Privacy Policy

1. Introduction

Moral Fabric B.V. i.o. (in oprichting) ("we", "us", "our") operates the Moral Fabric platform at app.moralfabric.org. Moral Fabric is currently operating under Stichting School for Moral Ambition (KvK: 92257461), Strawinskylaan 339, 1077 XX Amsterdam, the Netherlands. This Privacy Policy explains how we collect, use, and protect your personal information when you use our Service.

Moral Fabric is transitioning to a steward-ownership model, in which Stichting Moral Fabric will hold a majority of shares in the B.V., ensuring the company remains mission-driven and not extractive. We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch privacy laws.

2. Information We Collect

Information you provide

• Account information: name, email address, and password when you create an account
• Profile information: profile photo and display name
• Workspace data: team structures, roles, and organizational information you enter into the Service

Information from third-party services

When you connect third-party accounts, we may receive:

• Google: Name, email address, and profile photo (via Google OAuth). If you connect Google Drive, we access files you explicitly select or authorize.
• Asana: Project names, task information, and team member details from your connected Asana workspace.
• Slack: Workspace information and channel data you authorize access to.

Information collected automatically

• Usage data: pages visited, features used, and interactions with the Service
• Device information: browser type, operating system, and device identifiers
• Log data: IP address, access times, and error logs for security and troubleshooting

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Sync data from connected third-party services at your request
• Send transactional emails (e.g., account verification, password resets)
• Monitor and improve the security and performance of the Service
• Respond to your requests and provide support

We do not use your data for advertising, sell your data to third parties, or share your data with third parties except as described in this policy.

4. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Contract performance: Processing necessary to provide the Service you requested
• Legitimate interest: Improving and securing the Service, preventing fraud
• Consent: When you explicitly authorize third-party integrations or optional features

5. Data Sharing

We may share your information with:

• Service providers: Hosting (Hetzner), email delivery (MailerSend), error tracking (Sentry), and other providers that help us operate the Service. These providers process data on our behalf and are contractually bound to protect it.
• Third-party integrations: Only when you explicitly connect and authorize a third-party service (Google, Asana, Slack).
• Legal requirements: When required by law, court order, or to protect our rights and safety.

We do not sell, rent, or trade your personal information.

6. Data Storage and Security

Your data is stored on servers located in the European Union. We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, unless we are required by law to retain it longer.

8. Your Rights

Under the GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Request your data in a machine-readable format
• Restriction: Request that we limit the processing of your data
• Objection: Object to the processing of your data based on legitimate interest
• Withdraw consent: Revoke previously given consent at any time

To exercise any of these rights, contact us at privacy@moralfabric.org.

9. Cookies

We use essential cookies to keep you signed in and maintain your session. We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under GDPR.

10. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: