Skip to main content

Last updated: 10 August 2026

Privacy Policy

1. Who We Are

Morv AI Ltd (company number 17482982) is a private limited company registered in England and Wales.

Registered address: 14 Sunningdale Road, Cheadle Hulme, Cheadle, England, SK8 6PB

Data protection contact: privacy@morv.ai

Our services are operated from the United Kingdom and are offered to customers in the United Kingdom, United States, Canada, Australia, New Zealand and Singapore. Wherever you are located, UK data protection law (UK GDPR and the Data Protection Act 2018) applies to our processing of personal data.

We are the data controller for the personal data we process through our platform in relation to our account holders. For personal data collected through chatbot widgets embedded on our users’ websites, we act as a data processor on behalf of our users (who are the data controllers). See our Data Processing Agreement for details.

2. What Data We Collect

Account Data

  • Full name, email address, country, company name (provided at registration)
  • Password (stored as a bcrypt hash — we never store your actual password)
  • Phone number (required at registration)
  • Account type (personal or business)

Chatbot Conversation Data

  • Messages sent by website visitors to chatbots created on our platform
  • AI-generated responses
  • Session identifiers, IP addresses, and visitor metadata (browser, language, device), and the address and title of the page on which each conversation started, stored with that conversation
  • Token usage and credit consumption data
  • Contact details submitted through the chatbot’s contact form (where the chatbot owner has enabled it): the visitor’s name, email address and telephone number, any message they write in the form while the chatbot is switched off, and a record of their consent to be contacted. These are collected on behalf of the chatbot owner and sent to them by email.
  • Chatbot interaction events recorded in the visitor’s browser: the page the chat was opened from, links clicked inside the chat, session duration and similar interaction metadata.
  • Product feedback: Feedback you send us from your dashboard (the message, the category you chose, the page you sent it from, your IP address and browser, and any reply we send) is retained for 365 days, then automatically deleted. It is also deleted immediately if you delete your account.
  • Diagnostic AI request records, including the full prompt sent to the AI provider and its raw response, kept for troubleshooting.

Knowledge Base Data

  • URLs and content crawled from websites you add as knowledge sources
  • Extracted text content stored for chatbot retrieval
  • Crawled content may contain personal data published on source web pages (e.g. names, contact details). We do not automatically detect or remove personal data from crawled content. Users are responsible for ensuring their knowledge sources are appropriate.

Payment Data

  • Subscription and purchase history, credit balances
  • Payment processing is handled by Stripe — we do not store card numbers or payment credentials on our servers
  • A card fingerprint supplied by Stripe — a code identifying the payment card that does not reveal the card number and cannot be turned back into it — used to detect duplicate accounts and referral fraud as described in Section 8. Because we use it to recognise that two accounts share a card, we treat it as personal data rather than anonymous.

Integration Data

  • Third-party service credentials you provide (API keys, tokens) — stored encrypted using AES-256-CBC
  • Locally cached data from connected services (e.g. product catalogues, booking listings, order summaries). Order data is stored with email addresses hashed (SHA-256) rather than in plain text.
  • Integration connection status and error logs

Partner Program Data

  • Partner account details (name, email, company, website) provided when applying to the Partner Program
  • Referral activity: clicks on referral links (each logged with the IP address, browser user agent and referring page), campaign statistics, and the attribution of referred customers
  • Commission and payout records, including amounts, status, and history
  • Stripe Connect account status and the country of your payout account (payout account details are held by Stripe, not on our servers)

Technical Data

  • IP addresses, browser information, device type
  • API request logs, error logs
  • Dashboard activity logs (pages visited, actions taken, timestamps)
  • Website visit logs (the page you landed on, the website that referred you, any campaign parameters in the link, an approximate form of your IP address, and the time of the visit). This is recorded for every visit to our public website so we can understand which of our marketing works, and does not depend on cookies.
  • Which channel, referral link or invitation brought you to us, recorded against your account when you register, so that a partner or campaign is credited and we can tell which of our marketing works. This is taken from the short code in the link you followed, held server-side during your visit, or matched from an invitation we sent to your email address. It does not depend on cookies.

3. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

  • Contract (Article 6(1)(b)): Processing necessary to provide our services to you (account management, chatbot functionality, billing)
  • Legitimate interest (Article 6(1)(f)): Platform security, fraud prevention, spam detection, service improvement, analytics, and attributing a sign-up to the partner, campaign or channel that introduced you. We have conducted balancing assessments to ensure our legitimate interests do not override your fundamental rights and freedoms.
  • Consent (Article 6(1)(a)): Marketing communications (where applicable). You may withdraw your consent at any time (see Section 11).
  • Legal obligation (Article 6(1)(c)): Tax records, financial reporting, regulatory compliance

Providing the account data described in Section 2 is a contractual requirement — without it we cannot create or operate your account. You are not under any statutory obligation to provide personal data to us.

