Privacy
Privacy
Last reviewed:
Translated from the Spanish original, which stays available: leer en español.
Who’s responsible
The controller is Alejandro Carbajo Vidales, NIF (Spanish tax ID) 71558556J, Calle Jacinto Benavente 10, 1º Dcha., 24750 La Bañeza (León), Spain. For anything to do with privacy: [email protected].
This policy covers this site, Moritura’s web app and its Android and iOS companion apps during the invitation-only beta, in Spanish and in English. The closed test may include invited testers outside Spain; production availability remains limited to Spain. Whichever language you use, the controller is in Spain and Spanish and EU data-protection law applies. Moritura is for people aged 18 or over.
Beta access and charging are closed. The server is deployed, but it does not accept inquiries or call AI providers. Sign-in may be available to prepare access. Conversations and their AI processing will only become active when access opens.
The short version
- What you write is stored on your device. When you ask the AI for a reply, only the content needed to answer you travels. You can also explicitly transfer your inquiry to another device.
- Before anything is sent, the app asks for your explicit permission and tells you which AI provider is active and how long it keeps the data.
- We don’t sell what you write, we don’t use it to train AI models (ours or anyone else’s) and we don’t put it into analytics.
- Nobody routinely reads or replies to your conversations. It isn’t live monitoring or an emergency service.
What data we handle and why
| Data | What for | Legal basis |
|---|---|---|
| The text you send and the selected context of your inquiry | Generating the reply you ask for and checking whether the conversation should stop for safety | Your explicit consent, because what you write may include health data or other sensitive data (GDPR, arts. 6.1.a and 9.2.a) |
| Minimal safety records: category of the alert, reply shown, correction and times. Never your words | Checking that the safety stop worked and correcting false positives | The same explicit consent |
| Technical session state, permission receipts, and spend and repeat controls | Making the conversation work, letting you pick it up again and preventing abuse | Providing the service you ask for (art. 6.1.b) and, for anything sensitive, your consent |
| Invitation email | Letting you into the beta | Providing the service (art. 6.1.b) |
| Sign-in provider identifier, email and verification status | Signing you in and linking your access to the same account across devices | Providing the service (art. 6.1.b) |
| Purchase email, payment references, accepted terms, your start choice, contract, withdrawal and refund dates | Charging you, giving you access, sending confirmations and handling refunds | The contract (art. 6.1.b) and, for accounting or tax records, legal obligation (art. 6.1.c) |
| Content-free security logs and logs of exceptional access | Protecting the service and investigating misuse | Legitimate interest (art. 6.1.f); you can object |
| Usage analytics, only if you allow them | Understanding what works in the product | Your consent (art. 6.1.a) |
What you write isn’t used for advertising or research. Research using product data is switched off; if it ever existed, it would be optional and need a separate consent.
Your consent doesn’t cover other people’s sensitive data. If you talk about someone, say only what your question needs and leave out details that would identify them.
Moving your inquiry to another device
Transfer is optional and requires a separate confirmation. We temporarily store an encrypted copy of your inquiry, including its reflections and work, tied to your signed-in account. The one-use link goes to that account’s email through Brevo. You must sign in to the same account on the receiving device. Brevo receives the link; it does not receive the inquiry text.
The encrypted copy expires after fifteen minutes. Once the receiving device has saved it and confirmed that to the server, the server deletes the copy. An interrupted confirmation can be retried. Expired copies are purged every minute while the server is running; they cannot be claimed after expiry. Deleting the source inquiry, withdrawing its processing consent or deleting the account also deletes pending transfers. This is a one-time copy, with no ongoing synchronisation.
New inquiry and transfer-recovery files on iOS are protected by the device’s Data Protection and excluded from device backup. Android backup for this app is disabled. Your existing source copy remains on its original device until you delete it.
Providers
These providers handle data on Moritura’s behalf and under contract:
- AI provider. Moritura uses one at a time: OpenAI or Google (Gemini API, paid service). Your text only goes to the one that’s configured, and the app tells you which before asking for your permission.
