Morning Tally Privacy Policy

Effective Date: November 4, 2026

1. About This Policy

1.1Who We Are. This Privacy Policy (this "Policy") explains how Morning Tally, a business based in Knoxville, Tennessee ("Morning Tally," "we," "us" or "our"), collects, uses, shares and protects personal information.

1.2What This Policy Covers. This Policy has three parts:

1. Part A covers personal information about visitors to morningtally.com (the "Site"), people who ask us for a free sample report, people we contact about our services, and contacts at our customers. For this information, we decide how and why it is used.
2. Part B covers personal information contained in data that our customers give us, or let us access, so we can produce reports for them. For this information, we act on our customers' instructions as their service provider or processor, and each customer's own privacy notices govern.
3. Part C covers topics that apply to both: security, children, international visitors, changes and how to contact us.

1.3Defined Terms. In this Policy:

1. "Customer" means a business that has signed an Order Form with us under our Master Services Agreement.
2. "Customer Data" means call data, business data and any other data or files that a Customer, its users or its systems provide to us, as further defined in our Master Services Agreement.
3. "Data Processing Agreement" means the data processing agreement between us and a Customer that forms part of the Master Services Agreement.
4. "Master Services Agreement" means the agreement under which we provide the Services to a Customer.
5. "Personal Information" means information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual.
6. "Prospect" means a business, or a person at a business, that we have contacted about the Services or that has contacted us, and that is not a Customer.
7. "Reports" means the daily, weekly, monthly and other reports we deliver to Customers.
8. "Sample Files" means the call and order data exports a Prospect sends us under our Free Sample Report Terms so we can prepare a free sample report.
9. "Services" means our reporting services, including setup, access to Customer systems, analysis of Customer Data, and delivery of Reports.

Part A: Website Visitors, Prospects and Business Contacts

2. Information We Collect

2.1Information You Give Us.

2.2Information We Collect Automatically. When you visit the Site, our hosting provider automatically records technical information, including your IP address, browser type, device type, operating system, the pages you visit, the page that referred you, and the date and time of your visit. We use this information for security and to understand how the Site is used. We receive website analytics only in aggregated form, such as page view counts and referring websites.

2.3Information From Other Sources. To find businesses that may benefit from the Services, we collect business contact information from public sources, including public business directories, trade and industry association member lists, company websites and public professional profiles. This information includes a person's name, job title, business email address, business phone number, employer, and the employer's industry, size and location. We collect only business contact information. We do not buy consumer lists.

2.4Information We Ask You Not to Send. Please do not include in the request form, or in emails to us, any sensitive information such as health information, financial account numbers, government identification numbers or passwords. If you want a free sample report, please follow the instructions in our Free Sample Report Terms instead of attaching data to the form.

3. How We Use Information

We use the information described in Part A to:

1. respond to your questions and requests, including preparing a free sample report you ask for;
2. contact business Prospects by email or phone about the Services, as allowed by law;
3. set up, administer, bill and support Customer accounts;
4. operate, maintain, secure and improve the Site, including detecting and preventing fraud, abuse and attacks;
5. understand, in aggregate, how visitors use the Site;
6. keep a suppression list so we honor requests to stop contacting you;
7. comply with legal obligations, respond to lawful requests, and enforce our terms; and
8. carry out a merger, acquisition, financing or sale of all or part of our business, subject to Section 5.4.

We may use artificial intelligence tools to help us draft and organize our business communications. When we do, we use them under business terms that do not allow the provider to train its models on our data.

4. Legal Bases for Visitors Outside the United States

The Site is intended for businesses in the United States. If the law of your country requires a legal basis for our use of your Personal Information, we rely on:

1. Legitimate interests, to operate and secure the Site, respond to inquiries, and contact business Prospects about services relevant to their work, where those interests are not overridden by your rights;
2. Contract, to take steps you request before entering into a contract and to perform a contract with a Customer;
3. Legal obligation, to keep records and respond to lawful requests; and
4. Consent, where the law requires it. You may withdraw consent at any time.

5. How We Share Information

5.1Service Providers. We share Personal Information with service providers that help us run our business. They may use it only to provide services to us. Our current service providers are:

5.2Legal Requirements and Safety. We may disclose Personal Information if we believe in good faith that the law, a subpoena or a court order requires it, or that disclosure is necessary to protect the rights, property or safety of Morning Tally, our Customers or others.

5.3With Your Direction. We share Personal Information when you ask us to, for example when you ask us to introduce you to someone.

