Scope and applicable law

This notice applies to the Morrow website, accounts, learning services, certificates, Exam practice, Markets watchlists, private Money workspaces, organisation workspaces, enquiries and paid subscriptions. Morrow handles personal information under the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and applicable amendments, including the Data (Use and Access) Act 2025.

Information we collect

• Account details: first and last name, email address and date of birth.
• Learning records: lesson progress, quiz answers, scores, course status and certificates.
• Saved preferences: the companies you add to your personal Markets watchlist.
• Private business-budget records: business or project name, planning dates and assumptions, forecast and actual entries, categories, amounts, VAT and tax-planning settings, and any notes you choose to add.
• Exam-practice information: written answers submitted for AI-generated revision feedback; attempt timestamps; and derived results such as question, rubric and provider-model versions, estimated mark, available mark, assessment-objective breakdown and confidence level.
• Organisation records: invitations, organisation name, role, membership, seat allocation and activity available to approved managers.
• Payment records where Morrow+ is purchased: subscription status, plan, renewal information and Stripe customer and subscription references. Morrow does not receive or store full card details.
• Enquiries: name, email address, organisation, enquiry type, message and later correspondence.
• Technical and security records: authentication events, session information, essential cookie values, request timestamps, errors and records reasonably needed to operate, diagnose and protect the service.

Personal budget snapshots and the student calculators described as browser-only are calculated on your device and are not saved to Morrow's database. The signed-in business-budget workspace is different: it is deliberately saved so you can return to it, and is kept private to the account owner.

Please do not include health information, criminal-offence information or other sensitive personal information in free-text enquiry fields unless Morrow has specifically asked for it and explained why it is needed.

AI exam-practice feedback

Learners may submit written exam-practice answers to receive AI-generated revision feedback. The answer text, relevant fictional case, question and assessment instructions are sent to Morrow's configured AI provider, currently OpenAI, for processing. Morrow does not intentionally include the learner's name, email address, organisation or unrelated account information in that request. Learners must not include personal, confidential or sensitive information in their answers.

Morrow currently does not save raw submitted answers, AI prompts, generated feedback or provider responses in its database. It may store the learner's user ID and the time of an attempt to prevent abuse and apply rate limits. If feedback is produced, Morrow stores a derived result record so the learner can track practice and an authorised organisation manager can view limited learning analytics. That record contains the question, rubric and provider-model versions, estimated mark, available mark, assessment-objective breakdown, confidence level and timestamp, but not the learner's answer or the narrative AI feedback. AI feedback is educational, may be inaccurate and should be checked critically. An automated AI mark is not an official CCEA or examination result.

Morrow sets the OpenAI Responses API request not to store application state for later retrieval. OpenAI's published API documentation says API inputs and outputs are not used to train its models by default unless the customer opts in, but default abuse-monitoring logs may retain customer content for up to 30 days. Shorter controls, including Modified Abuse Monitoring or Zero Data Retention, require eligibility, approval and account configuration. Morrow therefore does not promise zero provider retention unless the applicable account and agreement have been verified. Morrow does not use the answer for unrelated profiling or advertising.

For an individual who requests this feature, processing needed to provide the feedback is based on Morrow's contract with that user. Where an organisation controls an organisation learner's use of the feature, the organisation is responsible for its lawful basis and Morrow processes the answer on its documented instructions where Morrow acts as processor. Morrow relies on its legitimate interests in protecting the service for the limited attempt record, after considering the effect on users.

Children and age assurance

Accounts are available from age 13. A self-declared date of birth is used to provide age-appropriate access: under-18 users can use Learn and basic Money but cannot access Markets or analyst-style analysis. Anonymous Markets visitors make an 18-or-over declaration stored in an essential cookie. Morrow does not routinely request identity documents, use children's information for advertising or sell it.

Morrow applies data minimisation, privacy-protective defaults and age-appropriate explanations. A shorter privacy explanation for young people is available. A parent, carer or young person can contact Morrow using the details above.

School, college, university and employer access

If you join an organisation using an authorised invitation, its approved managers can see your name, membership role, lessons completed, quiz scores, course status and last learning activity. Where Morrow Exam is enabled, they can also see derived attempt counts, estimated marks and assessment-objective trends. They cannot see your raw written exam answers, narrative AI feedback, information entered into private Money tools (including business budgets), your personal Markets watchlist, date of birth, password or payment information.

The organisation will normally be a separate data controller for its decision to invite you and use progress reports. Ask it how it uses its copy of that information. Morrow remains responsible for operating the platform and for its own handling of information under this notice. Contract terms with each organisation will document the parties' roles and responsibilities before a live programme begins.

Why we use information and our lawful bases

Where Morrow relies on legitimate interests, those interests are operating a useful and secure educational service, protecting users and Morrow, administering programmes and improving the service. Morrow considers necessity and balances these interests against your rights. You can object as explained below.

Morrow does not currently send direct-marketing emails. If that changes, Morrow will explain the lawful basis and provide an easy opt-out.

