Privacy Policy

This policy explains how Morefold Pty Ltd (ACN 699 686 149, ABN 33 699 686 149) ("Morefold", "we", "us") handles personal information. It covers this website, morefold.ai, and the Morefold platform at app.morefold.ai (the Platform), including any forms the Platform serves on behalf of our customers. We are an Australian company and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are and what this policy covers

Morefold Pty Ltd is an Australian proprietary company. We provide the Platform to insurance brokers and similar businesses (our customers) and operate this website. This policy applies to personal information we collect through the website, the Platform and our dealings with you.

If your organisation has a signed agreement with us, that agreement sets out the commercial and contractual terms between us, including our contractual obligations about its data. This policy is our statement of how we handle personal information and applies alongside that agreement. Our Terms of Use govern use of the website and the Platform.

2. Who this policy applies to

• Visitors to this website. People who browse morefold.ai or contact us.
• Platform users. People at our customer organisations who hold a Morefold account, such as brokers and their staff.
• People whose information appears in customer content. Our customers are businesses, and the emails, documents and records they bring into the Platform describe their clients, insureds, insurers, underwriters and other people they deal with. We handle that information on the customer's behalf and at its direction, to provide the service. The customer remains responsible for its relationship with those people, including telling them how their information is handled, and its own privacy policy governs how it collects and uses their information. If your broker uses Morefold, you can contact them about your information, or contact us using the details in section 19.
• People who complete a form sent by a customer. The Platform can host forms, such as a proposal or declaration, that a broker sends to a client to complete and sign. Section 3 explains what we collect when you do.

3. What we collect

• Website enquiries. If you email us or request a demo, we receive your name, your email address and anything else you choose to include.
• Account information. Your name, work email address, password (stored as a hash) or Google sign-in identity, profile image, email signature, preferences, role in your organisation, and sign-in records such as session details, IP address and browser type.
• Customer content. The documents your organisation uploads or connects; the email conversations it chooses to connect (see section 10); client, policy, claim and renewal records; contact details of insurers, underwriters and other market contacts; records imported from a connected CRM; notes and pasted text such as new enquiries; and the text, summaries, classifications and search indexes we derive from all of it. This content can contain personal information, and sometimes sensitive information, about people who are not Morefold users.
• Connected accounts. When your organisation or one of its users connects a supported service (Google Drive, Gmail, Microsoft 365 including Outlook, OneDrive and SharePoint, or a supported CRM), we store the connection credentials in encrypted form and the material the connection is authorised to provide.
• Forms you complete for a broker. If a broker sends you a form hosted on the Platform, we collect the answers you give, the declaration you make and your signature, the times you opened and submitted the form, and technical details of the device you used, such as IP address and browser type. That information is collected for the broker, forms part of its customer content, and is handled as described in this policy.
• Service records. Activity in your organisation's workspace, including which user prepared, approved, rejected or edited an action (the audit trail); AI requests and their outputs; delivery records for communications sent through the Platform; and technical logs used to operate and secure the service.

4. How we collect it

Directly from you, when you contact us, accept an invitation, sign in, upload something or complete a form. From your organisation, when it sets up your account or brings in records that mention you. Through the connections your organisation or its users authorise, such as a mailbox, file storage or CRM. And automatically, as ordinary technical records created by using the service. Where we hold information about you that you did not give us, it is usually because you appear in an email, document or record that a broker has connected to the Platform.

You can browse this website without identifying yourself. The Platform is a business tool used by invitation, so it cannot be used anonymously. We do not buy personal information or obtain it from data brokers. If you choose not to provide information we ask for, we may not be able to provide the service or respond fully to your enquiry.

5. Why we use it

• To provide the Platform: reading, organising, classifying and summarising the content your organisation connects; flagging missing, expiring or changed information; drafting communications and workflow actions for your team to review; and sending the communications your team approves.
• To run accounts: invitations, sign-in, support, notices about things that need your attention, and letting your organisation's administrators manage its workspace.
• To keep the service secure, reliable and within usage limits, including monitoring AI usage and cost.
• To meet legal obligations and to establish, exercise or defend legal claims.
• To improve the Platform using de-identified, aggregated information, as described below.

We do not sell personal information, and we do not use it for advertising or direct marketing. If we contact you about Morefold because you asked us to, you can tell us to stop at any time. We do not use your content to train AI models, and we use our AI providers under commercial terms that do not permit them to train on it either.

