Privacy Policy

1. Introduction

Stichting Moral Fabric ("we", "us", "our") operates the Moral Fabric platform at app.moralfabric.org, Strawinskylaan 339, 1077 XX Amsterdam, the Netherlands. This Privacy Policy explains how we collect, use, and protect your personal information when you use our services.

Moral Fabric is organised as a stichting (foundation), ensuring the organisation remains mission-driven and not extractive. We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch privacy laws.

This policy sits alongside our Terms of Service, which set out what our services are (the app, patterns, and advisory services). For the personal data described in this policy, we act as the controller. Where we process personal data on your behalf as part of our services, you are the controller and we are the processor; in that case we sign a Data Processing Agreement (DPA) with you, as data protection law requires.

2. Information We Collect

Information you provide

• Account information: name, email address, and password when you create an account
• Profile information: profile photo and display name
• Workspace data: team structures, roles, and organizational information you enter into the app
• Operations assessment: the ratings, notes, and organization details you enter in our operations assessment, including when you use it without an account. We store this so you can leave and come back to it, and we keep it for up to 12 months after your last change unless you ask us to delete it sooner. Anyone holding the resume link for an assessment can view and edit it.
• Newsletter signup: your email address, and the first and last name you give us, when you subscribe to our newsletter. See article 6 for how that works.

Information from third-party services

When you connect third-party accounts, we may receive:

• Google: Name, email address, and profile photo (via Google OAuth). If you connect Google Drive, we access files you explicitly select or authorize.
• Asana: Project names, task information, and team member details from your connected Asana workspace.
• Slack: Workspace information and channel data you authorize access to.

Information collected automatically

• Usage data: pages visited, features used, and interactions with the app
• Device information: browser type, operating system, and device identifiers
• Log data: IP address, access times, and error logs for security and troubleshooting

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our services
• Authenticate your identity and manage your account
• Sync data from connected third-party services at your request
• Send transactional emails (e.g., account verification, password resets)
• Monitor and improve the security and performance of the app
• Respond to your requests and provide support

We do not use your data for advertising, sell your data to third parties, or share your data with third parties except as described in this policy.

4. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Contract performance: Processing necessary to provide the services you requested
• Legitimate interest: Improving and securing our services, preventing fraud
• Consent: When you explicitly authorize third-party integrations or optional features, and when you confirm your subscription to our newsletter

5. Data Sharing

We may share your information with:

• Service providers: Hosting (Hetzner), email delivery (MailerSend), newsletter delivery (MailerLite), error tracking (Sentry), and other providers that help us operate our services. These providers process data on our behalf and are contractually bound to protect it.
• Third-party integrations: Only when you explicitly connect and authorize a third-party service (Google, Asana, Slack). See article 8 of our Terms of Service for how connected tools work.
• Legal requirements: When required by law, court order, or to protect our rights and safety.

We do not sell, rent, or trade your personal information.

6. Newsletter

Our newsletter runs on MailerLite (MailerLite Limited, Ireland), which acts as our processor for it. When you sign up we pass MailerLite your email address, the first and last name you gave us if you gave one, and which page you signed up from. We use that only to send you the newsletter and to see how many people opened it. We never sell or share the list, and subscribing is entirely separate from having a Moral Fabric account.

Confirming your subscription (double opt-in). Filling in the signup form does not subscribe you. MailerLite first emails you a confirmation link, and you only join the list once you click it. Until then your address sits unconfirmed and we do not send you anything. When you confirm, MailerLite records the date, time, and IP address of that click, which is how we can show you consented.

Unsubscribing. Every issue carries an unsubscribe link that takes effect immediately, and you can also email privacy@moralfabric.org to be removed. Unsubscribing has no effect on your account or on any other service we provide you.

How long we keep it. We keep your subscription for as long as you stay subscribed. When you unsubscribe, MailerLite keeps a record that you did, so we cannot add you back by mistake. Addresses that are never confirmed are never mailed.

7. Data Storage and Security

Your data is stored on servers located in the European Union. We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. For details on our security architecture, see our Security page.

Reporting a security issue. If you discover a vulnerability or believe your data has been compromised, please email security@moralfabric.org. Our responsible disclosure policy is published at moralfabric.org/security.

Breach notification. In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, as required by GDPR Article 33, and inform affected individuals without undue delay where the breach poses a high risk.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. When your agreement with us ends, we keep your content in the app accessible for 2 weeks so you can export it, then deactivate the account and delete your content, as set out in article 14 of our Terms of Service. We delete or anonymize any remaining personal data within 30 days, unless we are required by law to retain it longer.

9. Your Rights

Under the GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Request your data in a machine-readable format
• Restriction: Request that we limit the processing of your data
• Objection: Object to the processing of your data based on legitimate interest
• Withdraw consent: Revoke previously given consent at any time

To exercise any of these rights, contact us at privacy@moralfabric.org. You can also request a complete export of your workspace data at any time, free of charge, under article 9 of our Terms of Service.

10. Cookies

We use essential cookies to keep you signed in and maintain your session. We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under GDPR.

11. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: