Privacy Policy

This policy covers the processing of personal data collected through the moratus.ai domain and its subdomains, the MORATUS platform and applications served from those domains, API services, connectors and integrations, and our customer service and technical support channels. Third-party service providers' own privacy policies apply in addition.

• Web platform: moratus.ai and its subpages (including moratus.ai/home)
• Products: MORATUS Web, MORATUS Desktop and MORATUS Mobile
• API, connectors and integrations (e.g. form processing, email service, third-party app connections)
• Customer service and technical support channels

Personal Data:

Any information relating to an identified or identifiable natural person.

Special Category Personal Data:

Data concerning race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Data Controller:

The natural or legal person who determines the purposes and means of processing personal data. For this policy, the data controller is Muhammed Bahri Telli, trading as MORATUS.

Data Processor:

A third party or organisation that processes personal data on behalf of the data controller, under the authority the controller grants.

Explicit Consent:

Consent relating to a specific matter, based on information and given freely.

Input and Output:

The prompts, files and other content you submit to the platform (input) and the responses, files and work records MORATUS produces in reply (output).

Model Provider:

A third-party artificial intelligence model provider, not owned by MORATUS, that processes your prompts to generate AI responses.

Dynamic Routing:

The automatic decision about which model provider a request is sent to, based on the model you select, the type of task and provider availability.

For the personal data covered by this policy, the data controller under Turkish Personal Data Protection Law No. 6698 (KVKK) is Muhammed Bahri Telli, owner of the sole proprietorship trading as MORATUS. You can reach us through the channels below.

Identity Data:

First name, last name, username (if any) and profile information.

Contact Data:

Email, phone, company name and job title (contact form, demo requests, etc.).

Account and Subscription Data:

Account ID, plan, credit balance and usage limits, team/workspace memberships, roles and permissions.

Transaction and Session Data:

IP address, browser and device information, operating system, date/time stamps, referring page.

Usage Data:

Features used, models selected, credit consumption and error logs; aggregated measurement data about site visits.

Cookies and Local Storage:

Session, security and cookie-preference cookies; language and theme preferences kept in your browser.

Content Data:

Prompts you submit, files and attachments you upload, memory entries, generated outputs and related work records.

Connector Data:

Content and metadata accessed, with your authorisation, from third-party services you connect, and connection access tokens.

Billing and Payment Data:

Billing name, tax details and payment transaction records. Payments are collected by Paddle.com Market Limited as Merchant of Record; we do not store card details, which are processed by Paddle.

• Directly from you: Account creation, forms, email, support requests, contractual processes and the content you submit to the platform.
• Automatically: Cookies, browser/device records, product usage telemetry and security logs.
• From third parties: Connectors you authorise and services we integrate with (only to the extent necessary).

• To provide, maintain, improve and personalise our Services.
• To generate AI responses by sending your prompts to model providers according to the model you select and dynamic routing.
• To create accounts, authenticate users and manage access rights.
• To respond to requests and manage support and customer relationships.
• To run subscription, credit, billing and collection processes.
• To keep our systems secure and to prevent fraud, abuse and breaches of our terms.
• To measure site and product usage in aggregate and evaluate performance and trends.
• To meet our legal obligations and respond to requests from competent authorities.
• To send commercial electronic messages (only where you have given prior consent under Turkish Law No. 6563; you can opt out at any time through the link in each message or at privacy@moratus.ai).

Your personal data may be processed on one or more of the following legal bases:

• Necessity for entering into or performing a contract (KVKK art.5/2-c, GDPR art.6/1-b): your account, providing the Services, sending prompts to model providers, subscriptions and billing.
• Legal obligation (KVKK art.5/2-ç, GDPR art.6/1-c): billing records, traffic logs and requests from competent authorities.
• Legitimate interest (KVKK art.5/2-f, GDPR art.6/1-f), provided it does not harm your fundamental rights and freedoms: security, abuse prevention and cookieless site measurement.
• Establishing, exercising or defending legal claims (KVKK art.5/2-e, GDPR art.6/1-f).
• Explicit consent (KVKK art.5/1, GDPR art.6/1-a): commercial electronic messages, optional cookies and cases where no other basis applies.

