MORIM Privacy Notice — draft
Release blocked: operator identity, contact details and minors/privacy safeguards are not yet verified. These pages are draft notices, not final legal terms or a compliance certification. Public learning access is held in production until operator release approval.
Draft updated 2 November 2026. No final policy effective date has been established. Material changes require a dated notice and review before release.
Operator and privacy contact
The legal operator, address, privacy contact and grievance contact have not been supplied. Public launch is blocked until genuine details and an operational request-handling process are verified. No external support address is currently advertised.
Information and purposes
MORIM processes account email and identity, supported display-name/profile fields, exam goals, subjects, study preferences and availability. It uses these to provide authentication, personalize learning and generate study-plan previews. Saved Study Space work includes notes, drawings, formulas and slides. Assessments store question snapshots, saved answers, results and graded evidence used by the existing learner-state model. Opening a lesson or completing ungraded practice is not verified mastery evidence.
Authentication and security
Supabase provides authentication and database/storage services. Session cookies support sign-in. Server authorization and row-level policies restrict account data. Security/audit events support abuse prevention and account protection. Account deletion requires recent verified authentication and explicit confirmation; failures are reported.
AI processing and choice
OpenAI is the only supported tutor transport; live approved access remains unverified. When eligible processing is enabled and you consent, submitted questions, recent session conversation, selected academic/canvas text, saved learning preferences and relevant quiz summaries may be sent for moderation and a model reply. Credentials remain server-side. Basic contact-string redaction is not anonymization. AI can be inaccurate. Do not include sensitive personal information.
Withdraw consent in Settings to block future provider requests. Withdrawal cannot recall data already sent. Session chat is not saved as an account transcript by this tutor. Provider retention and contractual/account settings require operator verification; disabling response storage alone is not Zero Data Retention.
Providers, retention and deletion
Supabase supports account/data services, Vercel hosts the application, hCaptcha supports abuse prevention where configured, and an approved OpenAI account would process enabled tutor requests. Contractual terms, processing locations and retention schedules are not verified here. No fixed retention period or training-data assurance is promised. Account deletion removes the account and linked records subject to implemented database cascades; de-linked audit data or provider backups may remain under applicable retention arrangements. Third-party data already sent is not automatically recalled.
Student and guardian requests
Signed-in users can submit access, correction, erasure and grievance requests in Settings. Submission records a request for review, not completion. Guardian eligibility and identity verification need an operator-reviewed process. No verified external contact or response-time promise is currently available.
Children and release safeguards
MORIM includes learning for minors. Age assurance and any required guardian/institutional authorization must be verified before public release; the student AI preference is not guardian consent. Processing younger children’s personal data may require additional provider controls, including approved Zero Data Retention where required. Provider suitability, reporting/escalation, child-data handling and applicable legal requirements remain launch blockers. A release flag is an operator attestation, not an age-verification mechanism.