5.4Business Transfers. If we are involved in a merger, acquisition, financing, reorganization or sale of assets, Personal Information may be transferred as part of that transaction. The recipient must protect it in a manner consistent with this Policy. Customer Data will be transferred only as the Customer's Master Services Agreement and Data Processing Agreement allow.

6. No Sale, No Sharing and No Targeted Advertising

6.1We do not sell Personal Information. We do not share Personal Information for cross-context behavioral advertising. We do not run advertising on the Site, and we do not use advertising cookies, pixels or tracking tools.

6.2We do not sell or rent our prospect lists or our suppression list to anyone.

6.3We do not use Personal Information for profiling that produces legal or similarly significant effects on individuals.

6.4If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale and sharing of Personal Information associated with that browser. Because we do not sell or share Personal Information, the signal does not change how we handle your information.

6.5We do not disclose Personal Information to third parties for their own direct marketing purposes.

7. Cookies and Analytics

7.1Strictly Necessary Cookies. Our hosting provider may set a small number of cookies that are needed to protect the Site from bots and attacks and to keep it working. These cookies do not track you across other websites.

7.2Analytics. We use a privacy-focused analytics service that measures visits in aggregate without placing cookies on your device or building a profile of you.

7.3No Advertising Cookies. We do not use advertising, retargeting or social media tracking cookies or pixels.

7.4Your Controls. You can block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the Site may not work.

7.5Do Not Track. There is no common standard for responding to browser "Do Not Track" signals. Because we do not track visitors across websites, our practices are the same whether or not your browser sends one.

8. How Long We Keep Information

We keep Part A information only as long as needed for the purposes in Section 3, as shown below, unless the law requires us to keep it longer or you ask us to delete it sooner.

9. Your Choices and Rights

9.1Stopping Marketing Emails. Every marketing email we send includes a way to opt out. You can also reply "unsubscribe" or email hello@morningtally.com. We process opt-outs within 10 business days, and usually much sooner. After you opt out, we keep your email address on our suppression list so we do not contact you again. If you ask us to delete your information, we still keep the minimum information needed on the suppression list for this purpose.

9.2Stopping Phone Calls. If you ask us not to call you, we will add your number to our internal do-not-call list and stop calling within 10 business days.

9.3Privacy Rights. Whether or not a state law requires it, we will honor the following requests from any person in the United States about Part A information:

1. Access: confirm whether we process your Personal Information and give you a copy of it;
2. Correction: correct inaccurate Personal Information;
3. Deletion: delete your Personal Information, subject to legal exceptions and the suppression list described in Section 9.1;
4. Portability: provide your Personal Information in a commonly used electronic format; and
5. Opt-out: stop any sale, sharing for cross-context behavioral advertising, targeted advertising or significant profiling. We do none of these. You may still ask us to confirm this in writing.

9.4How to Make a Request. Email privacy@morningtally.com with the subject line "Privacy Request." Tell us what you are asking for and how we can reach you.

9.5Verification. We will verify your identity before acting on a request to access, correct or delete information, normally by confirming that you control the email address we have on file. We may ask for more information if needed, and we will use it only to verify your request.

9.6Authorized Agents. You may use an authorized agent to make a request. We may ask the agent for written proof that you authorized the request, and we may ask you to confirm your identity directly with us.

9.7Timing. We will confirm receipt within 10 business days and respond within 45 days after we receive your request. If we need more time, we will tell you why, and we may extend the response period once by up to 45 more days.

9.8Appeals. If we decline your request, you may appeal by replying to our decision with the word "Appeal" in the subject line within 60 days. We will respond in writing within 60 days after receiving your appeal and explain our reasons. If you are not satisfied with the result, you may contact the attorney general of your state.

9.9No Discrimination. We will not discriminate against you for exercising your privacy rights.

9.10Requests About Customer Data. If your request concerns Customer Data (for example, a recording of a call you made to one of our Customers), please see Section 18.

10. US State Privacy Laws

10.1Our Status. Several states have comprehensive consumer privacy laws, including California, Colorado, Connecticut, Texas, Tennessee and Virginia. Most of them apply only to businesses that meet revenue or data-volume thresholds. For example, the California Consumer Privacy Act applies to businesses with annual gross revenue above an inflation-adjusted threshold that started at $25 million (or that meet data-volume or data-sale tests), and the Tennessee Information Protection Act applies only to businesses with more than $25 million in revenue that also meet consumer-volume tests. As of the Effective Date, we believe that we do not meet these thresholds. Most of these laws, including Tennessee's, also do not apply to information about people acting in a business or employment context, which describes most of the information in Part A. California's law is an exception and does cover business contacts when it applies.

