Privacy Statement

1. Who we are

MORAII B.V. ("MORAII", "we") helps organisations put AI to work. MORAII B.V., Jurriaan Kokstraat 22, 2586 SJ The Hague, the Netherlands, Chamber of Commerce (KvK) number 42160898, is the controller for the processing of personal data described in this statement. Questions about privacy: privacy@moraii.com.

2. In short

• We only collect what we need to answer you, run the AI Opportunity Scan and work with clients.
• We only use analytics cookies on moraii.com if you agree. We do not use advertising cookies.
• We store scan and client data and run AI on it in the EU. A MORAII consultant reviews every scan result before you receive it.
• We do not sell personal data.

3. What we process and why

Visiting moraii.com. Our web server, hosted by dogado in Germany, records technical data such as your IP address, browser type, the page requested and the time. We use this to keep the website secure and working. Legal basis: legitimate interest. Retention: 30 days.

Contacting us. If you email us or use our contact form, we use your name, email address, company and message to reply to you. Legal basis: legitimate interest, or taking steps at your request before entering into an agreement. Retention: as long as needed to handle your message, and no longer than 12 months if no engagement follows.

Booking a call. If you book a call, we use Microsoft Bookings. We receive your name, email address, phone number if you provide it, the time you choose and any notes you add, so we can schedule and hold the call. Legal basis: taking steps at your request before entering into an agreement. Retention: no longer than 24 months after the call if no engagement follows.

AI Opportunity Scan. If you take the scan, we process your company details (name, website, sector, size and, if you choose to give it, a revenue band), your role, your answers about goals, processes, current AI use and systems, including any text you type yourself, and at the end your name, email address and, optionally, your phone number. To prevent misuse we briefly keep a hashed form of your IP address, which cannot be traced back to the address itself; it is normally deleted within a day. We do not store your IP address itself. We use this to prepare your scan and report, to contact you about the outcome and a possible conversation, and to improve the scan.

As part of the scan we look up public information about your company, such as your website and recent news. We do not look up information about you as a person. We also run a short online check for approaches that are not yet in our library of AI use cases; these checks never include your company name or personal details. If your scan points to a new use case, we may add it to our library in a general form, without details that identify you or your company.

Legal basis: your consent and your request to carry out the scan. For improving the scan and preventing misuse: our legitimate interest. Retention: a scan you do not finish is deleted after 30 days. If no engagement follows, we remove your name, email address and phone number from a completed scan no later than 24 months after you completed it. If your scan is linked to an ongoing conversation with us, we remove them no later than 5 years after the scan. We keep your answers about your organisation to improve our scan and library. If an engagement follows, the retention periods of that engagement apply.

Business contacts and prospects. We keep a CRM with business contact details of potential and existing clients and partners: name, role, company, business email and phone number, the public LinkedIn profile and notes of our contacts. To prepare a conversation, we use AI to look up public information about the company and the contact person's role. Legal basis: legitimate interest (business relationship and business development). You can object to this at any time, and we will then stop. Retention: if our contact has ended, 24 months after the last contact; otherwise no longer than 5 years after the last contact, unless you become a client. After that we remove your name, role, email address, phone number and LinkedIn profile. If we did not receive your data from you, the source is public business information or an introduction.

Clients. To carry out an engagement we process the data needed for it. Arrangements about client data are set out in the engagement and, where MORAII processes data on the client's behalf, in a data processing agreement. Invoicing data is kept for 7 years because Dutch tax law requires it.

4. Cookies and browser storage

Analytics. If you agree in the cookie banner, we use Google Analytics 4, provided by Google Ireland Limited, to see how visitors use moraii.com: for example which pages are visited, how visitors arrive and which type of device and browser they use. We use this only to improve the website. Google Analytics places cookies (such as _ga) for this. Google Analytics 4 does not store IP addresses of visitors from the EU; it does derive an approximate location (country or city). We have turned off data sharing with Google for other purposes and Google Signals, and Google acts as our processor. Google may process this data in the United States; see section 7. Legal basis: consent. Without your consent no analytics cookies are placed. You can change your choice at any time via "Cookie settings" at the bottom of every page. Retention: up to 14 months. We do not use advertising or social media tracking cookies.

Necessary storage. The scan stores a session token in your browser's local storage, so you can continue the scan later on the same device. This is necessary for the service you asked for, so we do not ask for consent. The token expires after 30 days, and you can remove it at any time by clearing your browser data. When you book a call, the booking page is provided by Microsoft, which may use its own functional cookies there.

5. How we use AI

For the scan and for preparing conversations we use an AI model, currently a Claude model by Anthropic, run through Google Cloud (Vertex AI) in the EU. Every AI step in the scan uses this EU route, including the company lookup and the online check. The AI drafts follow-up questions, summarises public information about your company and prepares a draft analysis. A MORAII consultant reviews every scan result before you receive anything from us. We do not make decisions based solely on AI that have legal or similarly significant effects on you.

For our own marketing content and for researching AI use cases from public sources, we also use OpenAI, which processes data in the United States. We do not send personal data of website visitors, scan participants, prospects or clients to OpenAI.

6. Who we share data with

We do not sell personal data. We work with the following processors, under data processing agreements:

• Google Cloud: AI processing through Vertex AI, in the EU.
• Railway: our application database, hosted in Europe.
• Vercel: hosting of our application, in the EU (Frankfurt).
• Microsoft 365: email, documents and appointment booking (Microsoft Bookings), in the EU.
• dogado: hosting of moraii.com, in Germany.
• Google (Google Analytics 4): website analytics, only with your consent; may involve processing in the United States.

Once we start using it, Moneybird (invoicing, Netherlands) will be added. We share data with other parties only if the law requires it.

7. Transfers outside the EEA

We store scan and client data and run AI on it in the EU. For Google Analytics, Google may process data in the United States. Some of our processors (Google, Microsoft, Railway and Vercel) are, or belong to, companies based in the United States, or use sub-processors there, for example for support. Where data may be accessed from outside the European Economic Area, this is covered by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

8. Security

We take appropriate technical and organisational measures, such as encrypted connections, access limited to authorised staff with single sign-on, and keeping AI processing of scan answers and client data within the EU.

9. Your rights

You have the right to access, correct or delete your data, to restrict or object to processing, and to receive your data in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect processing that took place before. Send your request to privacy@moraii.com. We respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

10. Changes

We may update this statement. The version and date at the top show when it last changed. If a change affects how we use data you gave us, we will tell you.