Privacy Policy

Last updated: 22 July 2026

This policy explains what personal information we collect when you use morsbags.org, why we collect it, how we look after it, and the rights you have over it. We’ve tried to write it in plain English. If anything is unclear, please get in touch.

Who we are

Morsbags is a social enterprise and global, community-led movement for making and giving away reusable fabric bags. Morsbags (“we”, “us”) is the data controller for the personal information described here. The website is hosted and technically operated on our behalf by Widebeam Digital Ltd.

Website: https://morsbags.org
Address: Chauffeurs Cottage, Hindon Road, East Knoyle, SP3 6AA, United Kingdom
Contact for privacy questions and data requests: admin@morsbags.org, or via our contact form.

The information we collect

Account, pods and membership

If you create an account, register a pod or join one, we collect your name, email address, username, and the details you provide — such as your pod name, location and news. We keep a record of the bags your pod has made.

Shop orders and payments

When you order labels from our shop, we collect your name, billing and delivery address, email address, phone number (if given), and your order details. Payments are handled securely by our payment providers, Stripe and PayPal — we do not see or store your full card details. Shipping and tax calculations are handled through WooCommerce Shipping & Tax (Automattic).

If you sign up for our newsletter, we collect your email address (and name, if given) to send you updates. We send these using MailPoet. You can unsubscribe at any time using the link in any email.

Forum, support and comments

If you post in our community forum, raise a support request, or leave a comment, we collect the information you enter — such as your name, email, and the content of your message or post. Forum posts and comments are visible to other visitors. We may also record your IP address and browser details to help prevent spam and abuse. Comment avatars may be shown via the Gravatar service (Automattic).

Downloads and location search

When you download resources such as the bag pattern, we may record the download to understand how our resources are used. When you search the pod directory by place, your search term is sent to OpenStreetMap’s Nominatim service to turn it into a location so we can show nearby pods; the map itself is also provided by OpenStreetMap.

Jollyfish — our AI assistant

Our website offers Jollyfish, an AI chat assistant that helps you find pods, make bags, shop for labels and manage your pod. When you use it, we process:

Your messages — what you type and Jollyfish’s replies, so it can help you and so we can improve and secure the service.
Your IP address and approximate location (town, region and country) worked out from it. This location lookup is done on our own systems — your IP address is not sent to any third-party location service for this.
A random identifier stored in your browser (in local storage) so we can recognise your chats across visits and keep conversations coherent. It is not linked to your identity unless you sign in.
Your Morsbags account ID, but only if you are signed in, so Jollyfish can help with your own pods and orders.

To generate replies, your messages are sent to our AI provider, Anthropic. We use Cloudflare Turnstile to check that you’re a person and not a bot. We do not use your chats for advertising, and we do not sell them. We keep this chat data for 90 days, after which the whole conversation — including everything above — is automatically and permanently deleted.

Security and server logs

To keep the site secure, our security tools (including Wordfence and login-protection) and our hosting record technical information such as IP addresses, the pages requested, failed login attempts, and browser details, and use this to detect and block malicious activity.

Cookies and local storage

We use cookies and similar browser storage that are necessary for the site to work — for example to keep you signed in, remember your shopping basket, process orders, run the bot check, and (as described above) let the Jollyfish assistant recognise your chats. We do not use advertising, analytics or cross-site tracking cookies.

How and why we use your information

Under UK data protection law we rely on the following lawful bases:

To provide what you asked for — running your account, registering and updating pods, processing and delivering orders, answering your messages and support requests, and operating the Jollyfish assistant (performance of a contract, or our legitimate interests in running the service).
To keep the site and community safe — preventing spam, fraud and abuse, and securing the site (legitimate interests).
To send you our newsletter — only where you have signed up (consent).
To meet our legal obligations — for example keeping order and tax records (legal obligation).

Who we share it with

We do not sell your personal information. We share it only with the service providers we rely on to run the site, and only as needed:

Stripe and PayPal — payment processing.
Automattic (WooCommerce Shipping & Tax, Gravatar) — shipping/tax calculation and comment avatars.
MailPoet — sending our newsletter.
Anthropic — generating the Jollyfish assistant’s replies.
Cloudflare — the bot check (Turnstile) on the assistant.
OpenStreetMap — maps and turning your pod-search terms into locations.
Defiant, Inc. (Wordfence) — website security.
Widebeam Digital Ltd — website hosting and technical operation.

Each of these acts as our processor or as an independent controller under its own privacy policy. Some may process data outside the UK; where they do, they are required to protect it to UK standards. We may also disclose information if required by law.

How long we keep it

Jollyfish chats: 90 days, then the whole conversation is deleted.
Account, pod and membership data: for as long as your account is active, until you ask us to delete it.
Orders: for as long as needed to fulfil the order and to meet our accounting and legal obligations.
Newsletter: until you unsubscribe.
Forum posts and comments: kept while they remain useful to the community, unless you ask us to remove them.
Support requests: for as long as needed to help you and keep a reasonable record.
Security logs: for a limited period, as needed to keep the site safe.

Jollyfish and support requests

Jollyfish is the assistant you can chat with on our site. When you use it we process what you type and, to keep it working and to prevent abuse, your approximate location, your internet (IP) address, and your account id if you are signed in. These chat records are automatically deleted after 90 days. The assistant is powered by Anthropic, the makers of Claude, whose systems process the words of your conversation to write a reply; they do not use it to train their models.

If Jollyfish can’t help and you choose to raise a support ticket, we also collect the email address (and name, if you give one) you enter, your message and the conversation so far, and any order or pod you decide to attach, so that a person can help you. Support tickets are handled in our own system, hosted on Amazon Web Services in London (UK). The emails we send you about a ticket, and any replies you send back, are delivered through Resend, an email service. We keep support tickets for as long as we need them to help you and to keep a record of what was agreed. You can ask us to delete yours at any time — see “Your rights” below.

Your rights

You have the right to ask us to: give you a copy of the personal information we hold about you; correct anything that’s wrong; delete it; restrict or object to how we use it; or provide it in a portable format. Where we rely on consent (such as the newsletter), you can withdraw it at any time. If you have an account, you can also request an export or erasure of your data.

To exercise any of these, contact us at admin@morsbags.org. You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to help first.

Children

Morsbags is a family-friendly community and children are welcome to make bags, but our accounts, shop and assistant are intended for people aged 13 and over. If you believe a child has given us personal information without appropriate consent, please contact us and we’ll remove it.

Changes to this policy

We may update this policy from time to time. When we do, we’ll change the “last updated” date at the top, and for significant changes we’ll make it clear on the site.