4. How We Share Your Data

We share personal data with the following categories of recipients. A full list of our sub-processors is available on our Sub-Processors page.

AI / LLM Providers

When a visitor sends a message to your chatbot, the message content (and relevant knowledge base context) is sent to third-party AI providers to generate a response, together with the address and title of the page the visitor is viewing, so the chatbot can tell which page they mean. We currently use:

These providers process message content to generate responses. They may temporarily store data for abuse monitoring as described in their respective privacy policies.

Payment Processor

  • Stripe, Inc. — processes all payments and stores payment credentials securely

Email Delivery

  • SMTP2GO — delivers our transactional emails (account, billing, and notification emails). Recipient email addresses, names, and email content are processed in the European Union.

Anti-Spam and Security

  • Google reCAPTCHA — used on our registration form for bot detection. Subject to Google’s Privacy Policy and Terms of Service.
  • Cloudflare — delivers and protects this website. All traffic passes through Cloudflare's network, which processes your IP address and request data to provide content delivery, TLS encryption, and protection against attacks. Cloudflare Turnstile additionally provides optional CAPTCHA verification on chatbot widgets (where enabled by the chatbot owner). Subject to Cloudflare’s Privacy Policy.

Customer-Initiated Integrations

When you connect a third-party integration (currently Shopify, WooCommerce, Square, Magento or Guesty), chatbot conversation context may be shared with that integration’s API to retrieve relevant data. These are initiated by your configuration and governed by the third-party’s own privacy policy.

Referring Partners

If you sign up through a personal invitation from a member of our Partner Program, that partner can see the name and email address they invited, and your plan and subscription status, so they can follow their referral. If you sign up through a partner’s general referral link, the partner can see that a customer signed up, with the plan and subscription status, but not your name or email address. Partners are independent controllers of the information they hold and are bound by our Partner Terms.

We do not sell your personal data to third parties.

5. International Data Transfers

Your data may be transferred to and processed in the United States by our AI providers (Google, OpenAI) and payment processor (Stripe). These transfers are protected by:

  • The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable; or, where the recipient is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge), that framework
  • Data Processing Agreements with each provider

You can request copies of the relevant transfer safeguards by contacting us at privacy@morv.ai.

6. Chatbot Widget Visitor Data

This section applies to individuals who interact with chatbot widgets embedded on our users’ websites (“Visitors”).

Data Controller

The website owner who deployed the chatbot is the data controller for Visitor data. Morv acts as a data processor. Visitors should refer to the website owner’s privacy policy for information about how their data is handled.

What Visitor Data We Process

  • Messages typed into the chatbot
  • AI-generated responses
  • IP address, browser type, language preference, and the address (without any query string) and title of the page you started the chat on, which is stored with the conversation and shown to the website owner
  • A session identifier stored in the browser’s localStorage (a random ID used only to maintain conversation continuity; the stored value itself contains no messages or browsing history)
  • Contact details you choose to submit through the chatbot’s contact form — your name, email address and telephone number and, when the chat is switched off, any message you write — which are sent to the website owner. These are only collected if you fill the form in and tick the consent box.
  • Interaction events sent to us as you use the chat: the page you opened the chat from, links you click inside the chat, and how long the chat was open. These are used to give the website owner statistics about how their chatbot performs.

How Visitor Data Is Used

  • Messages are sent to third-party AI providers (Google Gemini or OpenAI) in the United States to generate responses
  • IP addresses are used for rate limiting and spam prevention
  • Session identifiers maintain conversation continuity

Visitor Rights

If you are a Visitor and wish to exercise your data protection rights (access, erasure, etc.), please contact the website owner who deployed the chatbot. The website owner can then contact us and we will assist as data processor in accordance with our Data Processing Agreement.

You may also contact us directly at privacy@morv.ai and we will make reasonable efforts to direct your request appropriately.

7. Cookies and Local Storage

On the Morv Website

  • Session cookies (essential) — required for login and security (CSRF protection). These are strictly necessary for the service you have requested and do not require consent under PECR.
  • Cookie consent preference — stored in localStorage to remember your choice
  • Referral and campaign cookies (aff_ref, camp_ref) — set for 30 days only if you choose “Accept all”, when you arrive through a partner referral link or a campaign link, so that the partner or campaign can be credited if you later create an account. They hold only the referral or campaign code and are not used to build a profile of you or to serve advertising. If you choose “Essential only”, these are not set and no referral is recorded.
  • “Remember me” cookies (ai_remember_user, ai_remember_affiliate) — set only if you tick “Remember me” at login, so you stay signed in on that device. Cleared when you log out.

