|---|---|---|---|
| Microsoft (Azure and Microsoft 365) | Hosting, database, file storage, search, document reading, AI models, investor platform sign-in, and email | Everything held on our services | UK, the Netherlands and Sweden. AI requests can be processed in other Azure regions worldwide. |
| Anthropic | Provides the Claude models we use through our Azure account | Document content and chat questions, when Claude is used | United States and other countries outside Europe |
| Crustdata | Company and team enrichment | Company website addresses and names, and founders' names, LinkedIn addresses, past employers and schools | United States |
| Tavily | Web search | Search queries, which can include the names of companies and people | United States |
| Logo.dev | Shows company logos | A company's website address, and your IP address, sent by your browser | United States |
| Website icons for sources cited in chat | The website address and your IP address, sent by your browser | United States | |
| Sanity | Hosts our website's articles and images | Your IP address, sent by your browser when it loads images | European Union (Belgium) and the United States. Images are served from a worldwide network. |
| Clerk | Founder service sign-in | Name, email address and sign-in records | United States |
| Stripe | Founder service payments | Name, email address and payment details | United States |
| Fathom | Meeting recording, transcription and notes | Recordings, transcripts, and attendee names and email addresses | United States |
| Gumdrop | Meeting bookings | Name, email address and meeting details | United States |
| Calendly | Meeting bookings | Name, email address and meeting details | United States |
| Notion | Internal documents and notes | Names and contact details that appear in our notes and, for people we recruit or work with, CVs and dates of birth | United States |
We also share personal data with:
- the funds a founder chooses, when the founder opts in to submit their deck;
- our professional advisers, such as our accountants and lawyers, who are bound by confidentiality;
- authorities, such as regulators or the police, when the law requires it;
- a buyer or successor, if Morpheus is sold or merges. We would tell you before your personal data became subject to a different privacy policy.
7. International transfers
We store our data in Microsoft Azure data centres in the UK, the Netherlands and Sweden. Some processing happens elsewhere:
- Azure can process AI model requests in any of its regions worldwide.
- Anthropic processes Claude requests outside Europe, including in the United States.
- Several providers in section 6 are based in the United States.
The UK recognises the European Economic Area as giving adequate protection. For transfers to other countries, we use the safeguards in each provider's data processing terms: the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified. Email us for a copy of the safeguards that apply.
8. How long we keep personal data
We keep personal data only while we need it, and then delete it.
| Data | How long we keep it |
|---|---|
| A fund's deal data, and everything generated from it | While the fund is a customer, and for up to two years after the contract ends so that a returning fund can pick up where it left off. We delete it sooner, within 30 days, if the fund asks us to. |
| Investor platform user accounts | While your account is active, then deleted with your firm's data |
| Founder accounts, decks, submissions and reports | 2 years from your last submission |
| Logs and security records | 1 year |
| Backups | Database backups for 7 days. Earlier versions of deleted or changed files for 30 days. |
| Support requests | While the customer relationship lasts, plus 2 years |
| Emails with us | While we need them, reviewed every year |
| Website enquiries | While we need them, reviewed every year |
| Meeting recordings and transcripts | 12 months after the meeting |
| Meeting notes and summaries | While we are in contact with you or your firm, reviewed every year. At each review we delete notes about people we have had no dealings with for 3 years, unless a contract or dispute needs them. |
| Notes that form part of a customer contract | The contract term plus 6 years |
| Meeting bookings | 12 months after the meeting |
| Requests for access from firms that do not become customers | 12 months from the request |
| Business contacts at funds and firms we contact | While the contact is relevant, reviewed every year, and deleted if you ask us to stop contacting you (we keep only a minimal record so that we do not contact you again) |
| Applications from people we do not engage | 12 months after the recruitment ends |
| Records of people who work with us as interns or contractors | While they work with us, plus 6 years |
| Payment and financial records | 7 years, which covers what UK tax and company law require |
| Records of security incidents | 7 years |
We may keep data longer when the law requires it or while a legal claim is unresolved.
9. How we protect personal data
We protect personal data with technical and organisational measures that match the risk:
- Our services run on Microsoft Azure, whose data centres Microsoft secures and audits.
- Data is encrypted in transit (TLS 1.2 or higher) and at rest.
- On the investor platform, each fund's data is kept separate from every other fund's.
- Only staff who need access have it. Staff accounts require multi-factor authentication, and we review access every year.
- We monitor our systems and keep logs for a year. The investor platform's database is backed up continuously.
- Everyone who works with us accepts our security policies, is bound by confidentiality and completes security training every year.
If a breach puts personal data at risk, we follow our incident response plan. For data we hold for a fund, we tell the fund without undue delay, and within 48 hours, so it can meet its own reporting duties. Where we are the controller, we report the breach to the ICO within 72 hours where the law requires, and tell anyone at high risk without undue delay.
10. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct personal data that is wrong or incomplete;
- delete your personal data, where we have no lawful reason to keep it;
- restrict how we use your personal data while a concern is resolved;
- object to our use of your personal data where we rely on legitimate interests;
- move personal data you gave us to another service, in a machine-readable format;
- withdraw your consent at any time, where we rely on consent. This does not affect what we did before you withdrew it.
To use any of these rights, email hello@usemorpheus.ai. There is no charge. We may ask you to confirm your identity before we act. We reply within one month, and tell you if a complex request needs up to two more months.
If your request concerns deal data that a fund uploaded to the Morpheus platform, the fund decides how that data is used (section 2). We pass your request to the fund and help it respond. When the fund asks us to delete the data, we delete it within 30 days.
11. Cookies
On our own website and services we use only cookies and browser storage that they need to work. We use no analytics or advertising cookies, so we do not ask for cookie consent.
- Website: sets one cookie, which our host, Microsoft Azure, uses to send your requests to the same server. It holds no information about you.
- Investor platform: Microsoft's sign-in pages, and the app while you sign in, set cookies to keep you signed in. The app keeps your sign-in session in your browser's storage, and remembers display choices you make, such as the sidebar layout.
- Founder service: Clerk sets cookies to keep you signed in. Stripe's payment page can set its own cookies, which it needs to take payment and prevent fraud.
- Booking pages: our meeting-booking providers, Gumdrop and Calendly, run their own booking pages and can set cookies on them. Their privacy policies explain which.
You can block or delete cookies in your browser settings, but you may then be unable to sign in.
12. Children
Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.
13. Changes to this policy
We update this policy when our services or the law change, and the date at the top shows the latest version. If we make a material change, we email the people we hold contact details for before it takes effect.
14. Complaints
If you are unhappy with how we handle your personal data, please contact us first at hello@usemorpheus.ai so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. If you live in the European Economic Area, you can also complain to the data protection authority where you live.