We process special category personal data only under the conditions set out in article 6 of the KVKK. We do not need such data to provide the Services, but if you choose to include it in your prompts or files, it is also sent to model providers to generate the response. The bases for transfers abroad are explained under “International Data Transfers”.

On our site and in our app we currently use only strictly necessary cookies (cookie preference, session and security). Preferences such as language and theme are kept in your browser's local storage. We measure site usage in aggregate with Cloudflare Web Analytics, which does not use cookies or device identifiers.

If we start using analytics, functional or marketing cookies, we will run them only with the explicit consent you give in the cookie panel. You can change your cookie preferences at any time. For details, see the: Cookie Policy

MORATUS does not run its own AI model; responses are generated using models from third-party model providers. When you send a prompt, the content needed to answer it is sent to these providers. Your inputs and outputs belong to you and, where applicable, your workspace.

What is sent:

Your prompt; the content of files you attach; the conversation history needed for a coherent response; relevant memory entries if the memory feature is on; content retrieved for that task from connectors or web search; and the instructions of scheduled tasks. Your account and payment details are not sent to providers unless they are needed to generate the response.

How many providers:

Depending on the model you select and the result of dynamic routing, a prompt may be sent to at least one and at most three different model providers. For example, different steps of a task may run on different models, or a request may be rerouted when a provider is unavailable. In exceptional cases where none of the primary providers can be reached, the request may be sent through a US-based model routing service to the infrastructure providers that service works with.

Where it is processed:

Our model providers use infrastructure in the European Union (Germany), Singapore and the People's Republic of China; the fallback routing service is in the United States. Details are under “International Data Transfers”.

Retention and model training:

Providers' contractual terms differ. Some do not store content sent through their API and do not use it for model training; some keep content for a limited period (for example up to 30 days) for abuse monitoring and security; and the terms of some may allow data to be used to improve the provider's own services and models and to be kept for a period the provider determines. The fallback routing service does not store prompt content by default.

Providers' legal status:

Model providers act as data processors to the extent they process your requests on our instructions, and as independent data controllers to the extent they use data for their own purposes (for example to improve their own models), in which case their own privacy policies apply.

• We do not use your content to train AI models on our own behalf; if this changes, we will ask for your explicit consent first.
• We do not sell your content or use it for advertising.
• A limited number of authorised staff may access content, to the extent necessary and with access logged, for abuse detection, security and troubleshooting.
• On a request under article 11 of the KVKK, we will tell you which providers your data was transferred to.

Because some model providers may use data for their own purposes and process it in countries that do not offer the same level of protection as Türkiye, we recommend that you do not enter special category personal data (health, biometric, beliefs, etc.), other people's personal data, trade secrets or confidential information unless the task requires it.

You can connect MORATUS to the other services you use. When you authorise a connector, we access only the data covered by the permission you grant, and only to the extent needed to carry out the work you requested.

• Access permissions follow the principle of least privilege and can be revoked at any time.
• Access tokens are stored encrypted and invalidated when you remove the connection.
• Processing of data within the connected service is also subject to that service's own privacy policy.

When you connect a Google service (Gmail, Google Drive, Google Calendar, Google Docs, Google Sheets or Google Slides) to MORATUS, we access data in your Google Account only within the permissions you grant on Google's consent screen, and only to do what you ask in MORATUS.

Data we access:

• Gmail (read-only): the sender, recipients, subject, date and body of the emails you ask about.
• Google Drive (read-only): file names and details, and the text of the files you ask us to read.
• Google Calendar (read-only): the title, time, location, description and attendees of events in your primary calendar in the time range you ask about.
• Google Docs, Sheets and Slides: the content of the documents, spreadsheets and presentations you point us to, and the files we create or change with your approval.

How we use it:

• Only to carry out the request you make in chat: find, read and summarize the data you ask about, and create or edit a Docs, Sheets or Slides file when you ask.
• We never send, delete or change anything in Gmail, Drive or Calendar. In Docs, Sheets and Slides a file is created or changed only after you approve it on the confirmation card in chat, and we show you its link.