You can remove any of these at any time through your browser’s cookie settings.

On Third-Party Websites (Chatbot Widget)

  • localStorage (essential) — the chatbot widget stores a session identifier and conversation ID in your browser’s localStorage to maintain conversation continuity. No personal data, messages, or browsing history is stored locally. This is strictly necessary for the chat functionality you have requested and does not require separate consent under the Privacy and Electronic Communications Regulations 2003 (PECR).

The chatbot widget does not set any tracking cookies. When it shows products or properties from the website owner’s connected store, it loads their photos from the server that hosts that store’s images (for example Shopify’s or Guesty’s). Like any image on the web, that server receives your IP address and browser type; it is not told which page you are on. If the website owner has enabled CAPTCHA verification (Cloudflare Turnstile), Cloudflare may set its own cookies as described in Cloudflare’s Privacy Policy.

reCAPTCHA

Our registration pages use Google reCAPTCHA v3 for bot detection. It is strictly necessary to protect those forms from automated abuse, so it runs whichever cookie option you choose. reCAPTCHA may set cookies and collect device information as described in Google’s Privacy Policy.

Analytics (Google Analytics)

With your consent, we use Google Analytics 4 to understand how our website and dashboards are used so we can improve the Service. Google Analytics loads only if you choose “Accept All” on our cookie banner; choosing “Essential Only” (or making no choice) disables it entirely. Since 5 February 2026 the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025, would permit some first-party analytics without consent where it is used solely to improve our own service and you are given a straightforward way to object. We have chosen to keep asking for consent instead, and to offer the opt-out as well. When enabled, it collects pages visited, interaction events (such as sign-up and checkout steps), approximate location derived from your IP address, and device/browser information, and may set cookies, as described in Google’s Privacy Policy. This data is processed by Google LLC (see our Sub-Processors page). Google Analytics never runs inside the embeddable chatbot widget on our customers’ websites, and never in our admin tools. You do not have to accept analytics cookies in order to create an account. Our sign-up forms are protected by Google reCAPTCHA, which is strictly necessary to prevent automated abuse and therefore loads whichever option you choose. Google Analytics, and the referral and campaign cookies described above, are set only if you choose “Accept all”. You can change or withdraw your choice at any time on our Cookie Policy page, which lists every cookie we use and lets you switch analytics and attribution on or off. Withdrawing takes effect immediately: analytics stops loading and the referral and campaign cookies are cleared. Your choice is remembered for 180 days, after which we ask again.

Do Not Track

Third-party bot-protection services (Google reCAPTCHA on our registration page and, where enabled by the chatbot owner, Cloudflare Turnstile) may set their own cookies as described above, and analytics cookies are set only with your consent as described in the Analytics section. Our Service does not alter its behaviour in response to “Do Not Track” browser signals; use the cookie banner to control analytics tracking. We do not track users across third-party websites.

The chat widget on our own website stores a conversation identifier in your browser so your conversation survives a page refresh. Because it is how the page you asked for works, it loads whichever cookie option you choose. It sets no tracking cookies and loads no analytics.

8. Automated Decision-Making

We use the following automated systems that may affect your use of the Service:

  • Spam and bot detection: Our anti-spam system automatically analyses chatbot messages for patterns indicative of spam, abuse, or automated activity, including an AI classifier that screens messages for prompt-injection attempts. Messages flagged as spam or prompt-injection may be automatically rejected without human review. This is necessary for our legitimate interest in protecting the platform and other users.
  • IP address blocking: IP addresses that accumulate a threshold number of abuse signals within a short window may be automatically added to a temporary blocklist (typically for 7 days). Requests from blocked IPs — including login attempts — are rejected without further processing. Whitelisted IPs are excluded.
  • Credit enforcement: The Service automatically restricts functionality when your credit balance is exhausted or spending limits are reached. This is a necessary part of performing our contract with you.
  • Rate limiting: Automated limits on API requests, login attempts, and form submissions to prevent abuse.
  • Affiliate anti-fraud checks: Where you take part in our Partner Program, we automatically compare the payment-card fingerprint and IP address linked to a referred subscription against the referring partner’s own card and other referrals, to detect self-referrals and referral fraud. A match automatically holds the related commission for manual review before any payout is made. You can contact us to request human review of a held commission.