De-identified information. To the extent the law permits, we may de-identify and aggregate customer content and information about how the Platform is used, so that it can no longer reasonably be used to identify a customer, a user or any individual, and use that de-identified information for our internal business purposes, including to operate, analyse, improve and develop the Platform and related services.

6. AI processing

Reading and drafting with AI is the Platform's core feature, so the content your organisation connects, including email and document text, is sent to our AI providers, Anthropic and OpenAI, which process it in the United States. Before any text is sent, Australian tax file numbers, Medicare numbers and payment card numbers are automatically detected and masked, and the original values never leave our systems. That masking covers those three identifiers only. The rest of the content, including names, contact details, policy details and the body of emails and documents, is processed as written, because the AI needs it to be useful.

What the AI produces, such as summaries, extracted details, suggested actions and draft emails, is a draft for a person to check. The Platform does not send a communication to anyone outside your organisation unless a person in your organisation has reviewed and approved it in the Platform. The same person may prepare and approve it. Keeping records in step with your organisation's own connected systems, such as a CRM, is not treated as a communication.

Automated decision-making. We do not use the Platform to make decisions about individuals that could significantly affect their rights or interests without a person making the decision. Morefold prepares the work; a person decides. If that changes, we will update this policy first.

7. Who we share it with

We do not sell personal information, and we do not share it with advertisers. We disclose it only where running the service requires it:

• Service providers. A small set of providers operate parts of the Platform on our behalf: database and application hosting in Sydney, Australia; file storage in the Asia-Pacific region; the AI providers described above in the United States; AI observability and background-job tooling in the United States; and delivery of our own system email, such as invitations and password resets, from Japan. Each receives only what its role requires, under terms that restrict how it may use the information. A current list of these providers is available on request.
• Services you connect. If your organisation or its users connect Google, Microsoft or CRM accounts, those providers handle that data under your organisation's own arrangements with them. Microsoft 365 and Google connections use your organisation's own Microsoft 365 or Google Workspace tenant and the permissions it consents to; what a connection provides is then handled by us as described in this policy.
• Your organisation. Content your organisation brings into the Platform is visible to the users your organisation authorises in its workspace. Connected email conversations are visible to everyone in the workspace.
• Professional advisers and authorities. Our professional advisers where necessary, and regulators, courts or law enforcement where the law requires it.

Emails to your organisation's clients and to insurers are sent from the approving user's own connected mailbox, so they leave through your organisation's existing email provider, not through a Morefold address.

8. Where your information lives and overseas disclosure

Structured data, including client records, quotes and audit logs, is stored on servers in Sydney, Australia, and the Platform runs in Sydney. Uploaded documents and email attachments are stored with our storage provider in the Asia-Pacific region, which does not guarantee storage in Australia only. Some processing happens overseas: email and document content is processed by our AI providers in the United States; some operational tooling, including AI observability and background-job scheduling, runs in the United States; and our own system email is delivered from Japan. Personal information may therefore be disclosed to recipients in the United States and Japan, and stored files may be held in another country in the Asia-Pacific region.

When personal information goes overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including hosting our database and application in Australia, contracting with providers on terms that limit their use of the information, and masking the identifiers described in section 6 before AI processing.

9. Google user data

Morefold's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access Google user data only with your authorisation and only to provide features you ask for: signing you in; importing the Google Drive files your organisation selects and, where your organisation enables it, listing the names of files and folders in the locations it chooses so it can decide what to import; and sending emails you have approved from your own Gmail address. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalised AI or machine learning models. Our staff do not read it except with your permission, where needed for security, or where the law requires. Document content from any connected source, including Google Drive, is processed by the AI providers named above solely to provide these features to you.

10. Mailboxes and other connected accounts

Outlook, Microsoft 365 and Gmail. Mailbox connections are personal: each user connects their own mailbox and can disconnect it at any time. A Gmail connection lets the Platform send emails that user approves from their own address. A Microsoft 365 connection lets the Platform send emails that user approves from their own address and save them to Sent Items, and read the Inbox and Sent Items of that mailbox, starting with a backfill of recent mail and then continuing as mail arrives. The Platform keeps the conversations that match your organisation's clients, and the insurers and underwriters it is dealing with on a placement, so your team can see and act on them, and does not store the rest. To spot new enquiries, the text of new inbound messages that do not match a client is also read by our AI provider and then discarded, unless it looks like a genuine enquiry, in which case the sender, subject and a short masked excerpt are kept as a suggestion for your team. Kept conversations are visible to everyone in your organisation's workspace. Attachment files are fetched only when a user opens them in the Platform; until then we keep only their names, types and sizes. Mailbox reading uses permissions the user grants and can revoke at any time.

