DraftThis document is an auto-generated starting point and must be reviewed by a US attorney before production use.
Privacy Policy
Last updated: October 21, 2026
This Privacy Policy explains how The Brand Building Shop, LLC ("we", "us") collects, uses, and protects personal information through the Morellius platform (the "Service"). We are based in Charlotte, North Carolina, USA.
The Service is a B2B tool used by consultants and organizations to run narrative-alignment surveys and generate analysis. Our customers (the consultants and organizations who hold an account) act as the data controller for the survey responses they collect; we act as a data processor on their behalf, and as the controller of account-level information they provide to us.
1. Information we collect
Account information: name, email, organization name, and credentials of customers who create an account.
Contact enquiries: first name, organization name, approximate team size (including volunteers), phone number, and preferred language when you request information or a narrative diagnostic. We store your enquiry for The Brand Building Shop to respond to your request and may also notify its team by email.
Survey response data (collected on behalf of our customers): respondent name (optional), department, role level, segment, free-text answers, and technical metadata such as IP address and submission timestamp.
Technical data: cookies necessary for authentication and duplicate-submission prevention (see Section 8), and standard server logs.
2. How we use information
To provide and operate the Service, authenticate users, and prevent abuse.
To generate narrative-alignment analysis. Survey text is processed by a third-party AI provider (Anthropic) to produce reports; we do not use it to train models.
To communicate with account holders about the Service. Marketing emails, if any, comply with the US CAN-SPAM Act and include an unsubscribe mechanism.
To respond to contact enquiries and requests for a Morellius demonstration or narrative diagnostic.
Nonprofit pilot statistics are optional. When the organization and the relevant respondents separately authorize this use, we may prepare grouped GAP statistics without organization names, personal details or written quotations. Fictional examples are excluded, and grouped GAPs are withheld until the minimum sample is met. These statistics describe the participating sample, not the whole nonprofit sector. Organizations can withdraw permission from their dashboard; respondents can withdraw from their survey on the same browser, or contact morellius@thebrandbuildingshop.com. Declining or withdrawing does not affect the diagnostic.
3. Legal bases and your choices
We process personal information to perform our contract with our customers, to comply with legal obligations, and for our legitimate interest in operating and securing the Service.
Survey participation is voluntary; respondents may decline to provide their name and may contact the organization that invited them to exercise their rights.
4. California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information.
We do not sell personal information and do not share it for cross-context behavioral advertising.
We will not discriminate against you for exercising these rights. To make a request, contact us using Section 11.
5. Sharing and subprocessors
We share personal information only with service providers who help us operate the Service, under contract and limited to what is necessary. Current subprocessors include:
- Anthropic (AI analysis of survey text)
- Our hosting and database provider
- Our email provider (transactional email)
We do not sell personal information to third parties.
6. Data retention
We retain survey response data for as long as needed to provide the Service to the relevant customer. Authorized administrators perform periodic cleanup according to the configured retention policy (by default, audit logs are retained for 90 days).
Customers may request deletion of their organization's data at any time via Section 11.
7. Security
We use industry-standard measures including encrypted transport (HTTPS), hashed credentials, scoped access controls, and rate limiting. No method of transmission or storage is 100% secure, but we work to protect your information.
8. Cookies
We use strictly necessary cookies: a session cookie for authentication and a respondent cookie to help prevent duplicate survey submissions. We do not use advertising or third-party tracking cookies.
9. International users
The Service is operated from the United States. If you access it from outside the US, you understand that your information is processed in the US, which may have different data-protection laws than your country.
10. Children
The Service is intended for use in a professional context by adults and is not directed to children under 16. We do not knowingly collect personal information from children.
11. Contact us
For privacy questions or to exercise your rights, contact us at info@thebrandbuildingshop.com. Mailing address: The Brand Building Shop, LLC, 3105 Whitcomb St, Charlotte, NC 28269, USA.
We may update this Policy; material changes will be posted here with a new effective date.