Privacy

1. What we store

• Account — the email address used to sign in, and the organization it belongs to.
• Systems — public water system identifiers, state, source type, form assignment, and the operator of record’s name and certification number where you enter them.
• Readings — the values you enter or import, each with who recorded it, when, and how it arrived.
• Filings — every generated form version and the readings behind it, kept as an immutable snapshot.
• Uploads — spreadsheets, CSVs and log-sheet photographs you submit for import, kept so an import can be re-checked against its source.
• Billing — the subscription record. Card details are held by Stripe and never reach our servers.

2. How it is separated

Access is scoped to your organization in the database itself, not in application code, so a query that tried to read another organization’s rows returns nothing. Generated files are served through signed links that expire rather than from public URLs.

3. What is never logged

Reading values are not written to server logs, error reports or diagnostics, and neither are sign-in links or session tokens. That stripping happens in shared code at the boundary where anything is logged, rather than being left to each call site to remember.

4. Who else processes it

• Hosting and database — our infrastructure providers store the application data and uploads on our behalf.
• Payments — Stripe, for subscriptions.
• Email — our transactional email provider, for sign-in links and deadline reminders. Reminder emails carry a date, a form and a link to the app; they do not carry reading values.
• Extraction — when, and only when, you upload a log-sheet photograph or upload a system document as a PDF (a consumer confidence report, permit letter or operator certificate), that file is sent to Anthropic, our model provider, to be read. Nothing else is. No model is involved in the calculations, and the values read are yours to accept, correct or discard before they reach anything.

5. Getting it back, and getting it deleted

Export is available at any time, subscribed or not, and a lapsed subscription keeps read and export access to the filing archive. Ask us to delete an account and we will delete the account, its systems, its readings and its uploads. Say so in the request if you want a copy first — deletion is not reversible.

6. Cookies

One session cookie, set when you sign in, so the app knows who you are on the next request. There is no advertising or cross-site tracking on this site.

7. If there is a breach

If a breach affects your private information and you live in New York, we will notify you as New York General Business Law § 899-aa (the SHIELD Act) requires — in the most expedient time possible and without unreasonable delay, and no later than 30 days after the breach is discovered, unless a law-enforcement agency determines that notice would impede a criminal investigation. Wherever you live, we will also notify you as other state and federal breach-notification law requires.

8. Who to ask

MORhq is operated by Lyra Ventures LLC, a New York limited liability company and the controller of the data described above. Write to support@morhq.com.