Privacy Policy — Morbee
Last updated: September 4th 2026
Who we are
Morbee is a website builder at https://morbee.net, operated by Michael Linial, 56 Yefe Nof st Peduel, Israel. Contact: mikey.linial@morbee.net.
This policy covers two different groups of people, and the difference matters:
- Builders — people with a Morbee account who build sites, Landing pages or web apps.
- Visitors — people who use a site the builder has published. Visitors have no Morbee account and never see Morbee.
What we collect from builders
- Account details: email address and password (stored hashed, never in readable form).
- The sites you build: pages, content, uploaded images and fonts, and the settings of any integrations you configure.
- Connection credentials: when you connect an outside service such as Google or Salesforce or any other available connection, we store the access tokens that service issues us, along with the client id and secret you supplied. These are held in AWS Secrets Manager, encrypted at rest, and are used only to make the calls your site's own integrations ask for.
- Usage and error logs: requests made to our servers, retained for operating and debugging the service.
What we collect from visitors to published sites
- Whatever the site's forms ask for. A builder decides what their form collects; we process it on their behalf and pass it to wherever their integration points — their Salesforce, their Google Sheet or any other enabled database connection.
- A signing audit session, if the site includes a document to sign. It records which document was signed and a token proving it. It also audits the signer's trail including browser data, Device information, MFA verification stamp, IP address and session data.
- IP address, used to rate-limit abuse of public endpoints.
For this data, the builder is the controller and Morbee is the processor: we hold it to deliver it, and we do not use it for our own purposes.
Google user data
Morbee offers two separate Google connections. They are separate on purpose: each asks for only what it needs, and connecting one does not grant the other.
Google Sheets connection
| Permission | Why |
|---|---|
openid, email, profile | To label the connection with the account it belongs to, so you can tell several connections apart |
.../auth/spreadsheets | To read the rows and columns your integration is configured to read, and to write the rows it is configured to write |
.../auth/drive.readonly | Only to list the names of your spreadsheets, so you can pick one when setting up an integration |
- We read a spreadsheet's rows only for the sheet and tab you selected, and only when one of your integrations runs.
- We write only the values your integration maps, only into the sheet and tab you selected.
- We do not copy your Drive contents, and we do not open files other than the spreadsheet your integration names. Listing spreadsheet names is the only use of the Drive permission in this connection.
Google Drive connection
| Permission | Why |
|---|---|
openid, email, profile | To label the connection with the account it belongs to |
.../auth/drive.file | To store files in your Drive at your request, and to read back, replace or delete the files Morbee itself put there |
drive.file reaches only the files this app creates. Morbee cannot see, list, open or download anything else in your Drive — not your existing documents, not your folders, not files put there by any other app.
- Uploads go to a folder Morbee creates in your Drive, or to another folder Morbee created that you select.
- What is uploaded is what your integration maps — typically a document a visitor signed on your published site.
- You can move, rename or delete anything Morbee uploads. It is in your Drive and it is yours.
Limited Use
Morbee's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we do not use Google user data for advertising, we do not sell it, we do not transfer it to others except as needed to provide the feature you asked for or where the law requires it, and no human reads it except with your explicit permission, for security purposes, or where the law requires it.
Other connected services
The same applies to any other service you connect, such as Salesforce or any other connection enable by Morbee: we hold the credentials you authorise, and use them only to run the integrations you configure.
Who else sees your data
- Our infrastructure providers. Morbee runs on Amazon Web Services (Frankfurt, eu-central-1); credentials are held in AWS Secrets Manager.
- The services you connect, when your integrations send data to them.
- No one else. We do not sell data and we do not use it for advertising.
How long we keep it
- Sites, content and integration settings: as long as your account exists.
- Connection credentials: until you disconnect the connection or delete your account, at which point the stored tokens are deleted.
- Signing sessions: minutes to hours, per the site's setting, then deleted automatically.
- Logs: 90 days.
Your choices
- Disconnect any connection at any time from Manage connections. This removes the stored tokens, and Morbee can no longer reach that service.
- You can also revoke Morbee's access from your Google account permissions page.
- Ask us to delete your account and its data at mikey.linial@morbee.net.
- If you are in the EU or UK you have rights of access, correction, deletion, portability and objection; write to the same address.
If you are a visitor to a site built with Morbee and want your data removed, contact the owner of that site — it is theirs, and we hold it for them.
Security
Credentials are encrypted at rest in AWS Secrets Manager. Traffic runs over HTTPS. Session cookies are HttpOnly and cannot be read by page scripts. Access to production is limited to the founder.
Children
Morbee itself — i.e. the builder — is a tool for adults. You must be 18 or over to hold a Morbee account, and we do not knowingly collect data from children through it.
Sites built with Morbee are a different matter. A builder may quite legitimately run a site for a kindergarten, a school or a youth club, where the people filling in a form are parents writing about their children, or children themselves. In that case the builder decides what is asked and why, holds the relationship with those families, and is responsible for any consent the law requires. We process what their form collects on their behalf, and for no purpose of our own.
If your site collects data about children, the obligations are yours: follow whichever law applies where those families are - GDPR Article 8 in the EU, COPPA in the United States, or your local equivalent - for the consent you need before collecting it.
Changes
We will post changes here and update the date above. If a change materially affects how we handle your data, we will also email account holders before it takes effect.
Contact
mikey.linial@morbee.net — Michael Linial, 56 Yefe Nof st. Peduel, Israel.