MoroAK — Privacy Notice
1 · Who we are
MoroAK is a professional knowledge infrastructure platform operated at moroak.com.
Who is responsible for your data
Which company is responsible for your data depends on which service you use. This is the single most important thing in this section, and it is set out plainly rather than buried.
| If you are using… | The controller is… | Why |
|---|---|---|
| The platform — an account, a purchase, an enquiry, an educator application, published content. Wherever you live | MOROAK-NEY LTD ("MoroAK-UK") Company number 15533213 · Verona, Globe Road, Leeds, England, LS11 5FH | It operates the platform, contracts with every buyer as seller of record, receives the revenue and issues the receipts — so it decides the purposes and the means |
| Being paid as an educator who is resident in Brazil — your payout account, your payment records and the tax records that go with them | MoroAK-UK and MoroAK Educação Inova Simples (I.S.) ("MoroAK-BR"), jointly, and for this alone CNPJ 60.604.134/0001-43 · Rua Professor Guido Straube, 75, Conjunto 601, Vila Izabel, Curitiba, Paraná, CEP 80320-030, Brazil | The payment system cannot reach a Brazilian account from outside Brazil, so MoroAK-BR makes the payment and keeps the records Brazilian law requires of it. It is not a controller of anything else, and if you are a buyer or a reader in Brazil it holds no data about you |
| Advisory services — the advisory enquiry form, and any mandate that follows from it | MOROAK-NEY LTD ("MoroAK-UK") Company number 15533213 · Verona, Globe Road, Leeds, England, LS11 5FH | Advisory services are contracted and invoiced by MoroAK-UK under separate terms. They are not part of the platform, and the data does not mix with platform data |
The joint controllership is narrow, and it is narrow on purpose. It covers one thing: paying an educator who is resident in Brazil. Everything else on the platform has a single controller, MoroAK-UK — and that is so for a buyer, a reader or an enquirer in Brazil exactly as it is for one anywhere else. Where we are joint controllers you do not have to work out which of us to approach: we have agreed between us who does what, as Art. 26 UK and EU GDPR requires, the essence of that arrangement is set out in this section and the whole of it is available on request - info@moroak.com.
How to reach us
| Purpose | Contact |
|---|---|
| Anything about this notice, or about your personal data | info@moroak.com |
| Formal legal notices | legal@moroak.com |
| Payments, refunds and receipts | billing@moroak.com |
| Our representative in the European Union | See section 12.1 |
2 · What this notice covers
This notice applies to everyone whose personal data we process, including:
- Visitors to moroak.com who make an enquiry or subscribe to our newsletter;
- Registered users who create an account;
- Buyers of interactive tools, programmes and other paid content;
- Educators and Experts who apply to publish on the platform, and those whose applications are validated or refused;
- Prospective advisory clients who describe a matter through our advisory enquiry form.
It does not cover third-party websites we link to, or an educator's own processing of data about their learners where the educator is a separate controller.
3 · What we collect, why, and on what legal basis
The table below is the substance of this notice. Each row states a purpose, the data used for it, and the lawful basis under UK and EU GDPR Art. 6 and under LGPD Art. 7.
| Purpose | Personal data | UK / EU GDPR | LGPD |
|---|---|---|---|
| Answering an enquiry made through the advisory or educational programme forms | Name, email, organisation, role, jurisdiction, subject area, engagement type, participant numbers, how you found us, and any free text you write describing your objectives or a live matter | Art. 6(1)(b) — steps at your request before entering a contract | Art. 7, V |
| Sending the newsletter | Email address, language preference, subscription and unsubscribe dates | Art. 6(1)(a) — consent | Art. 7, I |
| Creating and running your account | Email, password (stored only as a cryptographic hash), display name, username, language and theme preference, sign-in timestamps, IP address, browser user agent | Art. 6(1)(b) — performance of a contract | Art. 7, V |
| Selling and delivering paid content | Purchase records, entitlements, order references, order history. Card details are entered directly with Stripe and are never seen or stored by MoroAK | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation for tax and accounting records | Art. 7, V and II |
| Recording that you accepted the Terms of Service, or the Educator Agreement, when you opened or changed your account | Your account identifier, the version, the language displayed to you, the time, and a cryptographic fingerprint of the exact text shown | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation to evidence what was disclosed | Art. 7, V and II |
| Recording that you accepted the Terms of Sale before paying | Your account identifier, the item, the version of the terms, the language you read them in, a cryptographic fingerprint of the exact text displayed to you, and the payment references | Art. 6(1)(b) — contract; Art. 6(1)(c) — the pre-contract information duty | Art. 7, V and II |
| Identifying your copy of a tool you have bought | Your name and your order reference are shown at the foot of the tool on screen and on every page you print, together with a reference unique to that purchase. Your email address is not printed on your copy | Art. 6(1)(f) — our legitimate interest in preventing the redistribution of paid material, which we have balanced against your interest in not having your contact details visible to anyone you show the output to — that is why the email address is left off | Art. 7, IX |
| Assessing an educator application | Name, professional qualifications, institution, years of experience, professional profile links, and any credential document you upload | Art. 6(1)(b) — steps at your request before entering the Educator Agreement | Art. 7, V |
| Structural and authority validation of submitted publications, including automated extraction and checking of uploaded documents | The submitted document and the metadata extracted from it; validation status and history | Art. 6(1)(b) — contract. See section 5 | Art. 7, V. See section 5 |
| Paying educators their share | Payout records and the identifiers of the connected payment account. Identity verification for payouts is carried out by Stripe as controller of that process | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation | Art. 7, V and II |
| Recording learning activity | Capsule submissions, quiz results, streaks and badges | Art. 6(1)(b) — contract | Art. 7, V |
| Publishing reviews and educator profiles | The content you choose to publish, and your display name | Art. 6(1)(b) — contract; Art. 6(1)(a) where you elect to be identified | Art. 7, V and I |
| Booking live sessions | Your Calendly event types and scheduling links where you connect Calendly to your educator profile | Art. 6(1)(b) — contract | Art. 7, V |
| Answering support questions through the assistant on the platform | The content of your messages. The assistant is an automated system and tells you so when you open it. Where a message is answered with the help of a language model, the provider of that model processes the message as our processor and is named in section 6 | Art. 6(1)(f) — legitimate interest in supporting users | Art. 7, IX |
| Delivering platform email, and knowing when it fails | Recipient address, template, message identifier, delivery status and any error. Addresses that bounce or unsubscribe are kept on a suppression list so we do not write to you again | Art. 6(1)(f) — legitimate interest in ensuring messages we are asked to send actually arrive | Art. 7, IX |
| Keeping an authentication audit trail | For each sign-in, sign-out, failed attempt, password change, sign-up and email confirmation: your account identifier, the time, your IP address and your browser user agent. See section 8 on how these are treated at the end of their life | Art. 6(1)(f) — legitimate interest in the security and integrity of accounts | Art. 7, IX |
| Keeping administrative and audit records, including a record of any administrator who accesses the platform as another user | User identifiers, timestamps, IP addresses, the action taken, and who took it | Art. 6(1)(f) — legitimate interest in the security, integrity and accountability of the platform | Art. 7, IX |
| Preventing fraud and abuse | Sign-in patterns, IP addresses, and records of blocked or suspicious activity | Art. 6(1)(f) — legitimate interest in protecting the platform and its users | Art. 7, IX |
| Understanding how the platform is used | Aggregated and pseudonymised usage statistics | Art. 6(1)(f) — legitimate interest in improving the platform | Art. 7, IX |
3.1 · The advisory enquiry form, specifically
Our advisory enquiry form invites you to describe a live matter. Depending on what you write, that description may contain confidential information about you or about a third party, and in some circumstances it may contain special category data within the meaning of Art. 9 GDPR and Art. 5, II LGPD.
Please do not include information you would not want us to hold, and in particular do not include third-party personal data, health information, or details of criminal proceedings, at the enquiry stage. Tell us only what we need in order to say whether we can help.
