Privacy Policy

Who is responsible

Morganwell is operated by ARC LABS AS (organisation number 937 980 884), Nordahl Bruns gate 22C, 0165 Oslo, Norway. ARC LABS AS is the controller of the personal data described here. Because we are established in Norway, we process personal data under the EU General Data Protection Regulation (GDPR) as it applies in Norway and the Norwegian Personal Data Act. Contact us about privacy at info@morganwell.com.

What we collect and why

• Property searches. The address or PIN you type and the properties you check. We use this to run the check and show your result. Legal basis: providing the service you ask for (GDPR art. 6(1)(b)).
• Your account. Your email address and, if you sign in with Google, the name and profile picture Google shares with us. When you sign in we store a session record with your IP address and browser type. Sign-in codes and links are stored only in hashed form. Legal basis: our agreement with you (art. 6(1)(b)) and keeping accounts secure (art. 6(1)(f)).
• Results you have seen. When you see a result after entering your email, we record which properties you checked, linked to your email and account. We use this to show your results again, to send the emails described below and to understand how Morganwell is used. Legal basis: our agreement with you (art. 6(1)(b)) and our legitimate interest in running and improving the service (art. 6(1)(f)).
• Orders. Which report you bought, for which property, the price, the amount paid and the payment status. We keep these to deliver your report and to meet accounting rules. Legal basis: our agreement with you (art. 6(1)(b)) and legal obligations (art. 6(1)(c)).
• “Watch this property” and “Email it to me”. Your email address, the address or PIN, its township, the wording you agreed to, and the time and IP address of your sign-up. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link.
• Emails we send you. We keep a copy of each email we send you (except sign-in codes), its delivery status and any unsubscribe, so we can show what was sent and respect your choice.
• Usage records. Which pages and properties are viewed and what is typed into the address search. These records carry a code made by hashing your IP address and browser type with a value that changes every day; we do not store the IP address itself in them. We may match them with the results you have seen to understand where people stop. Legal basis: our legitimate interest in running and improving the service (art. 6(1)(f)).

We do not sell your personal data, and we do not use it for advertising profiles. We may create anonymised or aggregated data that no longer identifies you and use it for any purpose, such as statistics and improving the service.

Emails

• Sign-in emails, receipts and report delivery emails are part of the service and are always sent.
• If you use Watch or ask us to email you a result, we email you about that property and, if it has a possible case, remind you a week, three days and one day before filing closes and a few days before Board of Review evidence is due.
• If you have an account and a check finds a possible case that you have not bought a report for, we may email you about that case the next day and remind you before the deadline. These emails stop when you buy, when the filing window closes, or when you unsubscribe. Legal basis: our legitimate interest in telling you about your case (art. 6(1)(f)). You can object at any time.

Every email that is not a sign-in, receipt or delivery email has a one-click unsubscribe link.

Cookies and similar technologies

• A sign-in cookie that keeps you signed in for up to 7 days, and a short-lived cookie used during Google sign-in.
• A random visit code that ends when you close your browser, and a cookie that remembers for 30 days which link brought you to Morganwell.
• Your browser’s local storage keeps the email address you last typed, so you do not have to type it again.
• Google Analytics cookies, which count visits and show which pages are used. Google receives your browser type, approximate location, the pages you view and, for some steps, the PIN of the property you checked. It does not receive your email address. You can block these cookies in your browser or with Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.

Who we share data with

We use these service providers. They process data on our behalf under their data processing terms, except Stripe and Google when they act as independent controllers as noted.

• Vercel (United States): hosts the website.
• Neon (database hosted in the United States): stores the data described above.
• Resend (United States): sends our emails.
• Stripe (United States and Ireland): processes payments. Stripe receives your email address, the order and the property PIN, and handles card data under its own privacy policy. We never see or store your card number.
• Google (United States and Ireland): Google Analytics, and Google sign-in if you choose it. Our emails and reports load fonts from Google, which lets Google see the IP address of the device that opens them.
• Komoot (Germany): the address suggestions service receives the text you type in the address search, but not your IP address.

We may also disclose data where the law requires it, to prevent fraud or abuse, or to establish, exercise or defend our rights in a legal claim. If Morganwell or ARC LABS AS is sold, merged or restructured, personal data may pass to the new owner, who must keep using it in line with this policy.

Property information from public records

Morganwell shows property information, such as characteristics, assessments and sales, that public bodies publish as public records. We use it to compare homes and build reports, based on our legitimate interest in providing the service (art. 6(1)(f)). We do not add personal details from other sources. If you believe public record data about you is wrong, it must be corrected at the public body that published it; you can also ask us to stop showing it.

Transfers outside Europe

Some providers above process data in the United States. Where they do, the transfer relies on the provider’s certification under the EU-U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses in their data processing terms. Contact us for more information about the safeguards used.

How long we keep data

• Account data, results you have seen and email records: for as long as your account is in use, or until you ask us to delete them.
• Watch and result-email sign-ups: until you unsubscribe or ask us to delete them. We keep a record of an unsubscribe so we do not email you again.
• Orders and payment records: for as long as Norwegian bookkeeping law requires, currently five years after the end of the financial year.
• Reports that were never bought may be deleted after the appeal window for that property closes.
• Sign-in codes and links expire after 20 minutes, and sign-in sessions after 7 days.

Your rights

You can ask for access to your personal data, and to have it corrected or deleted. You can also ask us to restrict its use, to receive it in a portable format, and you can object to processing based on our legitimate interests, including emails about your case. Where we rely on your consent, you can withdraw it at any time. Email info@morganwell.com from the address you used with us, and we will answer within one month.

If you think we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no, or to the data protection authority where you live.

Security

Data is sent over encrypted connections. Sign-in codes are stored in hashed form, and access to customer data is limited to the people who run Morganwell. No online service can be completely secure, so we cannot guarantee that data will never be accessed without permission. If a breach affects your rights, we will tell you and the authorities as the law requires.

Children

Morganwell is meant for adult property owners and is not directed at children under 16. If we learn that we hold data about a child, we delete it.

Other websites

Links to other websites, such as government offices, Stripe or Google, are covered by their own privacy policies, not this one. We are not responsible for how they handle data.

Changes

We may update this policy at any time by publishing a new version here. The date at the top shows when it last changed.

Law

This policy is governed by Norwegian law, and the governing law and courts section of our Terms of Service applies to any dispute about it. This does not limit your right to complain to a data protection authority.