10.2Our Approach. We offer the rights in Section 9 to everyone in the United States so that our practices do not depend on which law applies. If any state privacy law begins to apply to us, we will comply with it and update this Policy.

10.3California Disclosures. If you are a California resident, the following disclosures describe our practices during the 12 months before the Effective Date:

We use these categories for the purposes in Section 3 and keep them for the periods in Section 8. We have not sold or shared any of them. We do not use or disclose sensitive personal information.

10.4Nevada. We do not sell covered information as Nevada law defines that term.

Part B: Data We Process for Customers

11. Our Role as a Service Provider

11.1When a Customer uses the Services, the Customer decides what data we access and why. We process Customer Data only on the Customer's behalf and under its instructions, as described in the Master Services Agreement and the Data Processing Agreement. Under state privacy laws, the Customer is the "business" or "controller," and we are its "service provider," "contractor" or "processor."

11.2The Customer's own privacy notices govern how it collects and uses Personal Information, including information about its callers, customers and employees. If you have questions about a Customer's practices, please contact that Customer.

11.3If this Policy conflicts with a Customer's Master Services Agreement or Data Processing Agreement, the agreement controls for that Customer's data.

12. Customer Data We Process

With a Customer's written authorization, we connect to the Customer's systems using read-only access wherever the system allows it, or we receive exports the Customer sends us. Customer Data may include:

1. Call data from the Customer's phone system: call logs (phone numbers, dates, times, durations, directions, outcomes and the employee who handled the call), call recordings, call transcripts, and call summaries produced by the phone vendor's own AI features;
2. Business data from the Customer's system of record (such as a CRM, ERP, agency management system or case management system): orders, quotes, invoices, revenue, and the names and business contact details of the Customer's customers and contacts;
3. Employee information: names of the Customer's employees who make or take calls, and measures such as call counts and sales; and
4. Access credentials: the API keys, tokens or user accounts the Customer creates so we can reach its systems.

Because call recordings and transcripts capture what people say, they may contain information about the Customer's callers that neither we nor the Customer intended to collect.

13. How We Use Customer Data

13.1We use Customer Data only to:

1. produce and deliver the Reports the Customer has ordered;
2. keep a list of the Customer's corrections and standing instructions so later Reports are accurate;
3. set up, test, monitor, troubleshoot and secure the Services; and
4. comply with law.

13.2We do not sell Customer Data. We do not share it for advertising. We do not use it to contact the Customer's callers or customers. We do not combine it with another Customer's data or with our prospect lists. We do not use it to train or fine-tune any artificial intelligence model.

13.3We may compile counts and performance measurements about how the Services run, such as job run times, error rates and the number of calls processed. These measurements do not identify any Customer, individual or customer of a Customer.

14. Artificial Intelligence Processing

14.1We send call transcripts and related business data to a third-party artificial intelligence provider through its commercial service, so its model can analyze them and help write the Reports.

14.2Our artificial intelligence provider's commercial terms prohibit it from training its models on the data we send. We will only use artificial intelligence providers whose terms prohibit training on the data we send them, and we never use Customer Data to train or fine-tune any model ourselves.

14.3We review Report output and, when needed, the underlying Customer Data, to check quality and fix errors. Every customer quotation that appears in a Report is checked against the source transcript before delivery.

14.4Reports are produced with automated tools and can contain errors. Customers are responsible for decisions they make using Reports, and our contracts require human review before a Report is used for decisions with significant effects on an individual, such as employee discipline.

15. Our Data Commitments

We have made these commitments to every Customer:

1. Read-only access. We use read-only access to Customer systems wherever the system offers it. We do not create, change or delete records in a Customer's systems unless the Customer authorizes a specific action in writing.
2. Encrypted credentials. We store Customer credentials only in encrypted, access-controlled storage, and never in code, email or chat.
3. Call content deleted within 90 days. We delete call recordings and transcripts within 90 days after the Report that covers them is delivered, except short verbatim quotations that appear in delivered Reports.
4. Access revocable at any time. A Customer can revoke our access at any time by disabling the credentials it gave us or by emailing legal@morningtally.com. Services that depend on that access stop until it is restored.

