Privacy Policy
What Morsa collects, how we use it, and how we handle data from the Gmail, Outlook and WhatsApp accounts you connect.
Last updated September 25, 2026
Morsa is a product of Lunar, Inc., a Delaware corporation (“Lunar”, “we”, “us”). This policy explains what information we collect when your organization uses Morsa (the “Service”), how we use it, who helps us process it, and the choices you have. Morsa is a business service: it is used by companies and the people who work with them. Our Terms of Service cover the agreement itself.
1. Information we collect
Account and organization data. Names, work email addresses, phone numbers, roles, and the organization you belong to.
WhatsApp messages. Morsa works inside WhatsApp. We process the messages in the WhatsApp chats and groups where your organization has added Morsa, including text, voice notes, images, and documents, together with the sender’s name and phone number, so that Morsa can understand requests and reply.
Connected mail accounts. If you connect a Gmail or Outlook mailbox, Morsa accesses it as described in sections 4 and 5.
Business system data. If your organization connects an ERP or another business system, Morsa accesses the records it needs to provide the features your organization uses.
Usage data. How the website and dashboard are used, plus device, log, and diagnostic information.
Support communications. Messages you send us and their contents.
2. How we use information
To provide the Service. To understand requests, keep track of work, answer questions, send messages, and act for you when you ask it to.
To keep the Service secure and working. To operate, secure, and troubleshoot the Service, prevent abuse, and meet our legal obligations.
To improve the Service for your organization.
We do not sell your information, and we do not use it for advertising.
3. AI processing
Morsa uses AI models to read messages and write its replies. To do this, the Service sends the content Morsa is working on to our AI model provider, which processes it only to provide the Service to you. We do not use your content, including data from Gmail or Outlook, to train generalized AI models.
4. Google user data (Gmail)
If you connect your Gmail account, Morsa can tell you in WhatsApp which new mail needs your attention and, when you ask, act on your mail for you. This section explains what Morsa does with data it receives from Google.
What we access. When you connect Gmail, you grant Morsa the Google permission https://www.googleapis.com/auth/gmail.modify, plus your Google account’s email address (openid, email). With these, Morsa can read your mail and its attachments, see your labels and send-as addresses, create drafts, send mail as you, and change labels on your mail (for example: archive, mark as read, star, label, or move to trash). Morsa never permanently deletes mail.
How we use it. Morsa reads new mail as it arrives so it can tell you in WhatsApp what matters. Morsa drafts or sends a reply, forwards a message, or archives, labels, stars, or trashes mail only when you ask it to in your WhatsApp chat with Morsa. We use Google user data only to provide and improve these user-facing features.
What we store. We do not store the contents of your mail. Each time Morsa needs a message, it reads it live from Gmail. We store only what we need to keep the connection working: your Gmail address, an encrypted access token, Gmail’s identifiers for new messages (with no subject, sender, or body), a sync position, and a log of connection events (for example, connected or disconnected). If Morsa needs an attachment to answer you, a temporary copy is kept only while that request is handled and is then deleted. The WhatsApp messages Morsa sends you, which may summarize or quote an email, are part of your chat history with Morsa and are kept as described in section 8.
Who we share it with. We do not sell Google user data, use it for advertising, or use it to decide credit or lending. To produce its answers, Morsa sends the mail it is working on to our AI model provider, which processes it only to provide the feature to you. Our hosting providers store the data listed above on our behalf. We do not transfer Google user data to anyone else, except where the law requires it, to protect the security of the Service, or as part of a merger or acquisition, and in that case only after telling you.
Human access. No one at Morsa reads your mail unless you ask us to (for example, in a support request), or it is needed for security or to comply with the law.
AI and machine learning. Gmail data is not used to train AI models. We do not use data received from Google Workspace APIs, including Gmail, to develop, improve, or train generalized or non-personalized AI or machine-learning models.
Security. Google user data is encrypted in transit and at rest, access tokens are encrypted, and each organization’s data is kept separate from every other organization’s.
Limited Use. Morsa’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
5. Microsoft user data (Outlook)
If you connect a Microsoft Outlook mailbox, Morsa works with it in the same way as with Gmail.
What we access. You grant Morsa Microsoft Graph permissions to read, change, and send mail (Mail.Read, Mail.ReadWrite, Mail.Send), to read your basic profile, contacts, and the people you work with (User.Read, Contacts.Read, People.Read), to read and update your calendar (Calendars.Read, Calendars.ReadWrite), and to stay connected (offline_access). Morsa does not currently use the calendar permissions.
How we use it and what we store. Morsa reads new mail as it arrives and acts on mail only when you ask it to. We do not store the contents of your mail. We store your mailbox address, an encrypted access token, Microsoft’s identifiers for new messages (with no subject, sender, or body), the details of our mail notification subscription, and a log of connection events. Attachment copies are temporary, as for Gmail.
Sharing, human access, and AI. The same rules apply as for Gmail in section 4: no sale, no advertising, no human reading without your request or a security or legal need, and no use of your mail to train generalized AI models.
6. Disconnecting a mail account
You can disconnect a mailbox at any time by asking Morsa in WhatsApp. When you disconnect, we delete our stored access. You can also remove Morsa’s access at any time at https://myaccount.google.com/permissions (or, for Microsoft accounts, https://account.live.com/consent/Manage).
After you disconnect, Morsa stops reading that mailbox. Message identifiers and the connection-event log, which contain no mail content, may remain in our records until your organization’s data is deleted. You can ask us to delete them at any time.
7. Who we share information with
People in your organization. Morsa shares information with the members of your organization who use it, for example in the WhatsApp groups where it has been added.
Service providers. Companies that host the Service, run our AI models, and deliver messages, who process information only on our behalf.
WhatsApp. Messages to and from Morsa travel through WhatsApp and are also subject to WhatsApp’s own terms and privacy policy.
Legal and business transfers. Where the law requires it, to protect the rights and safety of our users or the Service, or as part of a merger, acquisition, or sale of assets.
8. How long we keep information
We keep information for as long as your organization uses the Service and as long as we need it to provide the Service. When your organization’s account ends, we delete its data within a reasonable period, except for backups we clear on our normal schedule and anything we must keep by law. Mail content is never kept, as described in sections 4 and 5.
9. Security
We protect information with encryption in transit and at rest, encrypted credentials for connected accounts, separation between organizations, and access controls.
10. Your rights and choices
You can ask us to access, correct, or delete the personal information we hold about you. If your employer provides Morsa to you, we may pass your request to them. If you live in California, you have rights under the California Consumer Privacy Act, including the rights to know, delete, correct, and opt out. We do not sell personal information or share it for cross-context behavioral advertising, and we will not treat you differently for using these rights. We may need to verify your identity before we act on a request.
11. International processing
Our service providers may process information in the United States and in other countries where they operate.
12. Children
The Service is for businesses and is not directed to children under 16.
13. Changes to this policy
We may update this policy as the Service changes or as the law requires. When we make a material change, we will post the updated policy here with a new date.
14. Contact
Questions about this policy, or requests about your information, can go to founders@morsa.ai.