Google Drive, OneDrive and SharePoint. File connections import the files your organisation selects, and may list file and folder names in the locations it chooses so it can decide what to import. They do not change or delete anything in your storage.

Connected CRM. If your organisation connects a supported CRM, the Platform reads the people, organisations and deals it is authorised to read so your client records stay in step. It does not write back to the CRM.

Permissions. We request only the permissions the relevant feature needs. Each connection can be seen, changed and revoked in the Platform settings, by the user for a personal mailbox or by an administrator for an organisation connection, and with the provider. Credentials are stored encrypted and are never shared with a third-party integration service.

11. Sensitive information and government identifiers

Content your organisation brings into the Platform can include sensitive information, such as health information in claims material. We handle it only to provide the service and for no other purpose. Your organisation is responsible for being entitled to share it with us and for telling the people concerned how their information is handled. Apart from the masking described in section 6, we do not detect or treat sensitive information differently from other content. We never use tax file numbers, Medicare numbers or other government identifiers to identify anyone, and those identifiers are masked before content is sent to an AI provider.

12. How we protect it

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification and disclosure. They include encryption in transit and at rest, isolation between customer organisations enforced at the database layer, encrypted storage of connection credentials, least-privilege permissions for connected accounts, sign-in protections and rate limiting, audit logging of workspace activity, restricted and logged staff access, and human approval before the Platform sends anything outside your organisation. We keep these measures under review and improve them over time. No system is perfectly secure, and we do not claim ours is. If we become aware of a security incident affecting your information, we will act as described in section 16.

13. How long we keep it

We keep personal information only for as long as it is needed for the purposes in this policy. Website enquiries are kept while we deal with them and for a reasonable period afterwards. Customer content, client records and the audit trail are kept for the life of the customer relationship. When a customer relationship ends, the customer may ask for an export of its content within 30 days; we then delete the content within 30 days after that window closes, or after we provide the export, and remove it from encrypted backups within 90 days after the relationship ends, unless the law requires us to keep it or the customer's agreement with us provides otherwise. When an account is closed we delete or de-identify its account records within a reasonable period, except that the audit trail keeps a record of what that user did while they held the account. Records of AI requests and their outputs are kept with your organisation's content. Technical logs and observability traces are kept for a short operational period. When information is no longer needed we take reasonable steps to delete or de-identify it; residual copies can persist briefly in backups until they are overwritten.

14. Access and correction

You can ask us for access to the personal information we hold about you, and ask us to correct it, by emailing privacy@morefold.ai. There is no charge for making a request. We may need to verify your identity, and we aim to respond within 30 days. If the information sits inside a customer's content, we will usually coordinate with that customer, because it holds the relationship with you and may be best placed to respond. In some cases the law allows or requires us to refuse a request; if we do, we will tell you why in writing and how you can complain.

15. Cookies, analytics and browser storage

This website sets no cookies and uses no analytics or advertising tools. It stores your light or dark theme preference in your browser only. The Platform uses the cookies needed to keep you signed in securely, and stores small amounts of working data in your browser, such as your theme, recently opened records and unsent drafts, so it works smoothly. That data stays on your device and is not used to track you across other sites.

16. Data breaches

We comply with the Notifiable Data Breaches scheme under the Privacy Act. If a data breach occurs that is likely to result in serious harm to individuals, we will notify the affected individuals and the Office of the Australian Information Commissioner as the Privacy Act requires. Where a breach involves a customer's content, we will notify that customer promptly and work with it on its own notification obligations.

17. Complaints

If you think we have mishandled your personal information, email privacy@morefold.ai and tell us what happened. We will acknowledge your complaint, investigate it, and reply within 30 days with what we found and what we will do. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

18. Changes to this policy

We may update this policy as the Platform and the law change. The current version will always be on this page, with the date shown above. We will tell customers with a signed agreement about changes, and if a change meaningfully reduces your rights or expands what we collect, use or share, we will give Platform users notice before it takes effect.

19. Contact

Privacy questions, requests and complaints: privacy@morefold.ai. By post: Morefold Pty Ltd, PO Box 604, Cotton Tree QLD 4558, Australia. Morefold Pty Ltd (ACN 699 686 149, ABN 33 699 686 149).