Morsis Logo
Book a Demo

PRIVACY POLICY

MORSIS Platform

Synergy Shock LLC

Version: 1.0

Last updated: February 11th, 2026

1. Introduction

This Privacy Policy describes how Synergy Shock LLC ("Synergy Shock", "we", "us", or "our") collects, uses, stores, protects, and shares information through the MORSIS platform, including our website (morsis.com), web application, APIs, interactive kiosks, and related services (collectively, the "Platform").

MORSIS is a software-as-a-service (SaaS) platform that provides interactive kiosk solutions, point-of-sale systems, messaging integrations, and related services to businesses ("Customers").

This Policy is designed to comply with applicable data protection regulations in jurisdictions where the Platform operates, including but not limited to:

This Policy applies to:

By using the Platform, you agree to the terms of this Privacy Policy

2. Data Controller and Data Processor Roles

2.1 When We Act as Data Processor

For most data processed through the Platform, our Customers are the Data Controllers and Synergy Shock acts as a Data Processor. This includes:

In these cases, our Customers determine the purposes and means of processing. We process this data only according to our Customers' instructions and our agreements with them.

Important regarding WhatsApp/Instagram messaging: When end users communicate with a Customer's WhatsApp or Instagram account, the Customer is responsible for informing those end users that their communications are processed through the MORSIS platform and that their personal data (phone number, name, message content) will be processed by Synergy Shock LLC as a data processor. Customers must include this information in their own privacy policies and/or automated welcome messages.

2.2 Co-Controller (Interactive Kiosks)

For interactive kiosk deployments, the business where the kiosk is installed may act as a co-controller with respect to information it provides to be communicated through the System (such as product information, prices, promotions, and business hours).

2.3 When We Act as Data Controller

Synergy Shock acts as Data Controller for:

2.4 Contact Information

Synergy Shock LLC

Address: 1603 Capitol Ave Ste 415 PMB 134544, Cheyenne, Wyoming 82001, USA

Data Protection Officer (DPO):

Luciano Ganga

Email: luciano@synergyshock.com

3. Information We Do NOT Collect (Interactive Kiosks)

For interactive kiosk deployments, the System is designed to NOT collect personal data from end users. Specifically:

  1. We do not perform facial recognition or any other type of biometric identification;

  2. We do not permanently record or store images captured by the camera;

  3. We do not permanently record or store audio from interactions;

  4. We do not collect names, emails, phone numbers, ID documents, or any other personally identifiable information through kiosk interactions (unless the Customer has enabled a loyalty program with explicit user consent);

  5. We do not create individual user profiles or track specific individuals;

  6. We do not perform age, gender, or demographic estimations linked to identifiable individuals.

4. Information We Collect

4.1 Customer Account Information

When Customers register for MORSIS, we collect:

4.2 Real-Time Processing (Kiosks - No Permanent Storage)

  1. Audio: The System captures audio through the microphone to process user queries. This audio is transmitted in real-time to natural language processing servers and is not permanently stored once the query is processed;

  2. Video: The camera may capture images to detect user presence and improve interaction. These images are processed in real-time and are not permanently stored.

4.3 End User Data (Processed on Behalf of Customers)

Through our Platform, we may process the following data on behalf of our Customers:

Loyalty Program Data (when enabled by Customer with user consent):

Transaction Data:

Messaging Data (WhatsApp/Instagram Module):

Technical and Usage Data (Anonymized):

This information does not allow identification of individual users and is used exclusively to improve System operation.

Internal User Data (Customer's employees):

Note: Internal users (Customer's employees) accept this Privacy Policy when they are registered on the Platform. It is the Customer's responsibility to inform their employees about the processing of their data and ensure they have the necessary authorization before registering them on the Platform.

4.4 Website Visitor Information

When you visit morsis.com, we may collect:

5. How We Use Information

5.1 Customer Account Information

We use Customer account information to:

5.2 End User Data

We process End User data solely to provide the Platform functionality to our Customers, including:

We do not:

5.3 Messaging Data

When Customers use our WhatsApp Business or Instagram integration, we process messaging data to:

5.4 Data from Meta Platforms (WhatsApp/Instagram)

When processing messaging data through WhatsApp Business API or Instagram API:

  1. We access data only as permitted by Meta's Platform Terms and the user's permissions;

  2. We do not use data obtained from Meta about message recipients for any purpose other than providing the messaging service to our Customers;

  3. We do not sell, license, or otherwise transfer any data obtained from Meta to any third party;

  4. We comply with Meta's Developer Data Use Policy and WhatsApp Business Policy;

  5. Our Customers are responsible for obtaining proper opt-in consent from their end users before initiating WhatsApp communications;

  6. End users may opt-out of receiving messages by contacting our Customer directly or by blocking the business on WhatsApp.

For more information about how Meta processes data, please refer to:

5.5 Aggregated and Anonymized Data

Synergy Shock may use aggregated and anonymized data derived from Platform usage to improve our products and services. This includes:

This data is anonymized and does not identify individual end users. It relates solely to the functioning of the application and does not include specific personal data belonging to Customers' end users. For this anonymized data, Synergy Shock acts as Data Controller.

6. Legal Basis for Processing

Depending on the jurisdiction and type of data, we process information based on:

For End User data processed on behalf of Customers, our Customers are responsible for establishing the appropriate legal basis.

