This Privacy Policy explains how MortonApps LLC (“MortonApps,” “we,” “us”) collects, uses, and protects information in connection with the Morton Command Center website at mortoncommand.com (the “Site”) and the Morton Command Center platform (the “Service”).
We act in two different roles depending on how you interact with us:
- Visitors and prospective customers who use the Site: we are the data controller of any information you submit to us (for example, through the consultation and demo-request forms).
- Customers who have a Morton Command Center instance deployed for their organization: we act as a data processor for the customer, as Section 1b describes. The relationship is governed by our written agreement with that customer, including a Data Processing Addendum where one is signed.
1. Information We Collect
1a. From Site visitors (mortoncommand.com)
When you browse the Site, our hosting provider automatically processes standard technical information, including:
- Your IP address
- Your browser type, language, and operating system
- The pages you request and the timestamp of each request
- Referring URL when you arrive from another site
This information is used to operate and secure the Site and to identify abuse.
How you found us. Our own small script keeps a note in your browser (in local storage, not a cookie) of how you first arrived at the Site: the first page you visited, the website that sent you (if any), and any campaign tags in the link you followed. It ignores the note after 30 days. The note holds no visitor ID, and it leaves your browser only when you submit one of our forms or tap or click an email or phone link on the Site.
Email and phone links. When you tap or click an email address or phone number link on the Site, that script tells us which link it was, the page it was on, the note of how you arrived, and your approximate location (country and state), without your name or contact details.
Our forms. When you submit our consultation form (“Schedule a Consultation”), you provide:
- Your name
- Your MSP’s name
- Your work email address
- Your phone number (optional)
- The free-text message you type describing your stack and goals
When you request access to our live demo, you provide your name, work email address, MSP’s name, role, and MSP size, and optionally your current ticketing system and anything specific you want to see. When you email us, we receive what you send.
Sent with a form. When you submit either form, it also sends us the full web address of the page you sent it from, including anything after a “?” in that address (such as campaign tags), that page’s title, the note of how you arrived, your approximate location (country and state), your browser’s user-agent string (which names your browser, its version, and your operating system), how long the form was open before you sent it (to help spot bots), and a scrambled form of your IP address that helps us block spam.
Bot check. Our home page and demo page, which carry our forms, also load Cloudflare Turnstile, a bot check that runs when the page opens, whether or not you use a form. It receives your IP address and technical details about your browser and device under Cloudflare’s own privacy terms. When you submit a form, our form service also sends your IP address to Cloudflare to confirm the check.
We use this information to follow up on your inquiry, schedule a discovery call or set up your demo access, and learn which pages and campaigns bring us inquiries. We do not sell, rent, or share this information with third parties for marketing purposes.
1b. From customers using a deployed Morton Command Center instance
A Morton Command Center deployment is a per-tenant custom instance. The instance reads from and writes to your existing tools (your PSA, RMM, accounting system, security stack, etc.) on your behalf. The data processed inside the instance (your tickets, contacts, companies, devices, billing data, employee information, and so on) is your data. You (or, for your clients’ data, your clients) remain its controller. We process it to provide the Service, as our written agreement with you and this policy describe, and Section 4 explains how our AI provider may also use what it receives under its own terms.
Our access to that data is limited to what is necessary to provide, maintain, secure, and improve the Service and to provide support. We use AI tools for that work, including when we examine your data to fix a problem; Sections 4 and 5 explain what the provider of those tools receives and how it may use it. Further operational details and commitments are set out in our written agreement with you.
1c. Demo access
If we give you access to our live demo, you sign in to a demonstration copy of the Service that we run ourselves. Our authentication provider (Clerk) handles the sign-in, and the demo, like every instance, keeps an activity log of sign-ins and actions that includes IP addresses. For the demo, MortonApps is the controller. You can ask us to remove your demo access at any time.
2. How We Use Information
We use the information described above to:
- Operate, maintain, secure, and improve the Site and the Service
- Respond to your inquiries and provide customer support
- Understand which pages, websites, and campaigns bring us visitors and inquiries
- Send you transactional and account-related communications (for customers)
- Comply with our legal obligations and enforce our terms
- Detect, investigate, and prevent fraud, abuse, and security incidents
We do not use your information to train artificial intelligence models (except as Section 4 describes), run targeted advertising, or build behavioral profiles for any third party.
3. Cookies and Similar Technologies
On the Site we do not use advertising or social-media cookies, and we do not track you across other websites. The Site uses:
- Cloudflare Web Analytics, which Cloudflare says counts visits without cookies and without identifying or following individual visitors, so we can see which pages people use.
- Our note of how you found us, kept in local storage as described in Section 1a.
- Cloudflare Turnstile, the bot check described in Section 1a.
Cloudflare receives your IP address and browser details when your browser contacts it and handles that information under its own privacy terms. Cloudflare may also set a security cookie if it needs to check whether your browser is automated. You can delete the note at any time by clearing the Site’s data in your browser. The Site does not respond to browser Do Not Track signals. Our Cookie Policy has more detail.
Customer-facing Morton Command deployments use a small set of essential cookies for authentication and session management, set by our authentication provider (see Subprocessors below). They cannot be disabled while signed in. The Service also keeps some working data, such as ticket timers and call logs, in your browser’s storage; our Cookie Policy lists it. The icons the Service shows for client companies are fetched by our servers, usually from that company’s own website, and delivered to your browser by the Service. A YouTube video shown in an instance loads from YouTube, so Google receives your IP address and browser details, and YouTube may set its own cookies, under Google’s privacy terms.
4. Subprocessors
As of the date of this policy, we use these subprocessors to operate the Site and the Service:
| Subprocessor | Purpose | Scope | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, edge security, DNS, data storage, backup storage (R2), identity-aware access, visit counts on the Site (Cloudflare Web Analytics), the bot check on our forms (Turnstile), and running our form, sales-records, and email-sending services | Site + Service | Global edge (US-primary) |
| Amazon Web Services, Inc. | Email delivery for Site form submissions and for email the Service sends (Amazon SES); receiving replies to email the Service sends (Amazon SES, AWS Lambda, Amazon S3); encrypted database backups (Amazon S3) | Site + Service | United States |
| Clerk, Inc. | User authentication and session management for customer Morton Command deployments | Service only | United States |
| Microsoft Corporation (Microsoft 365 and Azure) | Our business email, where Site form submissions, emails you send us, support requests, and in-app bug reports are received and kept; and, for customers who use our Microsoft Teams app, relaying messages between Teams and the Service (Azure Bot Service) | Site + Service | United States (Azure Bot Service may process messages in other regions) |
| Anthropic, PBC | AI tools (Claude) we use to build, operate, support, and maintain the Site and the Service. They read form submissions, emails, support requests, in-app bug reports (including screenshots), and the data in a customer’s instance when we troubleshoot it, so they can receive any personal information that material contains, including information about a customer’s own clients. We use them under Anthropic’s consumer terms, not a data processing or business associate agreement, so Anthropic may use that material, under its own terms and privacy policy, to provide and improve its services and to check it for safety. We have turned off the setting that lets Anthropic train its models on our conversations, but its terms still let it train on a conversation its safety systems flag. Do not put protected health information in bug reports or support requests. | Site + Service | United States (Anthropic may also process data in other countries) |
| Telegram | The messaging app that relays our AI tools’ replies to us, which can quote form submissions, emails, bug reports, and customer data | Site + Service | Global (Telegram is based outside the United States) |
| Google LLC (Google Drive) | Backups of our working computer, which can include our working notes and other working copies of form submissions, emails, bug reports, and customer data | Site + Service | United States (Google may also store data in other countries) |
When you submit a form on the Site, MortonApps’ own form service records it, copies it to our internal sales records, and emails it to us through our own email-sending service. Integrations with your own tools (your PSA, RMM, accounting system, and so on) work under your accounts with those vendors and are not listed here; our Microsoft Teams app is the exception and is listed above. We may add or change subprocessors over time; this page will be updated when we do.
5. How We Share Information
We do not sell, rent, or trade your personal information. We share information only in these limited circumstances:
- With our subprocessors, listed above, to provide, maintain, secure, improve, and support the Site and the Service and to deliver and respond to your inquiry. Anthropic may also use what it receives as its own terms allow, as Section 4 explains.
- With Google and Cloudflare, whose services your browser contacts directly, as described in Section 3
- With people and service providers who help us operate our business (for example, our sales representative, attorney, accountant, or payment processor) under confidentiality obligations
- To comply with the law when we receive a valid legal request. We may challenge a request we believe is overbroad or unjustified.
- To protect rights and safety of MortonApps, our customers, or the public
- In connection with a corporate transaction such as a merger or acquisition, in which case your information remains subject to the commitments in this policy
6. Data Retention
We keep consultation and demo-request form submissions so we can follow up on your inquiry and keep a record of it. Our form service and our internal sales records are set to delete each submission automatically 24 months after we receive it. Our email-sending service deletes the content of each email it sends us about a submission, including a daily summary of submissions our spam filter held for review, 30 days after sending; after that it keeps only a sending record.
Some copies can last longer. Each submission is also emailed to our business email, where the emailed copies are not deleted automatically. We also keep encrypted backups of our databases: daily backups expire after about 90 days, monthly archive copies are kept for up to 12 months, and our database provider keeps a 30-day restore history. Copies of files stored in our services (such as attachments and bug-report screenshots) are also kept in our backup storage until we remove them after the original is deleted. Backups of our working computer, which can include records of and notes from AI sessions and other working copies, are kept in Google Drive for up to about 13 months. A deleted submission can remain in any of these backups, which we use only to restore lost or damaged data and to test that restoring works. When we use our AI tools on a submission or an email, Anthropic keeps that conversation for 30 days after the session ends (for a session we open on or connect to claude.ai, until 30 days after we delete it there), or up to 2 years if its safety systems flag it, and longer where the law requires. Our AI tool’s transcript of each session on our computer is deleted about 30 days after the session is last used. The tool’s log of the requests we type to it, its replies relayed to us through Telegram (which stay in that chat, and in our copy of them, until we clear them), and notes we make from a session are kept with our other business records.
If you ask us to delete your information, we will delete your submission from our form service, sales records, and email-sending service and any notes we made from an AI session, and take reasonable steps to delete the emailed copies, unless we need to keep something for a legal, tax, or security reason. Anthropic’s copy expires on the schedule above. We do not edit backups, so a copy can remain in a backup until that backup expires; if we ever restore from one, we will delete your submission again.
Records of email or phone link taps and clicks, which carry no name or contact details, are kept as marketing records. Standard server log data is kept on a rolling basis under our providers’ defaults.
Customer data inside a deployed Morton Command instance is kept for the duration of the customer relationship. When the relationship ends, we make the customer’s data available for export on request for 30 days, or for the period our agreement with that customer sets, and then, within 90 days after that period ends, delete the instance and its data, except data the law requires us to keep or that we need to resolve a dispute. That deletion does not reach copies kept outside the instance: our encrypted backups, which follow the schedule described above (backup copies of the instance’s files stay until we remove them) and are used only to restore lost or damaged data and to test that restoring works; in-app bug reports and emails the customer’s users sent us, which we keep to support and improve the product and delete on request; our email-sending service’s records of the instance’s email, which after 30 days hold no message content, only a sending record that can include the sender’s name and address and some recipients’ addresses, together with any address that bounced or reported a message as spam, which we keep on a do-not-send list, so our products do not email it, until the entry is lifted; conversations with our AI tools, which Anthropic keeps as described above; replies from our AI tools relayed to us through Telegram, which stay in that chat until we clear it; notes from those conversations, kept with our other business records, which we delete on request; and backups of our working computer, which follow the schedule described above.
7. Your Rights
Depending on where you live, you may have the following rights regarding your personal information:
- Access: request a copy of the information we hold about you
- Correction: ask us to correct inaccurate or incomplete information
- Deletion: ask us to delete information we hold about you, subject to legal exceptions
- Restriction or objection: ask us to limit how we process your information
- Portability: request a copy of your information in a portable format
- Withdraw consent: where we rely on consent as our legal basis
To exercise any of these rights, contact us using the details in Section 12 below. We will respond within a reasonable time and within any deadline applicable law sets. We do not discriminate against you for exercising any of these rights.
If you are a California resident, California law may give you the right to know what categories of personal information we collect and to access, correct, and delete it. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
8. International Data Transfers
MortonApps is based in the United States, and our subprocessors are US-based companies except Telegram, which is based outside the United States. The Site and the Service are intended for businesses in the United States. If you access them from outside the United States, your information will be transferred to, stored in, and processed in the United States, and some of our subprocessors may also process it in other countries, as Section 4 notes.
9. Security
We take reasonable and appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, and destruction. These measures include encryption in transit (TLS) and at rest, access controls, role-based permissions inside the Service, and audit logs of administrative actions taken in the Service.
No system is perfectly secure. If we ever experience a security incident affecting your personal information, we will notify affected parties as required by applicable law.
10. Children’s Privacy
The Site and the Service are intended for business use by managed service providers and their authorized personnel. They are not directed to children under 16, and we do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.
11. Changes to This Policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page.
12. Contact Us
If you have questions about this Privacy Policy, want to exercise any of the rights described above, or have a complaint, contact us at:
MortonApps LLC
Privacy Inquiries
Email: [email protected]
For matters concerning a deployed Morton Command Center instance, please contact your designated MortonApps representative or use the support channels in your agreement with us.
Please don’t email us confidential or sensitive information, such as passwords, account credentials or personal records. If you send it anyway, we’ll keep it confidential and delete it when we no longer need it.