Where any solely-automated decision produces legal or similarly significant effects for you (for example, an automatic hold on a Partner Program commission), we provide the safeguards required by Articles 22A–22D of the UK GDPR: we tell you about the decision, a human reviews it before it takes lasting effect, and you may make representations, request human intervention, and contest the outcome. If you believe an automated decision has been made about you in error, contact us at privacy@morv.ai to request human review.

9. Data Retention

  • Account data: Retained while your account is active. Deleted 30 days after account deletion request.
  • Accounts never verified: If you create an account but never confirm your email address, the account (customer or partner) and its details are deleted automatically once it is 30 days old.
  • Conversation data: Individual conversations (and their messages) are retained for 365 days after last visitor activity, then automatically deleted. Chatbot owners may delete individual conversations earlier via their dashboard. All conversation data is deleted when the account is deleted. Removing a project from the dashboard does not by itself delete its conversations: they stay subject to the 365-day period above, and the chatbot owner can delete them individually before removing the project.
  • API request logs: Retained for 180 days.
  • LLM call logs: Retained for 90 days.
  • Email logs: Retained for 365 days.
  • Contact form messages: Messages sent through our website contact form (including your name, email address and IP address) are retained for 365 days, whether or not you hold an account with us.
  • Partner customer invitations: Where a partner invites someone by email to try the platform, the invitation record (name and email address) is retained for 365 days unless the invitation is accepted. Opt-out records are kept for as long as they are needed to honour the opt-out.
  • Our invitations and do-not-contact list: Where we invite someone by email to try the platform, the invitation record (name and email address) is retained for 365 days unless the invitation is accepted. If you ask us not to send you invitations — using the link in an invitation, or by writing to us — we keep your email address on a do-not-contact list for as long as it is needed to honour your request, and use it for nothing else.
  • Website visit logs: Retained for 365 days.
  • User activity logs: Retained for 90 days.
  • Spam logs: Retained for 180 days.
  • Crawl logs: Retained up to 100 entries per source.
  • Integration data: Locally cached data is retained while the integration is connected, including an integration on a project that has been removed from the dashboard. Deleted when the integration is disconnected or the account is deleted.
  • Payment records: Retained as required by UK tax law (typically 6 years).
  • Checkout consent records: When you start a checkout we record the wording shown to you, the time, your IP address and the Stripe checkout reference. These are kept while your account exists and for 180 days after your account is deleted, with the link to your account removed, so that we can respond to a payment dispute or chargeback (UK GDPR Article 17(3)(e)). They are then deleted automatically.
  • Chatbot contact-form leads: Retained for 730 days (about two years) by default. The period is deliberately generous because these are the chatbot owner’s own business records rather than our logs, and it outlives the 365-day chat transcript the lead came from. A chatbot owner can delete an individual lead at any time from their dashboard, and all leads are permanently deleted when the account is deleted. Note that removing a chatbot or project from the dashboard does not by itself delete leads already captured. We can apply a different automatic retention period across the platform — shorter, longer, or none at all — on request.
  • Chatbot interaction events: Retained for 365 days.
  • Affiliate click and activity data: Retained for 365 days.
  • Anti-abuse records: Where an account is suspended for abuse and then deleted, we keep an irreversible hashed form of the email address and card fingerprint for 730 days so that the same person cannot immediately re-register. These records contain no readable personal data and are used only to prevent repeat abuse.
  • Promotional offer records: Where you claim a promotional offer, an irreversible hashed identifier is kept indefinitely so a single-use offer cannot be claimed twice. It contains no readable personal data.
  • Security and operational records (risk signals, rate-limit counters, platform error logs, payment reconciliation records): Retained between 1 and 365 days depending on the record type.
  • Backups: System backups containing personal data are purged within 90 days of the data being deleted from the live system.

Indefinite retention, stated plainly: when a single-use promotional offer is claimed we keep an irreversible hashed identifier derived from the email address, with no time limit, so the same offer cannot be claimed twice. It contains no readable personal data and is never used for any other purpose. Anti-abuse identifiers created when a suspended account is deleted are kept for 730 days and then removed.

10. Data Breach Notification

In the event of a personal data breach that affects your data:

  • We will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, where required under UK GDPR Article 33
  • We will notify affected account holders without undue delay where the breach is likely to result in a high risk to your rights and freedoms, as required under UK GDPR Article 34
  • For breaches affecting Visitor data, we will notify the relevant data controllers (our users) without undue delay after becoming aware, using all reasonable efforts to do so within 72 hours, so they can meet their own notification obligations

Notifications will include: the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed to address the breach.

11. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

  • Right of access (Article 15): Request a copy of your personal data
  • Right to rectification (Article 16): Correct inaccurate personal data via your profile settings
  • Right to erasure (Article 17): Request deletion of your account and all associated data (with a 30-day grace period). Two narrow exceptions survive deletion, both described in Section 9: records we must keep by law (such as payment records), and the irreversible hashed identifiers used to prevent repeat abuse and to stop a single-use promotional offer being claimed twice. Neither contains readable personal data.
  • Right to data portability (Article 20): Download your data in a machine-readable format (JSON export available via your profile page, includes profile, projects, chatbot settings, conversations and messages, chatbot leads, credit history, credit pools, subscriptions, knowledge-source details, and any promotional offers you have claimed)
  • Right to restrict processing (Article 18): Request that we limit how we use your data
  • Right to object (Article 21): Object to processing based on legitimate interests
  • Right to withdraw consent: Where we process your data based on consent (e.g. marketing communications), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
  • Rights around automated decision-making (Articles 22A–22D): Safeguards for solely-automated decisions with significant effects — information about the decision, human review, the right to make representations, and the right to contest (see Section 8)

To exercise any of these rights, contact us at privacy@morv.ai or use the self-service options in your account settings. We will respond within one month as required by UK GDPR. This period may be extended by two further months where necessary, taking into account the complexity of the request, and may be paused while we verify your identity or seek clarification of your request. Searches in response to access requests will be reasonable and proportionate.

Partner accounts. If you have a partner (affiliate) account, the same rights apply to it. You can download everything we hold about you from Settings in your partner dashboard, and close your account from the same page. Commission and payout records are kept afterwards because they are financial records we are required to retain for tax and accounting purposes, but they are amended so they no longer identify you.

Records of processing and data protection oversight. We maintain records of our processing activities as required by Article 30 of the UK GDPR. Given our size and the nature of what we do we are not required to appoint a Data Protection Officer, and we have not appointed one; responsibility for data protection sits with the company’s directors. We are established in the United Kingdom, so no UK or EU representative is required. Data protection enquiries should go to privacy@morv.ai.

12. Information for US Residents

If you are a resident of California, Virginia, Colorado, Connecticut, or another US state with comprehensive privacy legislation, you may have additional rights under applicable state law.

California (CCPA/CPRA)

Under the California Consumer Privacy Act (as amended by the CPRA), California residents have the right to:

  • Know what personal information we collect, use, and disclose (see Sections 2–4)
  • Delete personal information we hold about you (via profile settings or by contacting us)
  • Opt out of sale or sharing of personal information — we do not sell or share (as defined by the CCPA) your personal information
  • Non-discrimination for exercising your privacy rights

In the preceding 12 months, the categories of personal information we have collected are described in Section 2. We share personal information with the service providers described in Section 4 for business purposes only. We do not sell personal information.

To exercise your rights, contact us at privacy@morv.ai. We will verify your identity before processing your request.

Other US States

If you reside in another US state with privacy legislation (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you may have similar rights to access, delete, and correct your data, and to opt out of targeted advertising, profiling, and sale of personal data. We do not engage in targeted advertising or the sale of personal data. Where automated processing does produce a significant effect — for example an automatic hold on a Partner Program commission — we provide the safeguards described in Section 8, including human review on request. Contact us to exercise any applicable rights.

13. Children’s Data

Our Service requires account holders to be at least 18 years old. We do not knowingly allow anyone under 18 to create an account, and we do not knowingly collect personal data from children.

Website visitors of any age may interact with chatbots embedded on our users’ websites. We require our users to implement appropriate safeguards if their chatbots may be accessed by children, in compliance with the ICO Age Appropriate Design Code (Children’s Code) and the US Children’s Online Privacy Protection Act (COPPA) where applicable.

If you believe a child has provided us with personal data, please contact us at privacy@morv.ai and we will take steps to delete it.

14. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through a notice on our platform at least 14 days before they take effect. Continued use of our services after changes constitutes acceptance of the updated policy.

15. Complaints

If you are unhappy with how we handle your personal data, please complain to us first: use our contact form or email privacy@morv.ai. We will acknowledge your complaint within 30 days, investigate it without undue delay, and inform you of the outcome, in accordance with section 164A of the Data Protection Act 2018.

You also have the right at any time to lodge a complaint with the Information Commissioner’s Office (ICO — in the process of being reconstituted as the Information Commission):

16. Contact

For privacy-related enquiries: