Privacy Policy

Moreta Studio(“we,” “us,” or “our”) respects your privacy. This policy applies to our website and client portal (the “Services”).

1. Information we collect

• Account information. When you create an account we collect your email address and name, managed through our authentication provider, along with any optional profile details you choose to add — a phone number, a profile photo, and short descriptions of yourself and your business. Profile photos are stored privately and shown only within your own account. If you enable two-factor authentication (optional for client accounts), our authentication provider also holds your two-factor enrollment (the shared secret for your authenticator app); we never see your one-time codes.
• Project information. Content you add in the portal — project details, comments, and files you upload — and the records of your quotes, invoices, and subscriptions.
• Payment information. When you pay, our payment processor (Stripe) collects and processes your payment details. We do not receive or store your full payment-card number. We retain limited billing records (such as amounts, status, and a payment-processor reference) needed to run and account for your engagement.
• Usage and analytics. With your consent, we use Google Analytics to understand how visitors use our site. We also use first-party, cookieless performance measurement (Vercel Analytics and Speed Insights). See our Cookie Policy for details.
• Communications. Emails we send you (for example, notifications and transactional messages) are delivered through our email provider. We also show in-product notifications inside the client portal — for example, when an invoice is sent, a proposal is ready, or a deliverable is waiting for your review.

2. How we use your information

We use personal information to:

• provide, operate, and secure the portal and your projects;
• prepare quotes, issue invoices, and process payments;
• send transactional and service-related messages;
• with your consent, measure and improve how our website is used; and
• comply with legal, tax, and accounting obligations.

We rely on your consent for analytics cookies, on the necessity of performing our contract with you for account and billing data, and on our legitimate interests and legal obligations for operating and securing the Services and keeping required records.

3. How we share your information

We do not sell your personal information. We share it only with service providers who process it on our behalf, under contract, to run the Services:

• Supabase — database, authentication, and file storage for your account and project data.
• Vercel — hosting of the application.
• Stripe — payment processing and invoicing.
• Google Analytics — website usage analytics, loaded only after you consent.
• Resend — delivery of transactional email.

We may also disclose information where required by law or to protect our rights, safety, or property, and in connection with a business transfer.

4. How we protect your information

Client data is isolated per account through database row-level security, so one client cannot access another’s data. Our administrative accounts are protected by mandatory two-factor authentication; for client accounts two-factor authentication is optional but encouraged, and once you enable it, signing in always requires your one-time code. We encrypt data in transit, keep file storage private with short-lived signed links for downloads, and limit access on a least-privilege basis. No method of transmission or storage is perfectly secure, but we work to protect your information.

5. Retention and deletion

We keep personal information for as long as your account is active and as needed to provide the Services. You can delete your account yourself at any time from the portal’s Settings page, or by contacting us. When your account is deleted, we revoke portal access and remove personal data — your profile details and photo, quote requests, projects, comments, uploaded files, in-product notifications, and deliverable review records — but we retain financial records — such as invoices and subscription history — because we are required to keep them for tax and accounting purposes. Retained financial records are kept for the period required by law, and any active subscriptions are cancelled immediately as part of deletion.

Deleting your account from the portal requires signing in — including your two-factor code if you have enabled two-factor authentication. If you have lost access to your authenticator app, email us at hello@moretastudio.com: after we verify that you control the account’s email address, we will reset your two-factor enrollment so you can sign in and complete the deletion, or process the deletion for you.

6. Your rights and choices

Depending on where you live, you may have rights to access, correct, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can manage analytics cookies at any time using the Cookie preferences control in the footer. To exercise any other right, email us at hello@moretastudio.com; we will respond within the time required by applicable law. We do not discriminate against you for exercising your rights.

7. Data location

Our providers store and process data in the United States. If you access the Services from outside the United States, you understand your information may be processed there.

8. Children

The Services are intended for businesses and are not directed to children under 18. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “Last updated” date above and, where appropriate, communicated to you.

10. Contact

Questions or requests about your privacy? Email us at hello@moretastudio.com.