Terms and Conditions & Privacy Policy

Terms and Conditions

1. Parties, Website, and Acceptance of Terms

These Terms and Conditions (“Terms”) are entered into by and between Morning Star AI Group LLC, a Washington limited liability company (“Company,” “we,” “us,” or “our”), and each person who accesses or uses the website located at https://morningstaraigroup.com/ (the “Website”).

These Terms are effective as of August 8, 2026 (the “Effective Date”). By accessing, browsing, or using the Website, you acknowledge that you have read, understood, and agree to be bound by these Terms and all applicable laws and regulations.

If you do not agree to these Terms, you must not access or use the Website. If you access or use the Website on behalf of an entity, you represent and warrant that you have authority to bind that entity to these Terms, and in that case “you” and “your” refer to both you and that entity.

These Terms govern the Website only. Section 3 explains what governs your use of Bearing and Cadence itself if your organization is a subscribing Customer.

2. What This Website Is — and Isn't — For

This section states our intent in plain language. The detailed sections that follow implement it; nothing later in these Terms is intended to narrow it.

2.1 What You Can Do Here

• Learn about Morning Star AI Group and Bearing and Cadence, our field-intelligence and client-communication platform.
• Read our published policies, blog content, and marketing materials.
• Contact us, request information, or book a call about our software, consulting, and implementation services.

2.2 What You Can't Do Here

• Access non-public parts of our systems, scrape or data-mine the site, or interfere with its operation (§6).
• Use the Website, or anything on it, for a purpose competitive with our business.
• Treat anything on the Website — including AI-generated content — as legal, financial, real estate, engineering advice (§8, §11).
• Treat these Terms as your contract for paid access to Bearing and Cadence. That's a separate agreement — see §3.

3. Scope: This Website vs. the Bearing or Cadence Platform

These Terms govern only your use of this public marketing Website. They do not, by themselves, grant any right to access or use Bearing or Cadence.

If your organization subscribes to Bearing or Cadence, that use is governed by a separate written agreement between the Company and your organization — a Master Subscription Agreement or Pilot Agreement, as applicable — together with the parties' Data Processing Agreement covering personal information processed through the platform. Those agreements, not this document, control billing, service levels, data handling commitments, warranties, and liability for the Bearing or Cadence platform itself.

If a provision of these Terms conflicts with a provision of an executed subscription agreement, pilot agreement, or Data Processing Agreement as applied to Bearing or Cadence, that executed agreement controls.

4. Eligibility and Compliance with Law

You may use the Website only if you have the legal capacity to enter into a binding agreement under applicable law. By accessing or using the Website, you represent and warrant that you meet this requirement and that your use of the Website will not violate any applicable law, regulation, court order, or enforceable governmental requirement.

You are responsible for ensuring that your access to and use of the Website, including any content you submit, request you make, or activity you conduct through the Website, complies with all laws and regulations applicable to you and your jurisdiction. You must not use the Website in any manner that is fraudulent, deceptive, abusive, unlawful, or otherwise inconsistent with these Terms.

5. Permitted Use

Subject to these Terms, you may use the Website only for legitimate business, informational, and other lawful purposes related to the Website's stated functions in §2. You may access and use the Website solely in a manner consistent with these Terms, any instructions or policies posted on the Website, and all applicable local, state, federal, and international laws, rules, and regulations.

No right is granted to use the Website for any purpose that is competitive with, harmful to, or inconsistent with the intended operation of the Website, or to use any information, materials, or functionality made available through the Website except as expressly permitted by these Terms.

6. Prohibited Conduct

You shall not, and shall not attempt to, use the Website in any way that could damage, disable, overburden, impair, or interfere with the operation, security, or availability of the Website or any related systems, networks, or services, including to:

• Access or attempt to access any non-public area of the Website, server, account, database, or related system without authorization;
• Circumvent, defeat, disable, or otherwise interfere with any security feature, access control measure, authentication mechanism, or technical restriction of the Website;
• Use any robot, spider, scraper, crawler, data-mining tool, automated script, or similar means to access, monitor, copy, extract, index, or harvest content or data from the Website, except to the limited extent expressly permitted by standard search engine indexing practices or by the Company's prior written consent;
• Introduce, transmit, or make available any virus, worm, malware, Trojan horse, corrupted file, malicious code, or other harmful or destructive technology;
• Engage in any activity that disrupts or interferes with another user's access to or use of the Website, or that places an unreasonable or disproportionate burden on the Website infrastructure;
• Copy, reproduce, distribute, modify, create derivative works from, publicly display, publicly perform, republish, sell, license, or exploit any portion of the Website or its content except as expressly allowed by these Terms or applicable law;
• Use the Website to infringe, misappropriate, or violate the intellectual property, privacy, publicity, confidentiality, or other rights of any person or entity;
• Submit, post, transmit, or otherwise use the Website to distribute any unlawful, defamatory, harassing, obscene, deceptive, or fraudulent material;
• Misrepresent your identity, affiliation, or authority, or impersonate any other person or entity; or
• Use the Website or any content, information, or output from the Website for any unlawful purpose or in violation of these Terms.

Any use of the Website that violates this Section is prohibited and may result in suspension or termination of access, in addition to any other remedies available at law or in equity.

7. Intellectual Property Rights

The Website and all content, features, functionality, text, graphics, logos, icons, images, audio, video, software, code, compilations, designs, layouts, and other materials made available through the Website are owned by or licensed to the Company and are protected by applicable United States and international intellectual property, proprietary rights, and unfair competition laws.

Subject to these Terms, users are granted a limited, revocable, non-exclusive, non-transferable right to access and use the Website solely for lawful personal or internal business purposes related to the Website's intended functions. No ownership interest is transferred to any user by virtue of access to or use of the Website.

Except for the limited right of use expressly stated in these Terms, no license or other right is granted, whether by implication, estoppel, waiver, or otherwise, under any copyright, trademark, trade secret, patent, or other intellectual property right of the Company or its licensors. All rights not expressly granted are reserved.

Users may not copy, reproduce, modify, distribute, publish, display, perform, transmit, create derivative works from, reverse engineer, decompile, extract, repurpose, or commercially exploit any portion of the Website or its content except as expressly permitted in writing by the Company or as allowed by mandatory applicable law.

8. AI-Generated Content and Outputs

Portions of the Website, and portions of Bearing or Cadence referenced or previewed through the Website, may display or describe content generated in whole or in part by artificial intelligence tools — for example, summaries, risk indicators, sentiment digests, and drafted client communications.

AI-generated content is provided for informational and drafting-assistance purposes only. It may be incomplete, outdated, or inaccurate, and it does not constitute legal, financial, real estate, engineering or other professional advice. AI-generated content is not independently verified by the Company before display unless expressly stated otherwise.

Any AI-drafted output intended for use outside the platform — including a drafted client communication, dispute letter, or similar document — is a starting draft only. It must be reviewed and approved by a qualified human before being relied upon, sent to a third party, or used to make a decision. This reflects how the Company builds and operates Bearing and Cadence, and it is a condition of using any AI-assisted feature, not a mere suggestion.

The Company disclaims responsibility for actions taken in reliance on AI-generated content that has not been reviewed as described above.

9. Third-Party Links and External Services

The Website may contain links to third-party websites, applications, platforms, tools, content, products, or services, or may enable access to external services that are not owned, operated, or controlled by the Company.

Any such links or integrations are provided solely for convenience and informational purposes. The inclusion of a link or reference does not constitute or imply any endorsement, sponsorship, affiliation, approval, investigation, or verification of any third party or any third-party content, goods, or services.

The Company does not control and is not responsible for the availability, accuracy, legality, security, privacy practices, content, policies, products, services, or performance of any third-party website or external service. Access to and use of any third-party website or service is solely at the user's own risk and is subject to the terms and policies of that third party.

The Company shall not be liable for any loss, damage, cost, or claim arising out of or related to a user's access to, use of, reliance on, or transactions with any third-party website or external service, including any purchase, communication, data sharing, or dispute involving such third party.

10. Relationship to Our Privacy Policy

Your use of the Website is also governed by our Privacy Policy, which describes how we collect, use, disclose, and protect personal information and is incorporated into these Terms by reference. Where Bearing or Cadence are concerned, the Data Processing Agreement referenced in §3 governs Customer-instructed processing of personal information; the Privacy Policy governs our own collection and use as described in that policy.