An advisory enquiry never reaches the platform side of the business and never reaches MoroAK-BR, whoever you are and wherever you live. It is held by MoroAK-UK under professional confidentiality, separately from platform data, and it is not used to market anything to you. See section 1.
You do not have to give us anything to read publicly available content. To open an account, to buy, or to publish as an educator, the data marked in the table above as used for a contract is required in order to enter that contract, and if you do not provide it we cannot open the account, complete the purchase or accept the application. Everything else is optional, and not providing it costs you nothing but the feature it supports.
4 · Where the data comes from
Most of the personal data we hold comes from you directly. We also receive:
- From Stripe — confirmation that a payment succeeded, the last four digits and brand of a card, and, for educators, the verification status of a connected payout account. We do not receive full card numbers.
- From Calendly — your event types and scheduling links, where you connect Calendly to your educator profile.
- From an educator — where an educator names or describes another person in content they publish. In that case the educator is responsible for having a basis to do so, and we act on notice if the content is inaccurate or should not have been published.
- From your device — IP address, browser type and language, as any website receives.
5 · Automated processing and validation
MoroAK-UK validates the structure and authority of material submitted for publication. Part of that process is automated: uploaded documents are read by software that extracts metadata and checks the submission against our published Authority Standards.
5.1 · Our position
A validation outcome that affects whether you may publish or monetise on the platform is not taken by software alone. Automated checks inform the decision; the decision to grant, refuse or revoke authority status is taken by a person, and you may ask for it to be reviewed.
5.2 · Your rights over automated decisions
Where a decision about you is taken solely by automated means and produces legal effects or similarly significantly affects you, you have the right to obtain human intervention, to express your point of view, and to contest the decision. Under Art. 20 LGPD you have the right to review of decisions taken solely on the basis of automated processing.
We do not use your personal data for automated profiling for marketing purposes.
6 · Who we share it with
We do not sell personal data. We share it only with service providers who process it on our instructions under a written contract, and with recipients you would expect.
| Recipient | What they receive | Role |
|---|---|---|
| Supabase — database, authentication and file storage | Substantially all platform data, including account credentials in hashed form and uploaded documents | Processor |
| Stripe — payments and educator payouts | Payment and payout data, and identity data educators provide for payout verification | Independent controller for payment processing and verification; processor for what it holds on our behalf |
| Lovable — development platform and, since 6 September 2026, the delivery route for platform email | Access to the production environment, and therefore to production data, in the course of building and maintaining the platform; and the recipient address and content of each message the platform sends | Processor |
| Namecheap (Private Email) — our mailboxes at the moroak.com domain | Mail sent to and from our own addresses | Processor |
| Calendly | Only what an educator chooses to connect | Independent controller of its own service |
| Professional advisers, auditors and authorities | Only where we are required to disclose, or need advice | Recipients |
Where these recipients are established: Supabase, Stripe, Namecheap and Calendly in the United States, Stripe additionally in Ireland, and Lovable in Sweden. For a recipient outside the United Kingdom and the European Economic Area we use the UK International Data Transfer Addendum and the European Commission's standard contractual clauses, and you can ask for a copy at info@moroak.com.
7 · International transfers
MoroAK-UK is established in England and serves users in the United Kingdom, the European Union, Brazil, the Americas and elsewhere. MoroAK-BR is established in Brazil and processes personal data only in connection with payments to educators resident there.
7.1 · If you are in the United Kingdom or the European Economic Area
Your personal data is collected by MoroAK-UK, a controller established in the United Kingdom. Where you are in the European Economic Area and give us your data directly, that is not a restricted transfer under Chapter V — there is no exporter in the EEA — but the EU GDPR still applies to us under its Art. 3(2), which is why we have appointed the European representative named in section 12. Where we then pass your data to a processor, we rely on the European Commission's adequacy decision for the United Kingdom where the processor is here, and on the standard contractual clauses and the UK International Data Transfer Addendum where it is anywhere else.
Where we then pass your data to a service provider located in a further country, we put standard contractual clauses in place, and rely in addition on the appropriate safeguards required by Chapter V of the GDPR or by Art. 33 LGPD as applicable.
7.2 · If you are in Brazil
Your data is processed by MoroAK-UK in the United Kingdom, and by MoroAK-BR in Brazil where you are an educator we pay there. A transfer out of Brazil therefore does happen, and we make it in reliance on Art. 33 LGPD, using contractual clauses that provide the guarantees the Law requires. The ANPD is competent over that processing and you may complain to it, whatever else you do.
8 · How long we keep it
We keep personal data only for as long as we need it for the purpose it was collected for, and for any period the law requires.
| Data | Retention | Then |
|---|---|---|
| Enquiries — the record | 24 months from our last contact with you about it | Deleted or anonymised |
| Enquiries — the free text you wrote | 12 months from our last contact with you about it | Deleted, leaving the rest of the enquiry record intact |
| Newsletter subscription | Until you unsubscribe | A minimal suppression record is kept so that we do not contact you again |
| Account and profile data | For as long as your account is open, then 30 days | Deleted; records that must survive are anonymised |
| An educator's content, product files, validation record and sales and analytics records | Twelve months after the Educator Agreement ends, as clause 13.8 of that Agreement requires, whatever happens to the account | Access is kept open throughout, then deleted or anonymised |
| Acceptance records for the Terms of Service, the Terms of Sale and the Educator Agreement | Six years from the end of the contract they relate to | Deleted |
| Messages you send the support assistant | Twelve months | Deleted |
| Fraud and abuse records | Six years | Deleted or anonymised |
| Advisory enquiries and mandate records | Seven years from the end of the mandate, as professional rules require | Deleted |
| Purchase and payout records | 6 years from the end of the relevant financial period | Deleted |
| Credential documents uploaded by educators | The earlier of the end of the educator relationship, or 12 months after validation concludes | Deleted |
| Learning activity — submissions, quiz results, streaks, badges | For as long as your account is open | Deleted with the account |
| Email delivery log | 12 months | Deleted |
| Administrative and audit records | 24 months | Deleted |
| Authentication records — sign-in, sign-out, failed attempts, password changes | 12 months | Pseudonymised, not deleted — see below |
What happens to an authentication record at twelve months
An authentication record is not simply deleted. It is pseudonymised: your email address and IP address are replaced with irreversible cryptographic digests computed under a secret key held separately from the log, and your account identifier is replaced.
Two things follow from that, and you should know both. Pseudonymised data is still personal data under Recital 26 of the GDPR — we do not claim it is anonymous. And where records are subject to a legal hold, for example because they are evidence in an investigation, the scheduled deletion is suspended until that hold is lifted.
9 · Your rights
Whichever law applies to you, you can exercise these rights by writing to info@moroak.com, which is the address in section 1 and reaches both controllers. We will respond within one month under UK and EU GDPR. Under the LGPD we answer a request for confirmation or access immediately in simplified form, as Art. 19, I requires, and in full within fifteen days. We do not charge for this.
| Right | What it means |
|---|---|
| Access | A copy of the personal data we hold about you, and information about how we use it |
| Rectification | Correction of data that is inaccurate, and completion of data that is incomplete |
| Erasure | Deletion of your data where we no longer have a reason to hold it |
| Restriction | A pause on our use of your data while a dispute about it is resolved |
| Portability | The data you gave us, in a structured, commonly used, machine-readable form, and transmitted to another provider where technically feasible |
| Objection | An objection to processing we carry out on the basis of legitimate interests, and an absolute right to object to direct marketing |
| Withdrawing consent | Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out |
| Automated decisions | Human intervention in, and review of, decisions taken solely by automated means — see section 5 |
| Anonymisation, blocking or deletion (LGPD) | Anonymisation, blocking or deletion of data that is unnecessary, excessive, or processed other than in accordance with the Law |
| Information about consent (LGPD) | Information about the option not to give consent and about what follows if you do not — art. 18, VIII |
| Information about sharing (LGPD) | Information about the public and private bodies with which we have shared your data |
10 · Security
We protect personal data with access controls enforced at the database level, so that each user can reach only their own records; encryption of data in transit; storage of passwords only as cryptographic hashes; and private storage for uploaded documents.