Sharing:

• To answer your request, the relevant data is sent to the AI model provider that processes it. Conversations that contain Google user data are processed only by providers that do not store that data or train models on it.
• We do not sell Google user data, use it for advertising, or transfer it to advertising platforms, data brokers or information resellers. We make no other transfers except for security, to comply with the law, or in a merger or acquisition with your prior explicit consent.
• No human reads Google user data, except with your explicit consent for specific data (for example, a support request you start), for security purposes such as investigating abuse or a bug, or to comply with the law.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.

Storage, control and deletion:

• Google access tokens are stored on our servers encrypted with AES-256-GCM and cannot be reached from the browser.
• Data a Google tool returns is saved as part of that conversation so you can see it in your history. It is deleted when you delete the conversation or your account.
• You can disconnect any Google service from the Plugins page at any time. When you disconnect the last service on a grant, access is revoked at Google and the tokens are deleted from our database. You can also remove access from your Google Account.
• To delete stored data, delete your conversations or your account, or write to privacy@moratus.ai.

MORATUS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google API Services User Data Policy
• Google Account access permissions

Your personal data may be transferred to the following recipient groups only for the purposes set out in this policy and only to the extent necessary:

• Model providers and the model routing service: Generating AI responses (see “AI Model Providers and Your Content”).
• Database provider: Storing account and content data on servers in Germany.
• Hosting, CDN and security providers: Hosting, content delivery, firewall and cookieless site measurement (Cloudflare).
• Communication services: Sending email and relaying contact form submissions.
• Paddle.com Market Limited: Processing orders as Merchant of Record; payment, invoicing, tax and refund transactions. For these transactions Paddle is an independent controller subject to its own privacy policy.
• Third-party services you connect: Actions carried out through connectors on your instructions.
• Competent authorities and institutions: Under legal obligations and court or administrative requests.
• An acquirer in a business transfer: In the event of a transfer or merger of the business, provided it maintains the protections in this policy.

We do not sell your data. You can request the current list of recipients, including their names, at privacy@moratus.ai.

To provide the Services, your personal data is transferred outside Türkiye. The main countries and purposes are:

These include countries for which the Turkish Personal Data Protection Board has not issued an adequacy decision. Transfers abroad are made under article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: where appropriate safeguards (such as standard contracts) can be put in place, we rely on them; where they cannot and the transfer is incidental, we rely on the exceptions in article 9/6 of the KVKK (such as your explicit consent, given after being informed of the possible risks). For users covered by the GDPR, transfers are subject to the transfer mechanisms in Chapter V of the GDPR.

Possible risks: in countries without adequate protection, your personal data may be subject to data protection rules different from those in Türkiye, public authorities may have broader powers to access it, and it may be harder for you to exercise your rights there.

Data is kept only as long as needed for the purposes of processing and for the periods required by law; when the period ends it is securely deleted, destroyed or anonymised.

• Encryption in transit and at rest (HTTPS/TLS, disk encryption)
• Access control, authorisation and authentication processes
• Principle of least privilege, with logging and monitoring
• Regular security updates, backups and vulnerability testing
• Contractual and technical security measures with data processors
• Confidentiality commitments and regular awareness training for staff

If a personal data breach is suspected, an impact assessment is carried out; where necessary, affected individuals and the competent authorities are notified within the periods prescribed by law.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Marketing based on profiling is carried out only with your consent, and you may opt out at any time.

• To learn whether your data is processed and to request information about it
• To learn whether it is processed in line with its purpose and to whom it is transferred in Türkiye or abroad
• To request correction of incomplete or inaccurate data
• To request deletion or destruction under the conditions prescribed by law
• To request restriction of processing or to object to processing
• To object to automated processing and to profiling
• To withdraw explicit consent at any time
• Data portability (for users within the scope of the GDPR)
• To lodge a complaint with the Turkish Data Protection Authority or the relevant supervisory authority

To exercise your rights under article 11 of the KVKK and, where applicable, the GDPR, you can contact us through any of the channels below.