7. Data Sharing and Disclosure

7.1 Sub-processors

We use third-party service providers to help operate the Platform. Current sub-processors include:

Provider Service Location Data Processed
Google Cloud Platform Cloud infrastructure United States Aggregated usage metrics, session data
OpenAI AI/NLP processing (Realtime API) United States Text and audio sent for inference, real-time processing
Cloudflare CDN, security Global Web traffic, IP addresses, static files
Vercel Hosting Global HTTP requests, server logs
Sentry Error monitoring United States Error logs, stack traces, device metadata
Resend Email delivery United States Email addresses, email content
Meta Platforms WhatsApp/Instagram APIs United States/Global Phone numbers, usernames, message content

Note regarding OpenAI: Audio and text data sent to OpenAI for processing is retained for a maximum of 30 days for API abuse monitoring, then deleted. OpenAI does not use API data to train models.

A complete list with Data Processing Agreement links is available in the Sub-processors Annex or upon request.

7.2 Payment Processors

Payment processing is handled by third-party providers (such as Nave, Payway, or others selected by Customers). We do not store or process credit card numbers or sensitive payment data.

7.3 Other Disclosures

We may disclose information:

We do not sell, rent, or trade personal information. We do not use data obtained from Meta platforms for purposes other than providing our services to Customers.

8. International Data Transfers

Data may be transferred to and processed in countries outside your country of residence, including the United States.

We implement appropriate safeguards for international transfers, including:

9. Data Retention

9.1 Audio and Images (Kiosks)

Audio and images from kiosk interactions are not permanently stored. They are processed in real-time and discarded immediately after processing.

9.2 Customer Data

We retain Customer account data for the duration of the business relationship and for a reasonable period thereafter for legal and business purposes.

9.3 End User Data

We retain End User data according to our Customers' instructions and our agreements with them. Upon termination of a Customer relationship, we will delete or return End User data as instructed.

9.4 Messaging Data

Conversation history and messaging data are retained while the messaging module is active. Upon deactivation or contract termination, data is deleted according to Customer instructions and Meta's requirements.

9.5 Technical Logs

Technical logs are retained for the time necessary for diagnostics and troubleshooting, generally no more than ninety (90) days, and then deleted.

9.6 Aggregated Metrics

Aggregated usage metrics may be retained indefinitely given their anonymous and non-personal nature.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

You can control cookies through your browser settings. Some features may not function properly if cookies are disabled.

11. Data Security

We implement appropriate technical and organizational measures to protect data, including:

12. Your Rights

Depending on your location, you may have rights regarding your personal data, including:

Important: Since the System in its basic kiosk configuration does not collect or store identifiable personal data, these rights may be of limited application in that context. However, we will address any inquiry or request a user wishes to make.

12.1 How to Exercise Your Rights

For End Users (kiosk users, loyalty program members, WhatsApp/Instagram contacts):

You may exercise your rights by contacting either:

If you contact Synergy Shock directly, we will:

  1. Respond to your request

  2. Communicate with the relevant Customer to coordinate the response

  3. Ensure your rights are fulfilled within the timeframes established by applicable law

For Customers and Website Visitors: Contact us directly using the information below.

We will respond to requests within the timeframes established by applicable law in each jurisdiction.

13. Children's Privacy

The Platform is not directed to children under 18. Our Customers' loyalty programs are restricted to adults (18+). We do not knowingly collect personal information from children.

If features requiring personal data are implemented in the future, parental or guardian consent will be required for minor users, in accordance with applicable law in each jurisdiction.

14. Future Collection of Personal Data

If in the future we incorporate features that involve the collection of personal data (such as name, email, phone, or other identifiers), we will implement:

  1. A mechanism for prior, express, and informed consent within the System's interaction flow;

  2. Clear information about the purpose of collection and user rights;

  3. An update to this Privacy Policy.

No personal data will be collected without the user's prior consent.

15. Future Processing of Biometric or Demographic Data

In the future, the System may incorporate features that allow the processing of biometric data or the obtaining of demographic estimates from users (such as age range or perceived gender).

If such features are implemented:

  1. This Privacy Policy will be updated to describe the new processing;

  2. The informational notice located next to the device will be updated;

  3. Where required by applicable law in each jurisdiction, a mechanism for informed consent will be implemented prior to processing;

  4. Data will be processed in accordance with applicable data protection regulations.

16. Business Information Disclaimer

Any data related to products, prices, promotions, hours, or commercial operations corresponds exclusively to the business where the System is installed. Synergy Shock LLC is not responsible for such information.

17. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

We do not sell personal information.

To exercise your rights, contact us at the information below.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date.

19. Meta Platform Compliance

This Privacy Policy complies with Meta's Platform Terms, Developer Data Use Policy, and WhatsApp Business Policy. Specifically:

20. Contact Us

For questions about this Privacy Policy or to exercise your rights:

Data Protection Officer:

Luciano Ganga

Email: luciano@synergyshock.com

Synergy Shock LLC

Email: privacy@synergyshock.com

Website: https://morsis.com

21. Additional Information for Specific Jurisdictions

21.1 European Economic Area (EEA)

If you are in the EEA, you have the right to lodge a complaint with your local data protection authority.

21.2 Argentina

Processing complies with Law 25.326 (Personal Data Protection Act). The Agency for Access to Public Information (AAIP) is the supervisory authority.

21.3 Brazil

Processing complies with Lei Geral de Proteção de Dados (LGPD). Data subjects have rights under Articles 17-22 of the LGPD.

21.4 Mexico

Processing complies with the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). Data subjects have ARCO rights (Access, Rectification, Cancellation, Opposition).

21.5 Other Latin American Jurisdictions

Processing complies with applicable data protection laws in Chile (Law 19.628), Peru (Law 29.733), Colombia (Statutory Law 1581 of 2012), and other jurisdictions where the Platform operates.

By using MORSIS, you acknowledge that you have read and understood this Privacy Policy.