Paid content is never served without an entitlement check. A tool you have not bought is not retrievable, signed in or signed out.
Administrators can, for support purposes, access the platform as another user. Every such access is recorded, with the identity of the administrator, the account accessed, and the time.
No system is completely secure. Where a breach of personal data is likely to result in a risk to your rights and freedoms, we notify the supervisory authority within 72 hours; where it is likely to result in a high risk, we also tell you, without undue delay. In Brazil we notify the ANPD, and you where the incident may bring relevant risk or harm, within three business days of learning of it — article 48 LGPD and Resolução CD/ANPD nº 15/2024.
11 · Cookies and local storage
The platform sets two cookies, and neither is for advertising or analytics. One carries a session identifier. The other is set by our hosting provider and routes your request to the right version of the site. The platform also stores four things in your browser’s local storage: your language choice, your light or dark theme preference, a draft of an educator application if you begin one so that you do not lose what you typed, and, when you are signed in, the token that keeps you signed in.
All of these are strictly necessary for a service you asked for, which is why you are shown no consent banner — regulation 6(4) of the Privacy and Electronic Communications Regulations 2003 and Art. 5(3) of Directive 2002/58/EC exempt storage of that kind. We set nothing for advertising and nothing for analytics. If that ever changes, this notice will say so before the first such cookie is set, and you will be asked first.
12 · Representatives, and how to complain
12.1 · Our representatives
United Kingdom — none is required and none is appointed. MoroAK-UK is established in England, and Art. 27 applies only to a controller that is not established in the United Kingdom. MoroAK-BR does not offer services to, or monitor, anyone in the United Kingdom, so it needs none either. You reach us directly at the address in section 1.
European Union. MoroAK-UK is not established in the European Union and offers services to people who are. Art. 3(2) of the EU GDPR therefore applies to it, and Art. 27 requires it to designate a representative in the Union. Art. 13 of Regulation (EU) 2022/2065 separately requires it to designate a legal representative for the purposes of the Digital Services Act. Both appointments are Data Privacy and Data Security Services Limited, trading as Data Privacy Services (DPS), info@dataprivacyservices.co.uk. DPS appoints the Member State. You may address DPS on any question relating to the processing of your personal data, in addition to or instead of contacting us.
Brazil. MoroAK-UK is the controller of all platform processing relating to people in Brazil and is subject to the LGPD directly, under its art. 3, I and II. MoroAK-BR is a joint controller for one thing only — paying an educator resident in Brazil — as section 1 sets out. MoroAK has not appointed a data protection officer within the meaning of Art. 37 of the United Kingdom and European Union GDPR, and on its present processing it is not required to. It is not a public authority or body; its core activities do not consist of processing which requires regular and systematic monitoring of data subjects on a large scale; and it does not process special category data, or data relating to criminal convictions and offences, on a large scale. Those are the three tests in Art. 37(1), and none of them is met. If the position changes, this notice will name a data protection officer before the change takes effect.
12.2 · Complaints
If you are unhappy with how we have handled your personal data, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority:
- United Kingdom — Information Commissioner's Office, ico.org.uk
- European Union — the data protection authority of the Member State where you live, work, or where the issue arose
- Brazil — Autoridade Nacional de Proteção de Dados, gov.br/anpd
13 · Changes to this notice
We will update this notice when our processing changes. The date at the top of the document tells you which version you are reading, and every previous version is available on request. Where a change materially affects you, we will tell you directly rather than relying on you to notice.
Language. This notice is published in English, Brazilian Portuguese and Spanish. The English text is the original; each of the others is a translation of one notice, not a different notice. The version published in your own language is the one addressed to you, and where a translated version does not resolve a question of interpretation the English text governs that question and nothing else. Nothing in this notice removes any mandatory right to receive information in your own language.