Email:

Send your request to privacy@moratus.ai from the email address registered on your MORATUS account, or sign it with a secure electronic signature or mobile signature.

Written request:

Deliver a signed letter to the address given under “Data Controller” by hand, through a notary or by registered mail with return receipt.

Through a representative:

Requests made on your behalf must include a power of attorney that specifically authorises the representative for this purpose.

So that we can resolve your request without delay, it should include:

• Your first name, last name and, if you have one, the email address linked to your MORATUS account
• Enough information for us to verify your identity; where the law requires it, your Turkish ID number (for foreign nationals, nationality and passport number)
• The email or postal address where you would like to receive the response
• The right you wish to exercise and a clear summary of your request
• Any information or documents that support your request

If we cannot verify your identity, we may ask for additional information to prevent your data from being disclosed to an unauthorised person; we use that information only for verification. We resolve requests as quickly as their nature allows and in any case within 30 days, free of charge. If the request involves an additional cost, only the fee set in the tariff of the Turkish Data Protection Board may be charged. For requests under the GDPR, this period may be extended by two further months where the complexity or number of requests requires it; in that case we will let you know within the first month.

If we accept your request, we carry it out and inform you of the outcome; if we refuse it, we explain our reasons in writing or electronically.

If your request is refused, you find our response insufficient, or you do not receive a response in time, you may lodge a complaint with the Turkish Data Protection Board within 30 days of learning of our response and in any case within 60 days of the date of your request.

MORATUS is a service for adults and professional use. Our services are not directed at people under 18, and you must be at least 18 to create an account.

• We do not knowingly collect personal data from anyone under 18, and we do not direct marketing or profiling at them.
• If we learn that an account belongs to someone under 18, we close the account and delete the related personal data within a reasonable time, except for data we are legally required to retain.
• If you are a parent or legal guardian and believe your child has provided us with personal data, write to privacy@moratus.ai; we treat these requests as a priority.

If the content you upload to the platform (for example a document or a dataset) contains personal data about children, you or your workspace admin are responsible for having a valid legal basis to process it and, where required, the consent of a parent or legal guardian.

Our site and products may contain links to third-party websites, documents, social media accounts and embedded content. These links are provided for convenience only and do not mean that we endorse the site or its content.

• When you follow a link you leave MORATUS; the other party may collect data such as your IP address, device information and the page you came from on its own behalf.
• These parties are independent data controllers and process your personal data under their own privacy policies and terms.
• We have no control over, and are not responsible for, the content, security or data practices of third-party sites.

We recommend reviewing the privacy policy of every site you visit before sharing personal data. This section covers external links only: services you connect to your account are described under “Connectors and Third-Party Integrations”, and suppliers that process data on our behalf under “Transfers to Third Parties and Processors”.

We may update this policy in line with changes in legislation, decisions of regulators, new products and features, and changes in our processing activities or suppliers. The current version is always published on this page, and the “Last updated” date at the top is refreshed.

Material changes:

When a new purpose of processing, data category or group of recipients is added, or your rights are affected, we notify you a reasonable time before the change takes effect, by email to the address registered on your account or through an in-product announcement.

Changes that require consent:

If the scope of a processing activity based on your explicit consent is extended, we ask for your consent to the new scope separately; your earlier consent does not automatically cover the new purpose.

Other changes:

Changes that do not affect your rights, such as corrections, clarifications of wording and updated contact details, apply as soon as they are published on this page.

If you do not accept a change, you can stop using the services and ask us to close your account. We recommend reviewing this policy periodically.

This policy was published, and took effect, on the “Last updated” date shown at the top of the page. Each version that takes effect replaces the previous ones and applies to processing carried out after its effective date.

• Previous versions are archived; you can request any of them by writing to privacy@moratus.ai.
• This policy should be read together with the Terms of Use and the Cookie Policy.
• Where a separate Data Processing Agreement (DPA) has been concluded with an enterprise customer, its provisions prevail for the data it covers.
• If any provision is found to be invalid, the remaining provisions continue to apply.