Privacy Policy

1. Overview

Morstex ("Morstex," "we," "us," or "our") provides a multi-tenant messaging and client-engagement platform that unifies SMS, MMS, calling, e-signatures, and ad-attribution tracking into a single inbox for business phone numbers. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices available to you when you use our website, our application, and related services (together, the "Service").

This policy applies to three groups of people: visitors to our marketing site, the organizations and individual users who sign up for and administer the Service ("Customers"), and the end recipients that Customers message, call, or send documents to through the Service ("Contacts"). Where the obligations differ between these groups, we say so explicitly below.

2. Information We Collect

2.1 Account & organization information

When you create an account, we collect your name, email address, password (stored as a salted hash, never in plain text), and the organization details you provide — business name, team member invitations, and role assignments.

2.2 Connected provider credentials

To send and receive messages and calls, each organization connects its own Twilio and/or Sinch account. We store the API credentials you provide for that connection solely to operate the Service on your behalf; we never use your credentials to send traffic outside of actions you or your team initiate.

2.3 Message, call, and document content

We store the SMS/MMS messages, call metadata (duration, timestamps, recording where enabled), e-signature documents, and merge-field contact data that flow through your organization's inbox, so that your team has a durable, searchable record of every conversation.

2.4 Contact data

Customers upload or sync contact records — names, phone numbers, email addresses, and related fields — from their own CRM, spreadsheet, or connected data source (for example Google Sheets or a custom API). Morstex processes this data as directed by the Customer; the Customer is the data controller for its Contacts, and Morstex acts as a data processor with respect to that Contact data.

2.5 Ad-attribution data

Where a Customer enables ad-attribution tracking, we capture click identifiers and campaign parameters (for example from Google Ads) passed to us when a Contact engages with a tracked link, and associate that identifier with the resulting conversation and, where applicable, a signed document — so the Customer can trace a signed client back to the campaign that produced them.

2.6 Usage & device data

We automatically collect standard web and application logs: IP address, browser type, device identifiers, pages visited, and timestamps, used for security, debugging, and product analytics.

2.7 Cookies & local storage

Our marketing site and application use cookies and browser storage for session authentication, remembering your theme preference, and basic analytics. We do not use third-party advertising trackers on the application itself.

3. How We Use Information

• To operate, maintain, and secure the Service, including routing messages and calls through your connected Twilio or Sinch account.
• To authenticate users, enforce organization-level access controls, and maintain an audit log of account activity.
• To generate, send, and track e-signature requests and record the resulting signed documents.
• To associate ad-click identifiers with conversations and signatures for attribution reporting, where a Customer has enabled that feature.
• To provide customer support and respond to inquiries sent through our contact form or support channels.
• To send Service-related notifications — product updates, security alerts, and billing communications.
• To monitor, debug, and improve the reliability and performance of the Service.
• To comply with legal obligations and enforce our Terms & Conditions.

4. SMS, MMS & Calling Compliance

Morstex is a platform that Customers use to message and call their own Contacts through their own connected provider accounts. Morstex does not originate marketing messages on its own behalf through the Service, and does not sell or rent Contact data collected on behalf of a Customer.

Customers are solely responsible for obtaining all legally required consent (including under the Telephone Consumer Protection Act, CAN-SPAM, and applicable carrier 10DLC registration rules) before messaging or calling a Contact through the Service, and for honoring opt-out requests. Morstex supports standard opt-out keyword handling at the provider level, but compliance with messaging consent law is the Customer's obligation as the party directing the communication.

5. How We Share Information

We do not sell personal information. We share information only in the following circumstances:

• Connected communications providers — Twilio and/or Sinch, as connected by each Customer, to deliver the messages and calls that Customer sends.
• Infrastructure & hosting providers — our database, file storage, and application hosting vendors, bound by confidentiality and data-processing terms.
• Integrated third-party services a Customer connects — for example a CRM, Google Sheets, or a custom API source — solely to the extent the Customer configures that integration.
• Legal & safety — where required to comply with law, a valid legal process, or to protect the rights, property, or safety of Morstex, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy's commitments carrying forward.

6. Data Retention

We retain account, message, call, and document data for as long as an organization maintains an active account, plus a reasonable period afterward for backup, legal, and dispute-resolution purposes. A Customer may request deletion of their organization's data by contacting us; some records may be retained longer where required by law or legitimate business need (for example, signed documents relevant to a dispute).

7. Data Security

We apply industry-standard safeguards, including encrypted transport (TLS), encrypted password storage, role-based access control, per-organization data isolation, and an audit log of sensitive account actions. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service.

8. Your Rights & Choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, or to object to certain processing. Customers can manage most of this directly within account and contact settings; Contacts who wish to exercise a privacy right with respect to data held on behalf of a Customer should contact that Customer directly, or reach us at the email below and we will route the request appropriately, consistent with our role as a data processor for Contact data.

9. Children's Privacy

The Service is intended for business use by adults and is not directed to individuals under 18. We do not knowingly collect personal information from children.

10. International Data Transfers

Morstex is based in the United States and processes data on infrastructure located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above, and where appropriate, additional notice will be provided to Customers.

12. Contact Us

Questions about this Privacy Policy, or requests related to your data, can be sent to support@morstex.com.