Where information comes from

Most information comes directly from you when you register, learn, update an account, join an organisation or enquire. Learning, subscription and security records are created as you use the service. An organisation may provide your email address and intended role when it creates an invitation. Stripe supplies payment and subscription status after paid launch. Morrow does not buy personal profiles or enrich learner accounts with data from brokers or social networks.

Who receives information

Morrow shares only what is necessary with:

• Supabase, for authentication, database storage and account administration.
• Netlify, for production hosting, delivery, logs and service security.
• Resend, for sending website-enquiry notifications, and Zoho Mail, where Morrow receives and answers those messages.
• Stripe, where payments are enabled, for checkout, subscriptions, fraud prevention and payment administration.
• OpenAI, when AI exam feedback is requested, to process the learner's written practice answer and generate formative feedback. Its legal role and processing terms depend on Morrow's applicable provider agreement and configuration.
• Your school, college, university, employer or other organisation, if you accept its invitation, as described above.
• Professional advisers, insurers, regulators, courts, law enforcement or public authorities where reasonably necessary or legally required.
• A buyer or successor if Morrow is reorganised, sold or transferred, subject to confidentiality and data-protection requirements.

Morrow does not sell personal information.

International transfers

Some providers may process information outside the UK. Where UK adequacy regulations do not cover a destination, Morrow requires an applicable safeguard, such as the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or another lawful transfer mechanism, together with any risk assessment and supplementary measures required. You may ask for more information about relevant safeguards through the privacy enquiry form.

How long we keep information

• Account, learning, organisation membership and certificate records: while the account is active, unless a longer period is needed to provide a verifiable certificate or meet a legal requirement.
• Personal Markets watchlist: until you remove a company or delete your account.
• Private business-budget records: until you delete individual entries or your account. A downloaded CSV copy is controlled by you and is not deleted from your device by Morrow.
• Unused or expired organisation invitations: deleted or anonymised when no longer needed to administer and secure the programme.
• Enquiries and correspondence: normally up to 24 months after the last substantive contact.
• Payment, invoice and transaction records: normally up to six years after the relevant financial year or longer if required for tax, disputes or fraud prevention.
• Security and diagnostic records: only for the period reasonably needed to investigate, protect and maintain the service.
• AI exam-practice content: raw answers, prompts, generated feedback and provider responses are not currently persisted in Morrow's database. AI-attempt user IDs and timestamps are retained for a limited period for abuse and rate-limit control. Keyed fingerprints are used to prevent duplicate submissions without retaining your written answer. These fingerprints are private to the service and retained while the associated learning history is retained. Derived mark, assessment-objective, question-version, rubric-version, provider-model, confidence and timestamp records form part of learning history and are retained under the account, learning and organisation rules above.

Account deletion removes associated information from the active service, subject to legal exceptions and the certificate choice explained at deletion. Residual encrypted backups are isolated from normal use and expire on the relevant provider's backup cycle. Morrow may retain minimal suppression or legal-claim records where necessary.

Cookies and similar technologies

Morrow currently uses cookies required for authentication, security and the Markets age declaration. It does not currently use advertising or optional analytics cookies. See the Cookie Policy for details and controls.

Automated decisions and profiling

Morrow uses the date of birth or adult declaration to apply access rules, uses quiz answers to calculate learning scores and can use AI to generate formative exam-practice feedback. AI feedback may be inaccurate and is not an official examination result. These functions do not make solely automated decisions that produce legal or similarly significant effects. Morrow does not profile users for targeted advertising.

Your data-protection rights

Depending on the circumstances, you may have rights to be informed; access a copy; correct inaccurate information; erase information; restrict or object to processing; receive portable information; and challenge qualifying automated decisions. You may withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful processing. Some rights have legal exceptions.

You can update details or delete your account through Account Settings, email privacy@morrowfinance.co.uk, or use the privacy enquiry form. Morrow may need to verify your identity and will normally respond within one month. Rights requests are ordinarily free.

Complaints

Please contact Morrow first so the concern can be investigated. Morrow will acknowledge a data-protection complaint within 30 days of receiving it, make appropriate enquiries, keep you informed of progress and communicate the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or telephone 0303 123 1113.

Whether you must provide information

Name, email address, date of birth and a password are needed to create and secure an account and provide age-appropriate access. Without them, Morrow cannot provide an account. Information required at checkout is needed to enter and administer a paid subscription. Enquiries are optional, but a name, reply address and meaningful message are needed for a response. Organisation data is needed only if you use an organisation workspace.

Security and personal-data breaches

Morrow uses access controls, row-level database security, protected server credentials, encrypted connections, owner-scoped database policies, restricted administrative access and service monitoring. Private business budgets and personal watchlists are not included in organisation reporting. No online service can promise absolute security. If a personal-data breach requires notification, Morrow will notify the ICO and affected people within the periods required by law.

Changes to this notice

Morrow will update this notice when its services, providers or legal obligations change. The date above shows the latest revision. Material changes will be highlighted on the website or communicated directly where appropriate. Earlier versions may be requested using the privacy contact details.