Privacy Policy

Morado AI, LLC ("Morado," "we," "us," or "our") provides Morado, the direct IRIS A2A transmitter for in-house tax teams. This Privacy Policy describes how Morado processes personal information that we collect through morado1099.com and its subdomains that link to this Privacy Policy (the "Site"), and through our related marketing activities, such as demo requests and email correspondence.

Notice at collection for California and other U.S. state residents: see the State privacy rights notice section below for information about your rights under applicable state privacy laws.

Summary

What this Privacy Policy covers

This Privacy Policy applies to the Site and to the ways we communicate with prospective customers: email, demo scheduling, and the migration-plan request form on the Site.

It does not apply to the Morado application at app.morado1099.com or to the information our customers upload to it to prepare and file information returns. That information, which can include the names, taxpayer identification numbers, and payment amounts of our customers' payees, is processed on the customer's behalf under the customer's agreement with Morado. If you are a payee or recipient whose information was filed through Morado, the organization that filed it is responsible for that data. Please direct requests to that organization, and we will assist it as its service provider.

Personal information we collect

Information you provide to us

• Contact data, such as your name, work email address, company name, professional title, and phone number, when you email us, book a demo, or ask for a migration plan.
• Communications data, including the content of the emails and messages you send us, our replies, and the notes we take on demo calls.
• Marketing preferences, such as whether you have asked us not to contact you.

Information we collect automatically

When you visit the Site, we and our analytics provider automatically log information about your device and your interaction with the Site:

• Device data, such as your IP address, browser type and version, operating system, device type, screen size, language settings, and general location (city, state, and country inferred from your IP address).
• Online activity data, such as the pages you view, the site you came from, the links and buttons you click, how far you scroll, how long you spend on a page, your navigation path through the Site, page performance timings, and browser console output on our pages.
• Session replay data. We use PostHog session replay to record how visitors interact with the Site: mouse movement, clicks, scrolling, and the page content as it rendered on your screen. Text you type into form fields is masked in your browser before it is sent to PostHog, so recordings do not contain what you typed. Recordings are kept for 30 days.

Information from other sources

• Public sources. We may combine device data with publicly available internet registry information to infer the organization associated with a visit, for example that a visit came from a university's or a credit union's network. This tells us about the organization, not about you as an individual.
• Business transaction partners. We may receive personal information in connection with an actual or prospective business transaction, such as a financing, merger, or acquisition.

Cookies and similar technologies

The Site uses first-party cookies and browser storage set by our analytics provider, PostHog, to recognize your browser across visits, tie page views into a session, and support session replay. We do not use third-party advertising cookies, tracking pixels, or social media plug-ins on the Site.

PostHog sets a first-party cookie (its name begins with ph_) that lasts up to one year and holds a visitor identifier, a session identifier, and your opt-out state, and it uses browser storage to buffer analytics and session replay data before sending it.

You can block or delete cookies and browser storage through your browser settings or a content-blocking extension. Doing so does not affect your ability to read the Site. We do not currently respond to "Do Not Track" browser signals. Because we do not sell or share personal information, there is nothing for an opt-out preference signal such as Global Privacy Control to opt you out of. If our practices change, we will honor such signals as applicable law requires.

How we use personal information

We use personal information for the following purposes:

• Service delivery and operations. To provide and maintain the Site, respond to your questions, schedule and conduct demos, send you the migration plan or other information you asked for, and communicate with you about Morado.
• Service improvement and analytics. To understand which pages are visited, how visitors move through the Site, where they arrive from, and where pages are confusing or slow, and to use that understanding to improve the Site and our content. Session replay is used for this purpose.
• Direct marketing. To follow up with you about Morado after you have contacted us, booked a demo, or asked for a migration plan. We do not enroll Site visitors in automated email sequences. You can opt out of marketing email at any time as described in Your choices below.
• Security and fraud prevention. To keep the Site secure, detect and block automated submissions (for example, through a hidden form field that only bots fill in), and investigate abuse.
• Compliance and protection. To comply with applicable law and lawful requests, protect our rights and the rights and safety of others, audit our own compliance, and enforce the terms that govern the Site.
• Business transactions. To evaluate and carry out an actual or prospective financing, merger, acquisition, or sale of assets.
• Aggregated and de-identified data. To create aggregated or de-identified data, such as traffic statistics, that no longer identifies you. We do not attempt to re-identify de-identified data, and we do not use personal information collected through the Site to train machine learning models.

How we share personal information

We do not sell personal information, and we do not share it for targeted advertising. We share personal information only with the parties below, or as otherwise described at the time of collection.

Service providers that process personal information on our behalf and under contract, such as website hosting, analytics and session replay, demo scheduling, and business email and calendar providers. Our current providers include Vercel (hosting, which sees device data including IP addresses in server logs) and PostHog (analytics and session replay, hosted in the United States, which also receives the email address you submit in the migration-plan form).

Professional advisors, such as lawyers, accountants, auditors, and insurers, in the course of the services they provide to us.

Authorities and others, including law enforcement, government authorities, and private parties, when we believe in good faith that disclosure is necessary for the compliance and protection purposes described above.

Business transferees, meaning prospective or actual counterparties and their advisors in a financing, merger, acquisition, sale of assets, or similar transaction, or in a bankruptcy or receivership in which personal information is transferred as a business asset.