16. Retention and Deletion of Customer Data

16.1During the Relationship. We keep Customer Data only as long as needed to provide the Services, subject to the 90-day limit for call recordings and transcripts in Section 15.

16.2Credentials. We delete a Customer's credentials within 5 business days after its last Order Form ends or after it asks us in writing.

16.3After the Relationship Ends. Within 30 days after a Customer's last Order Form ends, we delete all of its Customer Data, including archived analysis and copies of Reports, except: (a) data in routine backups, which is overwritten in the normal backup cycle within a further 30 days and stays protected until then; and (b) data the law requires us to keep, which we protect and use only for that legal purpose. On request, we give the Customer a written certificate of deletion.

17. Subprocessors

We use subprocessors in these categories to process Customer Data: artificial intelligence analysis, cloud computing and database hosting, Report email delivery, website hosting and network security, and business email. Customers receive the names and processing locations of our current subprocessors when they sign our Data Processing Agreement. Each subprocessor is bound by a written agreement to protect the data. We give Customers advance notice before adding or replacing a subprocessor, as our Data Processing Agreement describes.

18. Requests From Individuals About Customer Data

If you called or did business with one of our Customers and want to access, correct or delete information about you, please contact that Customer directly, because it controls that information. If you send the request to us, we will forward it to the Customer within 5 business days and help the Customer respond. We will not respond to the request ourselves, except to tell you that we forwarded it.

19. Sensitive and Regulated Data

19.1Recording Consents. Each Customer is responsible for giving the notices and obtaining the consents the law requires to record, transcribe and analyze its calls, including in states that require the consent of every party to a call, and for telling callers and employees that recordings may be analyzed by automated tools.

19.2Sensitive Information. The Services are not designed to collect sensitive information. We ask Customers not to send payment card numbers, bank account numbers, government identification numbers or passwords, and we redact them where we detect them. We recommend that Customers turn on any redaction features their phone systems offer.

19.3Businesses We Do Not Serve. We do not offer the Services to healthcare providers, law firms, insurance agencies, banks, lenders or other financial institutions, and we do not accept protected health information.

20. Free Sample Reports

20.1A Prospect that asks for a free sample report sends us Sample Files under our Free Sample Report Terms, by the secure upload link we provide or by email to samples@morningtally.com. We treat Sample Files with the same protections we give Customer Data.

20.2We use Sample Files only to prepare one sample report and discuss it with the Prospect. We do not use them to contact the Prospect's callers or customers, and we never show a Prospect's sample report or results to anyone else.

20.3Within 30 days after we deliver the sample report, we delete the Sample Files and all analysis derived from them, whether or not the Prospect becomes a Customer. Sample Files are never carried into the paid service. A Prospect may ask us to delete them sooner by emailing privacy@morningtally.com, and we will do so within 5 business days.

Part C: General

21. Security

21.1We protect Personal Information and Customer Data with administrative, technical and physical safeguards appropriate to the risks, including:

1. a written information security program, reviewed at least once a year;
2. multi-factor authentication on every account that can reach Customer Data;
3. encryption in transit using TLS 1.2 or higher, and encryption at rest by our database and storage providers;
4. least-privilege access, with read-only credentials to Customer systems wherever available;
5. separation of each Customer's data, with checks that prevent one Customer's Report from reaching another Customer;
6. full-disk encryption, automatic screen lock and current updates on work devices;
7. daily monitoring of scheduled jobs and regular review of account access logs; and
8. a written incident response plan.

21.2No system is completely secure. If a security incident affects Customer Data, we will notify the affected Customer within 72 hours after we confirm it. If a security incident affects Part A information, we will notify affected individuals as the law requires.

22. Children

The Site and the Services are designed for businesses and are not directed to children under 16. We do not knowingly collect Personal Information from children under 16. If you believe a child under 16 has given us Personal Information, please email privacy@morningtally.com and we will delete it.

23. International Visitors

We are based in the United States, and the Site is intended for businesses in the United States. We and our service providers process information primarily in the United States, where data protection laws may differ from those in your country. If you visit the Site or contact us from outside the United States, you understand that your information will be transferred to and processed in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, you may exercise the rights in Section 9 by emailing privacy@morningtally.com, and you may complain to your local data protection authority.

24. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the updated Policy on the Site and change the Effective Date at the top. If a change materially affects how we handle Customer Data, we will also notify Customers in advance as our agreements with them require. We encourage you to review this Policy periodically.

25. Contact Us