Privacy Policy

Moreta Studio(“we,” “us,” or “our”) respects your privacy. This policy applies to our website and client portal (the “Services”).

1. Information we collect

• Contact form. If you use our contact form we collect your business name, your name, your email address, and — if you choose to give them — a phone number and your current website address, along with the message you send. We use these only to reply to you and to prepare a demo; the enquiry is stored as a sales lead in our own system.
• Quote acceptance record. When you accept a quote we record the date and time, the identity of the account that accepted it, a fingerprint of the exact line items accepted, and the version of our Terms of Service then in force. This is how both of us can later establish what was agreed.
• Account information. When you create an account we collect your email address and name, managed through our authentication provider, along with any optional profile details you choose to add — a phone number, a profile photo, and short descriptions of yourself and your business. Profile photos are stored privately and shown only within your own account. If you enable two-factor authentication (optional for client accounts), our authentication provider also holds your two-factor enrollment (the shared secret for your authenticator app); we never see your one-time codes.
• Project information. Content you add in the portal — project details, comments, and files you upload — and the records of your quotes, invoices, and subscriptions.
• Website traffic figures. For clients on a care plan that includes reporting, we record aggregate figures about their own site — how many visits it received in a month, and which page addresses were opened most — so we can include them in the monthly report. These are counts and page addresses only. We do not collect information that identifies individual visitors to a client’s site.
• Site operating records. For clients whose site we look after, we keep the technical details needed to run it — the live address, the domain name, who it is registered with, where its DNS is hosted, and when it needs renewing.
• Business contact details. We keep records of local businesses we may be able to help. Those records come from public sources — OpenStreetMap, Google’s business listings, a business's own website, and, where we use them, business-licence and inspection datasets published by New York City and New York State — and from what we note when we visit or speak with a business. Where we record an email address we also record where it came from and when. Email we send from this site's systems to these business records goes only to a business we have spoken with or that has written to us, and at most once: we send one invitation to create an account, and we only send another if you ask us to. Every such email says that it is a commercial message, carries our postal address, and explains how to stop hearing from us. A business can ask us at any time not to be contacted. We do not delete the record — we mark it, and where we have an email address we also record the request against the address itself, so it survives the business appearing again in a public dataset. We may also send a business in those records a short introduction from a separate outreach address — at most twice per address, always saying it is a commercial message, carrying our postal address and a link to stop. If you no longer want to hear from us, follow the stop instructions in any email we send or write to hello@moretastudio.com; either route is kept as a suppression record against the address, so the request is never undone by a later import.
• Payment information. When you pay, our payment processor (Stripe) collects and processes your payment details. We do not receive or store your full payment-card number. We retain limited billing records (such as amounts, status, and a payment-processor reference) needed to run and account for your engagement.
• Usage and analytics. With your consent, we use Google Analytics to understand how visitors use our site. We also use first-party, cookieless performance measurement (Vercel Analytics and Speed Insights). See our Cookie Policy for details.
• Communications. Emails we send you (for example, notifications and transactional messages) are delivered through our email provider. We also show in-product notifications inside the client portal — for example, when an invoice is sent, a proposal is ready, or a deliverable is waiting for your review.

2. How we use your information

We use personal information to:

• provide, operate, and secure the portal and your projects;
• prepare quotes, issue invoices, and process payments;
• send transactional and service-related messages;
• with your consent, measure and improve how our website is used; and
• comply with legal, tax, and accounting obligations.

We rely on your consent for analytics cookies, on the necessity of performing our contract with you for account and billing data, and on our legitimate interests and legal obligations for operating and securing the Services and keeping required records.

3. How we share your information

Cloudflare Turnstile. Our contact form uses Cloudflare Turnstile to check that a submission comes from a person rather than an automated script. Cloudflare receives your IP address and browser signals in order to perform that check. It runs only on the contact page.

We do not sell your personal information. We share it only with service providers who process it on our behalf, under contract, to run the Services:

• Supabase — database, authentication, and file storage for your account and project data.
• Vercel — hosting of the application.
• Stripe — payment processing and invoicing.
• Google Analytics — website usage analytics, loaded only after you consent.
• Resend — delivery of transactional email.
• Calendly — scheduling of introductory calls, loaded only if you open the booking calendar on our contact page. What you enter when booking goes to Calendly directly.

We may also disclose information where required by law or to protect our rights, safety, or property, and in connection with a business transfer.

4. How we protect your information

Client data is isolated per account through database row-level security, so one client cannot access another’s data. Our administrative accounts are protected by mandatory two-factor authentication; for client accounts two-factor authentication is optional but encouraged, and for as long as it is on, signing in requires your one-time code. You can turn it off in Settings; if we remove it at your request after verifying your identity, we email you, record the action, and sign you out of the portal on every device. We may also end your signed-in portal sessions at your request (for example, after a lost device); we record that action. Setting up or replacing an authenticator also signs out your other devices that have not verified a code. Signed-in sessions in the portal end after 8 hours of inactivity and always within 24 hours of signing in (12 hours for studio accounts); these limits are applied the next time the session is used and govern access through the portal itself. We encrypt data in transit, keep file storage private with short-lived signed links for downloads, and limit access on a least-privilege basis. No method of transmission or storage is perfectly secure, but we work to protect your information.

5. Retention and deletion

The quote acceptance record described in section 1 is stored with the quote itself, so deleting your account deletes it along with the quote. The receipt we email to you when you accept, and our own copy of that receipt, remain with each party independently.

We keep personal information for as long as your account is active and as needed to provide the Services. You can delete your account yourself at any time from the portal’s Settings page, or by contacting us. When your account is deleted, we revoke portal access and remove personal data — your profile details and photo, quote requests, projects, comments, uploaded files, in-product notifications, deliverable review records, monthly care reports, and recorded work entries — but we retain financial records — such as invoices and subscription history — because we are required to keep them for tax and accounting purposes. Retained financial records are kept for the period required by law, and any active subscriptions are cancelled immediately as part of deletion.

Deleting your account from the portal requires signing in — including your two-factor code if you have enabled two-factor authentication. If you have lost access to your authenticator app, email us at hello@moretastudio.com: after we verify that you control the account’s email address, we will remove your two-factor enrollment using our admin tools, which record the action and email you, so you can sign in and complete the deletion, or process the deletion for you.

6. Your rights and choices

Depending on where you live, you may have rights to access, correct, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can manage analytics cookies at any time using the Cookie preferences control in the footer. To exercise any other right, email us at hello@moretastudio.com; we will respond within the time required by applicable law. We do not discriminate against you for exercising your rights.

7. Data location

Our providers store and process data in the United States. If you access the Services from outside the United States, you understand your information may be processed there.

8. Children

The Services are intended for businesses and are not directed to children under 18. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “Last updated” date above and, where appropriate, communicated to you.

10. Contact

Questions or requests about your privacy? Email us at hello@moretastudio.com.