- OpenAI: under its API terms, it doesn’t use this data for training unless the customer allows it, and Moritura doesn’t. It may keep it for up to 30 days to detect abuse, with the exceptions it publishes (OpenAI data controls; data processing addendum).
- Google: on the paid service, it doesn’t use your prompts or the replies to improve its products. It keeps them for 55 days to detect breaches of its usage policy, and authorised Google staff may review prompts flagged by its filters (Gemini API terms; abuse monitoring; processing terms).
- Hosting. The server and database run on infrastructure managed directly by Moritura’s controller.
- Cloudflare serves this site and protects connections to the server. It can see content while it passes through its network (data processing agreement).
- Stripe takes the payment. It receives your email, the product, the amount and technical references, and your card details directly on its own page. It never receives what you write. For fraud and its financial obligations, Stripe acts as an independent controller (data processing agreement).
- Brevo sends the service’s emails: access, inquiry-transfer links, purchase confirmation, withdrawal and refund. It doesn’t carry what you write in the conversation (data processing agreement).
If you choose Google or Apple sign-in, that provider verifies your identity and gives Moritura an account identifier and your email, which may be an Apple relay address. Moritura does not receive your Google or Apple password. Your inquiry text is not sent through sign-in. Google sign-in on the web uses Firebase Authentication, which also processes authentication records, IP addresses and browser information for security. Firebase keeps logged IP addresses for a few weeks and other authentication information until deletion is requested; removal from its live and backup systems can then take up to 180 days (Firebase privacy information). Google and Apple also handle your own provider account under their respective privacy policies.
Transfers outside the European Economic Area
Some of these providers may handle data outside the EEA. When that happens, the transfer relies on the EU-US Data Privacy Framework if the recipient has joined it, or on the European Commission’s standard contractual clauses. That’s what the agreements of OpenAI (§4), Google, Cloudflare (§6) and Stripe provide for. Google says it may process data in any country where it has facilities. We don’t promise that everything stays in the European Union.
How long
| What | Period |
|---|---|
| Your conversation, your case file and your work on the device | Until you delete them. You can delete parts or everything from the app |
| Minimal safety record | 7 days from when it was created. Correcting it doesn’t extend the period |
| Technical session state, permission, and repeat and spend controls | 31 days from your last action in the session. Looking at it doesn’t extend the period |
| Closing control after a deletion | 31 days, with no content or category |
| Log of exceptional access | 90 days from the access |
| AI provider | OpenAI, up to 30 days; Google, 55 days. These are the provider’s periods and ours don’t shorten them |
| Email logs at Brevo | One month, with no copy of the message content |
| Purchase, payment, withdrawal and refund | For as long as the contract lasts and afterwards for as long as tax and consumer obligations require |
Expired data is deleted every hour while the server is running; expired data stops being used even before it’s deleted. Analytics events stop being linked to your account if you delete it.
Exceptional access
If you ask for help, we’ll only access what you authorise to sort it out. We review the product’s safety with minimal records, without your words. Exceptional access for safety or a specific obligation must have a reason and limited permissions, and must be logged. If it requires reading sensitive information, we need your explicit consent or a specific legal basis that allows it.
Your rights
You can ask to access your data, correct it, delete it, restrict its use, take it with you and object to its processing. You can withdraw your consent whenever you want: from that moment we stop sending your text to the AI, without affecting what was done before. Withdrawing it doesn’t take away export, deletion or the help resources, and you don’t have to pay or create an account to exercise your rights.
From the app you can export your work and delete it, on the server too if you don’t have an account. For anything else, write to [email protected]. We’ll reply within one month at most. If you clear your browser and lose the proof of your session, we may need one more detail to find it; never more than strictly necessary. More details in privacy choices and delete account.
If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
Changes
If we change something important, such as the AI provider or a retention period, we’ll update this page before the change applies. The review date is at the top.