Privacy Policy

Updated: September 2026.

MorganHR, Inc. (“Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it through our compliance with this policy. This policy describes how we collect, process, retain, and disclose personal data about you when you use our human resources software and related services, including our SimplyMerit platform, through our websites that link to this policy (our “Services”), and our practices for using, maintaining, protecting, and disclosing that information.

This policy only applies to information we collect (1) through the Services, and (2) in communication, including email, text, chat, and other electronic messages between you and us. Please read this policy carefully to understand our policies and practices regarding your information and how we treat it. This Privacy Policy should be read together with our Terms of Use, our Cookie Policy, and our Dispute Resolution Policy. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this privacy policy. This policy may change from time to time. Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Scope of This Policy; Our Business Customers and Their Users

MorganHR provides HR software, including the SimplyMerit platform, that businesses (“Business Customers”) use to manage information about their own employees, applicants, and personnel (“Customer Data”). This Policy does not govern our processing of Customer Data. Instead, when a Business Customer or its personnel submit Customer Data to the Services, we act solely as a service provider and processor on behalf of, and under the instructions of, that Business Customer, who remains the data controller responsible for such Customer Data. Our processing of Customer Data on behalf of a Business Customer is instead governed by our agreement with that Business Customer and the data processing terms incorporated into it.

If you are an employee, applicant, or other personnel of one of our Business Customers and have questions about how your personal data is processed within the Services, please contact that Business Customer (your employer or prospective employer) directly, as it controls that data and is responsible for responding to your request. We will support our Business Customers in responding to such requests as required by our agreement with them and applicable law.

This Policy governs personal data that we collect and control directly, for example, information about visitors to our websites, prospective customers, and the individuals at a Business Customer who administer or use our Services on that Business Customer’s behalf in their capacity as an account administrator or authorized user (“Site and Account Data”). References to “you” in the remainder of this Policy refer to individuals whose Site and Account Data we collect, unless the context indicates otherwise.

Children’s and Minors’ Data

Our Services are not intended for, and we do not knowingly collect any personal data from, children under the age of 18. If we learn we have collected or received personal data from a child under 18 years old without verification of parental consent, we will delete that information.

The Personal Data That We Collect or Process

“Personal data” is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, or payment information (for example, account information such as name, postal address, and email address, credit card number, and any other identifier we may use to contact you).

We collect several types of information from and about individuals who access and use our Sites and use our Services, including:

• Account and contact information, including name, address, email address, job title, and other contact information you provide to us.
• Billing and payment information, including credit card or debit card information you use in connection with the Services.
• Account history, including information about your subscription, account, transactions, purchases, order history, or discounts.
• Content and information you or your organization submit to the Services, including data entered into the SimplyMerit platform in connection with your use of the Services.
• Location information, including general geographic location such as country, state or province, or city, if you have enabled and consented to location information collection.
• Device and usage information, including your IP address, device identifiers, browser type, and other device information.
• Content and information you elect to provide as part of your profile, or in any reviews, surveys, or other communications sent to us.

Some of the information identified above may be considered sensitive data under certain laws. If required under applicable law, we will collect and process sensitive personal data only with your consent. If you choose not to provide or allow us to collect some information, we may not be able to provide you with requested features, services, or information.

Biometric Information

The Services do not collect, capture, purchase, or otherwise obtain biometric identifiers or biometric information, as those terms are defined under the Illinois Biometric Information Privacy Act or similar laws.

How We Collect Your Information

You Provide Information to Us

We collect information about you when you interact with our Services, such as when you create or update an account, place an order, register for or attend a demo, participate in surveys, or submit information through a form (including forms hosted through our marketing and scheduling tools).

Automatically Through Our Services

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies, including details of your interactions with our Services and other communication data, and which resources and Services features that you access and use.

We may use these automatic collection technologies to collect information about your online activities over time and across third-party sites or other online services (behavioral tracking).

The technologies we use for this automatic data collection include cookies. A cookie is a small file placed on your device when you interact with the Services. Non-essential cookies, including statistics, marketing/advertising, and social media cookies, are placed only after you provide affirmative opt-in consent through our cookie consent tool. For a full description of the cookies we use, the third parties involved, and how to manage your preferences, please see our separate Cookie Policy. You may also refuse to accept or disable cookies through your browser or device settings; however, if you do so, you may be unable to access certain features of the Services.

How We Use Your Information

We use information that we collect about you or that you provide to us to:

• Provide the Services and any other related products, documents, and information.
• Promote our services, business, and offerings, where you have consented to receive marketing communications.
• Carry out our obligations and enforce our rights.
• Operate, maintain, and improve the Services and your experience with them.
• In any other way we may describe when you provide the information.
• Contact you about goods and services that may be of interest to you.

The usage information we collect, whether connected to your personal data or not, helps us improve our Services and deliver a better and more personalized experience. You may opt out of any future marketing contacts from us at any time.

Who We Disclose Your Information To

We may disclose personal data that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support us in providing the Services, including marketing and customer relationship management platform providers (such as HubSpot) and review/testimonial platform providers (such as G2).
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company’s assets.
• To comply with applicable laws and regulations, respond to a subpoena, search warrant, or other lawful request for information, or to protect our rights.
• For the protection of us, our customers, and others, if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of us, such as exchanging information for the purposes of fraud protection and credit risk reduction.

California Civil Code Section § 1798.83 permits users who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us at hello@morganhr.com.

Data Security and How We Protect Your Information

We have implemented and adopted appropriate commercially reasonable measures designed to secure your Personal Information against unauthorized access, alteration, disclosure or destruction. All information you provide to us is stored on secure servers behind firewalls. Any Personal Information or payment-related information exchanged will be protected using encrypted, protected with digital signatures, and transported over an SSL secured communication channel.

No transmission of information via the internet or any electronic commerce is completely secure. Although we use appropriate commercially reasonable efforts and standards to protect your Personal Information, we cannot guarantee the security of the Personal Information transmitted to our Sites and through our Company Offerings.  Any transmission of Personal Information is at your own risk and you should consider taking pro-active steps to secure and protect yourself, your Personal Information and all information online and with any electronic commerce. You are responsible for keeping your password and user details confidential and we will not ask for your password in any correspondence between us.  We are not responsible for circumvention of any privacy settings or security measures of mobile applications or on the Sites.  We reserve the right to contact or notify you about any information regarding this Policy, security, our services, the Sites, and other Company Offerings electronically along with other means of notification. Use of the Company Offerings involves third-party hardware (i.e. smart phones and other mobile devices) as well as software integrated into the service or third-party service providers or carrier or platforms (i.e. ShareFile). Company does not control third parties. User’s information will be handled by such third-party and Company cannot assure User that such information will be handled in a secure manner.

Your Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal data under applicable state privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), and similar laws in states such as Colorado, Connecticut, Oregon, Texas, and Virginia. This section describes those rights and supplements the rest of this Policy. It does not apply to Customer Data that we process on behalf of Business Customers, as described in the Scope section above.

Your Rights

Subject to applicable law and certain exceptions, you may have the right to:

• Know and access. Request that we disclose the categories and specific pieces of personal data we have collected about you, the categories of sources from which it was collected, the business or commercial purposes for collecting, selling, or sharing it, and the categories of third parties to whom we have disclosed it, and obtain a copy of your personal data in a portable format.
• Correct. Request that we correct inaccurate personal data we maintain about you.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company’s assets.
• Delete. Request that we delete personal data we have collected from you.
• Opt out. Opt out of the “sale” or “sharing” of your personal data, of targeted (cross-context behavioral) advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects.
• Limit. Limit our use and disclosure of sensitive personal data, where applicable.
• Non-discrimination. Not be discriminated or retaliated against for exercising any of these rights.

Sale and Sharing of Personal Data

We do not sell personal data in exchange for money. However, when you consent to marketing and advertising cookies, third-party advertising partners such as LinkedIn (including through the LinkedIn Insight Tag) and Google may collect identifiers, internet or other electronic network activity information, and inferences through our Sites in order to deliver, target, and measure advertising. Under some state laws, this may be considered a “sale” or “sharing” of personal data, or “targeted advertising.” In the preceding 12 months, we may have sold or shared those categories of personal data with advertising partners for these purposes. We do not knowingly sell or share the personal data of consumers under 16 years of age.

Compliance and Related Information Regarding Minors

No one under the age of 13 may provide any personal information, and we do not knowingly collect personal information from children under the age of 13 (or 18 without parental/guardian consent). If you are under the age of 13, do not use or provide any personal information on our sites or provide any information to us about yourself, including your name, address, telephone number, email address, screen name, or username you may use. If we learn we have collected or received personal information from a child under the age of 13 (or under the age of 18 without parental/guardian consent), we will delete that information. If you believe we might have any personal information from or about a child under the age of 13 (or 18 without parental/guardian consent), please contact us at our contact information specified below.

Email Communication

We may periodically communicate with you via email, including emails that verify password and username information, or which provide updates, service announcements, administrative messages, and/or other important information about the Services. These emails are tied to our services and other Company offerings.

Correcting or Updating Personal Information

If User’s Personal Information changes, or if User has a reason to believe that User’s Personal Information maintained by Company is incorrect, User may contact Company and Company will accommodate such reasonable requests for such changes.

Company will use commercially reasonable efforts to timely make any changes request by Users. Many such changes are accomplished using batch processing (i.e. collecting a number of similar change requests and making all such changes at once), so the changes may not be immediately effective but may take thirty (30) days or longer. If User requires an immediate change to User’s Personal Information and User is unable to make such a change using the available Sites resources and user profile on the application, please contact Company at hello@morganhr.com.

Retention of Personal Information

We keep your personal data for as long as necessary to provide the Services, the relevant purposes described in this Privacy Policy, or as we otherwise notify you should there be an update to this Policy, and as may be required by law (including for our tax, audit, and accounting purposes).

Contact Us

If you have questions about this Privacy Policy, please contact us:

• MorganHR, Inc.
• 21720 W. Long Grove Rd., Suite C-216, Deer Park, IL 60010, United States
• Email: hello@morganhr.com
• Phone: (847) 719-9060