Privacy Policy
Last updated: 31 October 2026.
This Privacy Policy explains how Morris Legacy LLC, a Wyoming limited liability company (“Morris Legacy”, “we”, “us”), collects, uses and protects personal data. It applies to visitors to morris.is, anyone who sends us a message or books a call, and our clients and their users of our consulting, managed endpoint and Shamir services.
Shamir, our client portal, has its own policy at shamir.morris.is/privacy. Where a client signs a contract or Data Processing Agreement with us, that contract governs the client data it covers.
1. Who is responsible for your data
Data controller: Morris Legacy LLC, a Wyoming limited liability company
Address: 30 N Gould St Ste N, Sheridan, WY 82801, USA
Contact: contact@morris.is
Website: https://morris.is
Operations: Israel
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name, email, and optionally phone and company, plus your answers on the contact form | To reply to your message | Legitimate interest; steps before a contract |
| Name, email, chosen time and notes when you book a call | To schedule the call: the booking creates a calendar invitation in our Microsoft 365 calendar | Steps before a contract |
| IP address, browser and device details, pages viewed | Site analytics (PostHog), spam protection (Cloudflare Turnstile), security and hosting logs (Cloudflare, Railway) | Legitimate interest |
| Client contacts, support tickets and their messages, time records | To deliver and bill the services you engaged us for | Contract |
| Managed device data: device names, signed-in user names, health, patch and antivirus status | To monitor and maintain the devices we manage for clients | Contract |
| Billing contact and invoice details | Invoicing through Stripe; we never see or store card details | Contract; legal obligation |
3. How we use it
- To answer enquiries and hold the calls you book
- To deliver, support and invoice our services
- To keep our websites and systems secure and understand how they are used
- To send service information you asked for; we do not send marketing email without your consent
We do not sell personal data, use it for advertising, or make automated decisions about you.
4. Service providers
These providers process data on our behalf under their own terms and data protection agreements:
- Microsoft 365: email (including contact form delivery), calendar bookings and files. Microsoft Privacy Statement
- Cloudflare: DNS, network security and the Turnstile spam check on our forms. Cloudflare Privacy Policy
- Railway: hosts our websites and applications. Railway Privacy Policy
- PostHog: website analytics. PostHog Privacy Policy
- Stripe: invoices and payments. Stripe Privacy Policy
- N-able: remote monitoring and management of client devices. N-able Privacy
- Anthropic: AI features in our internal tools and client portal. Anthropic Privacy Policy
- YouTube: videos embedded in privacy-enhanced mode (youtube-nocookie.com); YouTube receives data only when you play a video. Google Privacy Policy
5. International transfers
Morris Legacy LLC is a US company operated from Israel, which the European Commission recognises as providing adequate data protection. Several providers above process data in the United States under the EU-US Data Privacy Framework or Standard Contractual Clauses.
6. How long we keep it
- Messages and booking details: up to 12 months, longer if we start working together
- Client service records, tickets and time records: for the engagement plus 24 months
- Invoices and payment records: 7 years, for tax and accounting
- Analytics: up to 12 months in identifiable form
- Security logs: up to 90 days
7. Your rights
Depending on where you live (including the EU, UK, Israel and US states such as California), you may have the right to access, correct, delete, restrict or port your personal data, to object to processing, and to withdraw consent. Email contact@morris.is; we reply within 30 days. You can also complain to your local data protection authority; in Israel this is the Privacy Protection Authority.
8. Cookies and local storage
- Analytics: PostHog sets a first-party cookie to count visits. We do not build personal profiles from it.
- Spam check: Cloudflare Turnstile runs on our forms to stop bots.
- Preferences: your light or dark theme choice is saved in your browser only.
We use no advertising cookies and serve no third-party ads.
9. Security
We protect personal data with HTTPS everywhere, multi-factor authentication and least-privilege access on our systems, encrypted storage at our providers, and the same security controls we apply for clients. If a breach affects your data, we will notify you and the relevant authorities as the law requires.
10. Children
Our services are for businesses. We do not knowingly collect data from anyone under 16.
11. Changes
We will post any changes here and update the date at the top. Significant changes affecting clients will also be emailed to them.
12. Contact
Morris Legacy LLC
30 N Gould St Ste N, Sheridan, WY 82801, USA
contact@morris.is
https://morris.is