Privacy Policy

Who this covers

This Privacy Policy explains how MorningSheet ("MorningSheet," "we," "us," or "our"), a business based in Washington State, handles personal information about you: the people who visit our site, create an account, and use the MorningSheet app (our customers and the sales reps who use the Service).

It is separate from how we treat the business-lead data we sell, which is compiled from public records and describes businesses. We address that distinction directly under People and businesses in our lead data.

What we collect from you

We keep this deliberately small. We collect:

• Your email address. Required to create an account and to sign in, because we use passwordless "magic-link" authentication. We also use it to send you service and account messages, and (if you opt in) product updates.
• Account & subscription details. The tiers, verticals, and counties you subscribe to, your plan status, and billing records. Payment-card details are handled by Stripe, our payment processor; we don't store your full card number.
• Usage, log & device data. When you use the Service, we and our infrastructure automatically record information such as your IP address, browser and device type, pages and leads you view, leads you save or hide, actions you take, referring pages, how you found us (including your answer if we ask), and timestamps. We use this to operate, secure, and improve the Service.
• Support & communications. If you email us or send feedback, we keep that correspondence and any information you choose to include in it.

MorningSheet is for business use, so we ask only for the details you use for work. We do not ask you for sensitive personal information, and we don't knowingly collect more than we need to run the Service.

How passwordless sign-in works

MorningSheet doesn't use passwords. When you sign in, we email you a one-time, time-limited link (a "magic link"). Opening it from your inbox signs you in and creates a session.

To make that work, we store your email address and short-lived sign-in tokens, and we record when a link is issued and used so we can expire it and protect your account. There is no password for us to store or for anyone to steal. Because anyone with access to your inbox can use a magic link, keeping that inbox secure is an important part of keeping your account secure.

How we use your data

We use the information above to:

• provide, maintain, and secure the Service and sign you in;
• process your subscription, take payment, and send billing and account messages;
• respond to your support requests and feedback, which can include a team member viewing the app as you see it, read-only, to find and fix a problem;
• understand how the Service is used so we can fix problems, improve features, and tune what leads are useful;
• detect, prevent, and address fraud, abuse, security issues, and violations of our Terms of Service;
• comply with our legal obligations and enforce our agreements.

We don't sell your personal data

We do not sell your personal information, and we don't share it with third parties for their own advertising. The only parties we share your personal data with are the service providers ("sub-processors") that help us run MorningSheet, listed below, and only so they can perform their function for us. We may also disclose information if required by law or to protect our rights, our users, or the public, and we may transfer it as part of a merger, acquisition, or sale of our business (with notice as required).

Cookies & sessions

We use a small number of strictly necessary cookies (or equivalent local storage) to keep you signed in after you click a magic link and to keep the app working as you move between pages. These are essential to provide the Service you asked for.

We don't run advertising cookies and we never sell your information. To understand traffic and product usage we use a few analytics tools: Google Analytics and PostHog (which set their own analytics cookies / local storage) and Cloudflare Web Analytics and Ahrefs Web Analytics (both cookieless). Google Analytics, Cloudflare, and Ahrefs measure traffic to our website. PostHog records how you use the app, linked to your account, including session recordings so we can see where things break. Recordings hide what you type into forms, except the lead search box, and can show what was on screen, including lead details. Session recordings are deleted after 30 days, and PostHog deletes usage events after 12 months. We use PostHog only to improve MorningSheet, never for advertising. You can block or clear cookies in your browser, but if you block the essential ones you won't be able to stay signed in.

Sub-processors we share with

To run MorningSheet we rely on these service providers. They process personal data only on our instructions and for the purpose described:

• Stripe: payments. Processes your subscription payments and stores your payment-card details under Stripe's own privacy terms. We receive billing status and limited transaction details, not your full card number.
• Resend: transactional email. Delivers your magic-link sign-in emails and account and service messages. To do that, it processes your email address and the contents of those messages.
• Render: hosting & infrastructure. Hosts the application, database, and logs that run the Service. Usage and log data passes through this provider as part of normal operation.
• Google Analytics: website analytics. Measures traffic to our marketing site. It sets cookies and receives page views, IP address, and device and browser information.
• PostHog: product analytics. Records in-app usage and session recordings linked to your account email, so we can improve the Service. Typed form inputs are masked, except the lead search box. Recordings are deleted after 30 days and usage events after 12 months.
• Cloudflare: CDN & cookieless web analytics. Serves and protects the site, which means it handles your IP address, and measures traffic without setting cookies.
• Ahrefs: cookieless web analytics. Measures traffic and search performance on the marketing site without setting cookies. It receives IP address and browser information.

We choose providers that maintain appropriate security and privacy practices, and we update this list as our providers change.

Retention & deletion

We keep your personal information for as long as you have an account and as needed to provide the Service. After you ask us to close your account, we delete or de-identify your personal information from our systems within 30 days and ask our analytics provider to delete events linked to your account. Backups roll off on their normal schedule, and we keep some records where needed to meet legal, tax, accounting, or fraud-prevention obligations, or to resolve disputes. Log data is retained on a rolling basis and then deleted or aggregated.

Your rights & choices

You can ask us to access, correct, export, or delete the personal information we hold about you, and you can ask us to close your account at any time. To make a request, email privacy@themorningsheet.com from the address on your account, and we'll verify and respond within the time the law allows. You can also unsubscribe from optional marketing emails using the link in any such email; we'll still send essential service messages while you have an account. Depending on where you live, you may have additional rights (see California below) and you won't be treated differently for exercising them.

Privacy rights by state

Some state laws, such as California's, give residents rights over their personal information. We honor the access, correction, and deletion requests described above for everyone, whether or not a law requires it. We have not sold or shared the personal information of our users for cross-context behavioral advertising, and we don't use it for targeted advertising. You may use an authorized agent, and we will verify any request before acting on it.

People and businesses in our lead data

The leads we sell are a separate matter from your personal information, and we want to be clear about it. MorningSheet's lead data is compiled from public records (Washington state, county, and city building permits, business and trade licenses, liquor-license applications, health-department filings, and similar public sources) and it describes businesses.

Lead data is about businesses: a business's name, address, category, and a phone number or website it lists for itself. Some businesses are run by one person, so a business name, address, or filing email can identify that person. Some public filings also name an owner or a permit applicant. We use those names to connect records about the same business, and we do not display the owner or applicant name fields to our customers. On plans that include contact access, a lead can show an email address from a public filing, such as a permit or plan review, so a vendor can reach the business. We treat these as business contact details: we only show an email that was given on a filing for that business or published by the business itself, and our customers may use it only to contact the business about its business.

We never sell lists of people. Leads can't be downloaded or exported. We use data that agencies publish openly, we don't request lists of individuals from agencies for commercial use, and we ask agencies for permission where their terms call for it. Our data is not a consumer report: our Terms forbid customers from using it to decide anyone's eligibility for credit, insurance, employment, or housing, and require them to stop contacting anyone who asks.

Corrections and removal. If you run a business we list, or you are named in a public record we use, you can ask us to correct your information or remove it from MorningSheet. Email privacy@themorningsheet.com with the business name and address. We aim to respond within 10 business days, and we keep removed records out of future updates.

Security

We take reasonable measures to protect your information, including encryption in transit, passwordless authentication that removes the risk of stored or reused passwords, scoped access to systems, and reputable infrastructure providers. No method of transmission or storage is perfectly secure, so we can't guarantee absolute security, but we work to keep what we hold safe and to respond promptly if something goes wrong. If a breach of your personal information requires notice under RCW 19.255.010, we will notify you, and the Washington Attorney General where required, within 30 days of discovering it.

Children

MorningSheet is a business-to-business product intended for use by adults. It is not directed to children, and we don't knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we'll delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will give you at least 30 days' notice by email of any material change and update the "Last updated" date above. Changes apply only going forward.

Contact us

For any privacy question or to exercise your rights, email privacy@themorningsheet.com. For general support, write to support@themorningsheet.com. The terms that govern your use of the Service are in our Terms of Service.