Skip to content

Privacy Policy

Last updated: October 18, 2026

1. Who processes your data

The data controller is Gabriel Miccoli (“Morlex”, “we”). For any question or request about your data, write to supporto@morlex-ai.com.

2. What data we process

  • Account data: email address, the name you choose to show, sign-up date. Your password is held, encrypted, by our authentication provider: we never see it. If you sign in with Google we receive your name and email address from Google.
  • What you create: the requests you type or dictate, the experiences generated, the changes you ask for and their history.
  • Files and recordings: images and documents you attach to a request, and voice recordings from dictation, are sent to the AI model provider to process the request and are not stored by us.
  • Learning progress: answers, scores and progress in experiences, saved in your browser and, for your own experiences, on your account so you can pick up on another device.
  • Payment data: plan, subscription status, credit purchases. Card details are handled only by Stripe and never reach us.
  • Student verification (only if you apply): school or university, city, year, institutional address and any document you upload. The document is deleted as soon as the application is reviewed.
  • Technical data: IP address (for security and usage limits), browser type, pages visited. Visits are counted with an encrypted identifier that changes every day and cannot recognise you from one day to the next.
  • Notifications: if you turn them on, the technical address your browser provides for push notifications.
  • Waiting list: the email address you leave to hear about the launch.
  • Feedback: your answers to the short questionnaires we offer in the app, in Settings or by email (score, chosen options, comment), with the page and plan you answered from.
  • Invites: if you sign up from a friend’s link we record who invited you, and whether you make your first experience or start a plan, to give the reward credits. To stop people inviting themselves we compare the daily visit identifier of the two accounts.

3. Why, and on what basis

  • To provide the service you asked for — account, generating experiences, subscriptions and credits (performance of a contract, GDPR art. 6.1.b).
  • To protect the service from abuse and fraud and to measure its use in aggregate (legitimate interest, art. 6.1.f).
  • To meet legal obligations, such as tax and accounting rules on payments (art. 6.1.c).
  • To send push notifications or the waiting-list launch email, only if you asked for them (consent, art. 6.1.a), which you can withdraw at any time.
  • To send you, in the first ten days after you sign up, at most three emails on how to use Morlex (legitimate interest, art. 6.1.f). Each one has a one-click link to stop them.
  • To ask now and then what you think of Morlex — after your first lesson, if you stop using it, if you cancel a plan — at most one email every two weeks, and to improve the service with your answers (legitimate interest, art. 6.1.f). Answering is optional; the same link stops these emails too.

We do not sell your data, use it for advertising, or profile you.

4. Artificial intelligence

Experiences are generated by Google’s AI models (Gemini API). To generate them we send Google your request, any attachments and, when you edit an experience, its content. We use Google’s paid API, whose terms exclude using this content to train the models.

Do not put personal data — yours or anyone else’s — into requests unless it is needed to learn the topic.

5. Public experiences

On the Free plan the experiences you create are public: they can appear in Explore, and anyone with the link can open them. They are shown without your name unless you choose to show it. Paid plans can keep them private. You can delete an experience at any time.

6. Who we share data with

We rely on providers that process data on our behalf, as processors (GDPR art. 28):

  • Supabase — database, authentication and file storage.
  • Vercel — application hosting.
  • Google — AI models (Gemini API) and, if you use it, Sign in with Google.
  • Stripe — payments and invoicing.
  • Upstash — usage limits against abuse (processes IP addresses).
  • Resend — sending service emails.
  • Your browser’s push services (Google, Apple, Mozilla, Microsoft), only if you turn notifications on.

Some of these providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.

7. How long

  • Account and content: for as long as you keep the account. If you delete it, they are deleted at once; database backups are overwritten within a few days.
  • Payment data: invoices are kept by Stripe and by us for 10 years, as the law requires.
  • Student verification document: deleted as soon as the application is reviewed.
  • Waiting list: until the launch email is sent, or earlier if you ask.
  • Usage statistics: kept in a form that can no longer be linked to you after the account is deleted.

8. Your rights

You can ask for access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest. Two of these you can exercise yourself, from Settings: “Download your data” and “Delete your account”. For everything else write to supporto@morlex-ai.com; we answer within one month.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

9. Children

Morlex may be used by anyone aged 14 or over. Under 14, it may be used only with the consent of a parent or guardian. If you are a parent and believe your child gave us data without your consent, write to us and we will delete it.

10. Cookies and browser storage

Morlex uses only technical cookies, which are needed for it to work and so do not require your consent:

  • the authentication provider’s session cookies, to keep you signed in;
  • “morlex_locale”, to remember the language you chose;
  • “morlex_ref”, to remember for 30 days the invite code of the link you arrived from, until you create an account.
  • “morlex_src”, to remember for 30 days which channel first brought you here (for example TikTok, Instagram or Google). It holds only the channel name and the landing page, is our own, and is used only to count, in aggregate, which channels bring sign-ups.

We also use the browser’s local storage (localStorage and sessionStorage) to save your progress in experiences and some preferences. We use no profiling, advertising or third-party analytics cookies.

11. Changes

If we change this policy in a meaningful way, we will tell you in the app or by email before the changes take effect.