Privacy policy.
We keep only what you type into three forms, plus cookie-free analytics that run only if you allow them. We never sell any of it. This page says exactly what we hold, why, for how long, and how to make us delete it.
1. Who we are
Morton Labs, a company headquartered in Chicago, Illinois (“Morton Labs”, “we”), operates www.mortonlabs.ai and is the controller of the personal data described here. Write to us at zach@mortonlabs.ai or by post at Chicago, IL, USA. We have not appointed a data protection officer or an EU or UK representative; we are not required to.
The Fusion Hub at hub.mortonlabs.ai is a separate application with its own notice. This policy does not cover it.
2. What we collect, and where it comes from
We collect nothing you do not give us, plus the standard request data any web server sees. There are no accounts and no sign-in.
Contact form
When you use the form on /contact we store your name, email address, company or program (optional), and your message. Alongside it we record a salted one-way hash of your network (IP) address and your browser’s user-agent string, both taken from the request. The raw IP address is never stored.
Job applications
The careers form, shown only while a role is open, stores the role you apply for, your name, email address, any links you choose to share (LinkedIn, GitHub, portfolio), and your message, plus the same hashed network address and user-agent. Send only what you want us to read, and please leave out sensitive personal data such as health, religion or immigration details.
Newsletter
The footer signup stores your email address, the fact that it came from the site footer, and a hashed network address. Nothing else.
Analytics
If you choose Allow analytics, Vercel Web Analytics and Speed Insights record the page URL, referrer, a filtered query string, country, region and city, browser, operating system and device type, a timestamp, and Core Web Vitals timing. They set no cookies and store no identifier on your device. Vercel derives a hash from the request that is discarded within 24 hours and cannot follow you across sites. Nothing is recorded until you allow it.
Hosting
Vercel, our host, receives the request data every website’s server sees — IP address, request headers, the URL you asked for — to deliver pages, defend against abuse, and keep short-lived server logs. We add nothing to that.
The hashed network address is pseudonymised personal data, not anonymous data: we hold the salt. It exists only to key a per-network limit of a few submissions per hour, and it is scrubbed after 30 days.
3. Why we use it, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answer your enquiry or arrange a demo | Contact form data | Steps you ask us to take before a contract (GDPR Art. 6(1)(b)); our legitimate interest in responding |
| Consider your application | Careers form data | Pre-contract steps (Art. 6(1)(b)); legitimate interest in recruiting |
| Send the newsletter | Email address | Your consent (Art. 6(1)(a)) — withdraw any time |
| Prevent spam and abuse (honeypot, timing check, per-network rate limit) | Hashed network address, user-agent | Legitimate interest in security (Recital 49) |
| See which pages are useful and how fast they load | Aggregate analytics | Your consent (the analytics bar); no profiling |
| Comply with law and defend claims | Any of the above | Legal obligation; legitimate interest |
We do not make automated decisions with legal or similarly significant effects, and we do not profile you. No law or contract requires you to give us anything; if you leave a form blank, the only consequence is that we cannot reply.
4. Who can see it
Inside Morton Labs, only the founders and engineers who need it. Outside, four service providers, each bound by a data-processing agreement:
| Provider | Location | What it does |
|---|---|---|
| Vercel Inc. | United States | Hosts the site and keeps short-lived request logs; runs Web Analytics and Speed Insights when you allow them |
| Supabase Pte. Ltd. | Singapore; our database runs on AWS in us-east-1 (Virginia, United States) | Stores form submissions |
| Plus Five Five, Inc. (d/b/a Resend) | United States | When enabled, emails us a copy of each contact and careers submission; Resend keeps message logs for 30 days |
| Google LLC (Google Workspace) | United States | Runs our mailbox, where those notifications and your direct emails land |
We never sell, rent or share personal information for advertising. We disclose it beyond this list only when the law requires, to protect rights and safety, or if the business is ever sold or merged — and we would tell you first. No third party tracks you on this site.
