Effective 25 October 2026 · Last updated 25 October 2026
Morpheus is a software and data platform for retail distribution, operated by TheMorpheusCompany, Inc. ("Morpheus", "we", "us", "our"). This policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices and rights people have.
It covers our website at themorpheusco.com, the Morpheus application (including each customer's own sign-in address, such as company.themorpheusco.com), and the information about retail businesses that Morpheus contains.
Morpheus is sold to businesses ("customers"). Most people who use it do so because their employer gave them access.
Account and sign-in information. Your name, work email address, company, role, title and team. If you sign in with Google or Microsoft, we receive your name, email address, whether the email is verified, and the work domain that manages your account. We never receive or store your Google or Microsoft password.
Security information. Sign-in times and outcomes, the fact that a passkey or Face ID has been registered (the biometric itself never leaves your device and is never sent to us), multi-factor settings, IP address and device type, used to protect accounts and investigate misuse.
Work you record in Morpheus. Store visits, notes, tasks, missions, routes, placements, call logs, and photos you choose to upload. This information belongs to your company.
Location, only when you use field features. If you allow it on your device, we use your location to show nearby stores, plan routes and record where a visit took place. Morpheus does not track your location in the background or when the app is closed. You can turn location off at any time in your device settings.
Voice, only when you use Deki. When you press and hold to talk to Deki, the voice assistant, your audio is sent for transcription and understanding (see section 5).
Usage and device information. Which screens and features are used, app version, browser and device type, IP address, approximate location derived from IP address, and error reports.
Information you send us. The content of emails and enquiries, and the details you give us when you ask about an account.
Information about retail businesses. Morpheus contains information about retail locations and the businesses that run them, drawn from public registries, licensing records and commercial data sources (see section 10).
We do not ask for, and ask customers not to record in Morpheus, sensitive information such as health information, government identification numbers or financial account numbers.
What we do not do. We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use customer information to train artificial intelligence models, and we do not allow our service providers to do so. We do not share one customer's information with another customer.
When you sign in with Google or Microsoft, we receive only your name, email address, email verification status and the work domain that manages your account. We use them only to sign you in and to confirm which company you belong to. We do not request access to your email, files, calendar or any other data in those accounts.
Morpheus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Maps and store imagery in Morpheus are provided through Google Maps Platform. When a map loads, Google receives the information your browser sends to load it, under the Google Privacy Policy.
Deki, the voice assistant, sends your spoken request to OpenAI to be transcribed and understood. We keep the resulting text request and what was saved as a result, not a recording of your voice. OpenAI processes this information as our service provider under business terms that do not permit it to train its models on the information, and that limit how long it may keep it for abuse monitoring.
Answers and suggestions in Morpheus, including store scores and estimates, are produced automatically from data and may be wrong. They are aids to judgment, not decisions: Morpheus does not make decisions about people that have legal or similarly significant effects on them.
Your company. Your company's administrators and managers can see the work recorded in their company's Morpheus according to the roles they set.
Service providers that run Morpheus for us, under written contracts that limit their use of the information to providing their service to us:
We will update this list when it changes, and tell customers before a new service provider begins handling their information.
Legal reasons. When we believe in good faith that disclosure is required by law, regulation or legal process, or is needed to protect the rights, safety or property of our users, customers or the public. Where the law allows, we will tell the affected customer first.
Business transfers. If Morpheus is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction, and will remain subject to the promises in this policy.
With your direction. When you or your company ask us to share information, for example with an integration your company turns on.
Morpheus uses cookies and browser storage that are needed for it to work: to keep you signed in, to remember your company and your settings (such as the map style you chose), and to protect the service, including the access check our security provider runs before the application loads. These cannot be switched off without stopping Morpheus from working.
We do not use advertising cookies, and we do not allow third parties to track you across other websites through Morpheus. Because we do not sell or share personal information for advertising, we treat a Global Privacy Control signal from your browser as a confirmation of that choice; there is nothing further to opt out of. Our website and application do not change their behaviour in response to "Do Not Track" signals, because they do not track you across sites.
Information is encrypted in transit and at rest. Each company's information is kept separate from every other company's at the database level, so one company's users cannot reach another company's records. Sign-in requires multi-factor authentication, a passkey, or the company's own Google or Microsoft sign-in. Access by our own staff is limited to people who need it to run the service and is protected by multi-factor authentication. Backups are encrypted and restores are tested.
No system is perfectly secure. If we become aware of a security incident that affects a customer's personal information, we will notify the affected customer without undue delay, and others as the law requires, and tell them what happened and what we are doing about it.
Morpheus helps distributors plan their work with information about retail locations: the store's name, address, type, licences, and, where public records show it, the business that holds its licence and the name of its owner or officer. This information comes from government licensing registries and corporate filings, public listings, and commercial data providers, and it is used to describe businesses, not to profile individuals.
Our customers may not use Morpheus to make decisions about individuals' eligibility for employment, credit, insurance or housing, and may not use it to build profiles of private individuals.
Removing an owner's name. If you are named in Morpheus as the owner or officer of a business and want your name removed, email [email protected] with the subject "Owner removal", the business name and its address. We will confirm the request is yours, remove your name from the business's record within 30 days, and keep a note so it is not added back from the same source.
You can review and update much of your information inside Morpheus. Depending on where you live, you may have the right to:
How to ask. If you use Morpheus through your employer, please start with your company's administrator, who controls your company's information; you can also contact us and we will work with your company to respond. Otherwise, email [email protected] with the subject "Privacy request".
We will confirm we received your request within 10 business days and respond within 45 days. If we need more time, up to a further 45 days, we will tell you why. We will verify your identity before acting, usually by confirming control of your email address. You may use an authorised agent, who must show written permission from you. If we decline your request, you may appeal by replying to our decision with the word "Appeal"; we will answer the appeal within 60 days, and if you are not satisfied you may contact your state's attorney general.
This section adds detail required by the privacy laws of California and other states, including Colorado, Connecticut, Virginia, Texas, Oregon and Utah.
Categories collected in the last 12 months, for the business purposes in section 3: identifiers (name, email address, IP address, account identifiers); professional information (employer, role, title, team); internet and device activity (usage, sign-in and error records); approximate and, with permission, precise geolocation (field features only); audio, converted to text (Deki only); and inferences limited to store scores and estimates about businesses, not individuals.
Sources: you, your employer, your device, sign-in providers, public records and commercial data providers.
Disclosures: to the service providers and recipients described in section 6, for business purposes only. We have not sold or shared personal information for cross-context behavioural advertising, and we do not knowingly sell or share the information of anyone under 16.
Sensitive information: precise geolocation is used only to provide the field features you turn on, and not to infer characteristics about you.
Shine the Light: we do not disclose personal information to third parties for their own direct marketing.
Morpheus is provided from, and hosted in, the United States. If you use it from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Where the law requires a legal basis for processing, we rely on our contract with the customer, our legitimate interests in providing and securing the service, legal obligations, and, where needed, consent. Customers outside the United States may ask us for a data processing agreement that includes appropriate transfer safeguards.
Morpheus is a business tool and is not intended for anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.
We may update this policy as Morpheus changes or as the law requires. We will post the new version here with a new date, and tell customers about material changes before they take effect.
TheMorpheusCompany, Inc.
[email protected]