Your choices

• Opt out of marketing email. Reply to any email from us and ask us to stop, or email privacy@morado1099.com. We may still send you non-marketing messages, such as a reply to a question you asked.
• Cookies and analytics. Use your browser settings to block or delete cookies and browser storage, or use a content-blocking extension. See Cookies and similar technologies above.
• Access, correction, and deletion. You can ask us to access, correct, or delete the personal information we hold about you by emailing privacy@morado1099.com. We handle these requests as described in the State privacy rights notice below.
• Declining to provide information. You can read the Site without giving us any personal information. If you do not provide the information a form requires, we cannot respond to that request.

Retention

• Session replay recordings: 30 days.
• Analytics events, and the device and activity data attached to them: 12 months.
• Contact data and communications: for as long as we have an ongoing business relationship or a legitimate need, such as answering a follow-up question, meeting a legal obligation, or resolving a dispute.

When we no longer need personal information, we delete it, de-identify it, or isolate it from further processing.

Security

We use technical, organizational, and physical safeguards designed to protect the personal information we collect through the Site, including encryption in transit (HTTPS) and access controls on the systems that hold contact data and analytics. Security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.

International data transfer

We are headquartered in the United States and use service providers that operate in the United States. If you visit the Site from outside the United States, your personal information will be transferred to and processed in the United States, where privacy laws may not be as protective as those in your country.

Children

The Site is intended for businesses and professionals and is not intended for anyone under 18 years of age. If you believe we have collected personal information from a child in a manner prohibited by law, contact us and we will delete it as the law requires.

Other sites and services

The Site links to websites and services operated by others, including the Morado application at app.morado1099.com and IRS.gov. Demo bookings run on Calendly, which collects your name, email address, and the time you choose under its own privacy policy and provides them to us. Those links are not endorsements. We do not control third-party sites and are not responsible for their practices. Read their privacy policies before providing information to them.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If we make material changes, we will post a notice on the Site or notify you by email where we have your address. Your use of the Site after the effective date of an updated Privacy Policy means the updated policy applies to your interactions with us.

How to contact us

Email privacy@morado1099.com. We answer privacy questions and requests by email.

State privacy rights notice

This section applies to residents of U.S. states whose privacy laws apply to us and grant the rights described below (the "State Privacy Laws"). Not every right is available in every state, and some State Privacy Laws may not apply to a business of our size or type. Where a request is not covered by a law that applies to us, we will still consider it in good faith.

In this section, "Personal Information" has the meaning given to "personal data," "personal information," or similar terms in the State Privacy Laws, and "Sensitive Personal Information" has the meaning given to "sensitive personal information," "sensitive data," or similar terms, in each case excluding information exempted from those laws.

Your privacy rights

Depending on your state, you may have the right to:

• Information. Learn the categories of Personal Information we collect, the sources, the purposes, the categories of third parties we disclose it to, and whether we sell or share it.
• Access. Receive a copy of the Personal Information we have collected about you.
• Correction. Ask us to correct inaccurate Personal Information.
• Deletion. Ask us to delete the Personal Information we have collected from you.
• Appeal. Appeal our denial of a request.
• Nondiscrimination. Exercise these rights without discrimination.

Opt-out rights

• Targeted advertising. We do not process Personal Information for targeted advertising.
• Sale of Personal Information. We do not sell Personal Information within the meaning of the State Privacy Laws.
• Profiling and automated decision-making. We do not use Personal Information to make automated decisions that produce legal or similarly significant effects.
• Sensitive Personal Information. We do not intentionally collect Sensitive Personal Information through the Site.
• Consumers under 16. We do not have actual knowledge that we collect, sell, or share the Personal Information of consumers under 16 years of age.

Because we do not sell or share Personal Information, there is no sale or sharing to opt out of. If that changes, we will update this notice, provide an opt-out method, and honor Global Privacy Control signals as applicable law requires.

How to exercise your rights

Email privacy@morado1099.com with the subject line "Privacy request." Tell us which right you want to exercise and the email address you used with us.

Verification. We verify requests by matching the email address the request comes from against the email address in our records. We may ask you to confirm the request from that address or to provide additional information reasonably needed to verify your identity or residency, and we may decline requests we cannot verify.

Authorized agents. Where the State Privacy Laws allow, you may use an authorized agent to make a request on your behalf. We may require proof that you gave the agent signed permission, verify your identity directly with you, or ask for a copy of a valid power of attorney.

Timing. We respond to verifiable requests within the time required by the applicable law, generally within 45 days, and will tell you if we need more time.

Information practices

Sources and purposes. We collect the categories of Personal Information described in Personal information we collect, from the sources described there, and use them for the purposes described in How we use personal information.

Retention. See Retention above.

De-identification. We do not attempt to re-identify de-identified information, except to test whether our de-identification processes comply with applicable law.

Personal Information we collect, use, and disclose. The table below maps the information described in this Privacy Policy to the categories of personal information listed in the California Consumer Privacy Act (Cal. Civ. Code Section 1798.140). It describes our practices currently and during the 12 months before the effective date of this Privacy Policy. Information you volunteer in free-form fields or emails may include other categories.

Additional information for California residents

Shine the Light. California Civil Code Section 1798.83 lets California residents who have a business relationship with us primarily for personal, family, or household purposes ask for the names of third parties to which we disclosed certain personal information for their own direct marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. To make a request, email privacy@morado1099.com with "Shine the Light Request" in the subject line and include your name, mailing address, and a statement that you are a California resident.

Additional information for Nevada residents

Nevada residents have the right to opt out of the sale of certain personal information for monetary consideration. We do not sell personal information. If you are a Nevada resident and want to record an opt-out for any future sale, email privacy@morado1099.com.