5. Where it is stored; international transfers
We are in the United States and process your data here. Vercel and Resend are certified under the EU–US Data Privacy Framework; Supabase processes under the EU Standard Contractual Clauses with the UK Addendum. If you are in the EEA, the UK or Switzerland, your data leaves your jurisdiction when you submit it. Email us for copies of the safeguards.
6. How long we keep it
| Data | Kept for |
|---|---|
| Contact submissions | 24 months from submission |
| Job applications | 12 months from submission — longer only if you ask us to keep you on file |
| Newsletter address | Until you unsubscribe, then 30 days |
| Hashed network address and user-agent | 30 days from submission (they only serve a 60-minute abuse window); after that the fields are overwritten |
| Notification emails | Our mailbox retention; Resend’s copy for 30 days |
| Analytics | Aggregate only; never tied to you |
A nightly job in our database enforces these periods; they are not good intentions. When retention ends we delete the data or irreversibly anonymise it. We may keep a record longer if we need it for a legal claim, and we will tell you if that applies to you.
7. Cookies, analytics, Do Not Track and Global Privacy Control
This site sets exactly one cookie, and only after you make a choice in the analytics bar:
| Cookie | Type | Lifetime | Purpose |
|---|---|---|---|
ml_consent | First-party, strictly necessary | 180 days | Stores your analytics choice (allow or decline) so we do not ask again |
Nothing else is stored in your browser: no local storage, no third-party cookies, no advertising pixels. Vercel Web Analytics and Speed Insights are cookieless and load only after you choose Allow analytics; until then no analytics request leaves your browser. Change your mind at any time with the Cookie settings link in the footer. Declining is remembered for the same 180 days, so you are never asked twice.
We honour Global Privacy Control: if your browser sends the GPC signal we treat it as a decline. We treat Do Not Track the same way. Because we do not sell, share or advertise, those signals have nothing else to opt you out of — that is already the default.
8. Your rights and choices
Wherever you live, you can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct it;
- delete it;
- hand it over in a portable format;
- restrict or stop a particular use of it;
- withdraw consent — for the newsletter or for analytics — without affecting anything done before you withdrew.
We will not treat you differently for exercising any of these. Email zach@mortonlabs.ai from the address you used with us. We reply within 30 days (one month under the GDPR, extendable once by two months for a complex request, and we will say so). We may ask you to confirm the request from that address. An authorised agent may write on your behalf with proof of authority. There is no charge unless a request is plainly unfounded or repetitive.
If you are in the EEA or the UK you can also complain to your supervisory authority — the Information Commissioner’s Office in the UK, or the authority in your EU member state. We would rather hear from you first.
9. How to complain to us
Email zach@mortonlabs.ai with “Privacy complaint” in the subject line, or write to Chicago, IL, USA. We acknowledge every complaint within 30 days and aim to resolve it without undue delay. If you are unhappy with our answer you can go to the ICO (UK), your EEA authority, or the Illinois Attorney General.
10. Newsletter specifics
The newsletter is occasional email about Morton Labs. Signing up is your consent, and we record when you gave it and which version of this policy was in force. Unsubscribe with the link in any email or by writing to zach@mortonlabs.ai; we honour it within 10 business days, usually immediately. Every marketing email carries our postal address. We do not share the list with anyone, and we send nothing until a working unsubscribe link exists.
11. Security
HTTPS everywhere, with HTTP Strict Transport Security. No database keys in the browser. Row-level security with zero public access, and writes only from server code. A honeypot, a timing check and per-network rate limits on every form. Access limited to the people who need it. No method is perfect; if a breach affects you we will notify you and any regulators as the law requires.
12. Children
This site is for professionals and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, email us and we will delete it.
13. Changes to this policy
We post changes here and update the effective date and version. For a material change we add a note to the top of this page for 30 days, and email newsletter subscribers where the change affects them. Prior versions are available on request.
- Version 1.0 — 2026-09-19
- First version.
14. Contact
Morton Labs, Chicago, IL, USA. zach@mortonlabs.ai. Questions about this policy, rights requests and complaints all go to the same address.
Adapted in part from the Basecamp open-source policies (CC BY 4.0).