11. Disclaimers

To the fullest extent permitted by applicable law, the Website and all content, features, functionality, information, and services made available through it are provided on an “as is” and “as available” basis.

The Company disclaims all warranties, representations, and conditions of any kind, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, completeness, reliability, quiet enjoyment, and any warranties arising out of course of dealing, usage, or trade practice.

Without limiting the foregoing, the Company does not warrant that the Website will be available at any particular time or location, will operate without interruption, delay, error, or defect, will be secure, will be free of viruses or other harmful components, or that any content on the Website — including AI-generated content described in §8 — will be accurate, complete, current, useful, or suitable for any user's specific needs or intended results.

Any reliance on the Website or on any content or materials made available through the Website is at the user's own risk. The Company may change, suspend, remove, or discontinue any part of the Website at any time without notice and without any warranty or obligation to continue making the Website available.

12. Limitation of Liability

To the fullest extent permitted by applicable law, the Company and its owners, managers, members, officers, employees, contractors, agents, affiliates, licensors, and service providers shall not be liable for any indirect, incidental, consequential, special, exemplary, punitive, or enhanced damages arising out of or relating to the Website or these Terms, including damages for lost profits, lost revenues, lost business opportunities, loss of data, business interruption, loss of goodwill, or procurement of substitute services, whether based in contract, tort, negligence, strict liability, or any other legal theory, even if advised of the possibility of such damages.

To the fullest extent permitted by applicable law, the aggregate liability of the Company and its related parties for any and all claims arising out of or relating to the Website or these Terms shall not exceed the greater of (a) the amount, if any, paid by the user to the Company specifically for access to or use of the Website during the twelve-month period immediately preceding the event giving rise to the claim, or (b) one hundred U.S. dollars (USD 100.00). This cap applies to use of the Website itself; it does not apply to, and is not intended to limit, liability under a separate executed subscription agreement, pilot agreement, or paid services engagement, which state their own liability terms.

The limitations of liability in this clause apply regardless of whether any remedy fails of its essential purpose and form an essential basis of the bargain between the user and the Company. Nothing in these Terms excludes or limits liability to the extent such exclusion or limitation is prohibited by applicable law.

13. Indemnification

You agree to defend, indemnify, and hold harmless the Company and its affiliates, managers, members, officers, employees, agents, licensors, and service providers from and against any claims, demands, actions, proceedings, liabilities, damages, judgments, awards, losses, costs, and expenses, including reasonable attorneys' fees, arising out of or relating to your access to or use of the Website, your violation of these Terms, your misuse of the Website, your violation of any applicable law or regulation, or your infringement or misappropriation of any intellectual property, privacy, publicity, confidentiality, or other rights of any person or entity.

This indemnification obligation includes claims arising from any content, data, information, submissions, communications, or materials that you post, transmit, upload, or otherwise make available through the Website, as well as any unauthorized use of accounts, systems, or networks connected to the Website by you or through your devices or credentials.

The Company reserves the right, at its own expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you, and you agree to cooperate fully with the Company in the defense or settlement of that matter. You may not settle any covered claim without the Company's prior written consent if the settlement imposes any obligation on, or includes any admission by, the Company.

14. Suspension and Termination of Access

The Company may, in its sole discretion and without prior notice where permitted by law, suspend, restrict, disable, or terminate your access to all or any part of the Website if the Company believes that you have violated these Terms, used the Website in an unauthorized, unlawful, abusive, or harmful manner, created a security or operational risk, interfered with the rights or use of others, or if suspension or termination is reasonably necessary to protect the Website, the Company, its systems, its business, or other users.

The Company may also suspend, restrict, or terminate access to comply with applicable law, regulation, court order, governmental request, subpoena, or internal policy, or to investigate suspected misconduct, fraud, infringement, or technical issues affecting the Website.

Any suspension, restriction, or termination may be temporary or permanent and may include removal of access to content, features, or related services. The Company will not be liable to you or any third party for any suspension, restriction, termination, or resulting loss of access, functionality, or data, except as required by applicable law.

Upon termination, your right to use the Website will immediately cease, but any provisions of these Terms that by their nature should survive termination will remain in effect, including provisions concerning intellectual property, AI-generated content, disclaimers, limitations of liability, indemnification, governing law, and dispute venue.

15. Changes to Terms

The Company may revise, update, or modify these Terms from time to time in its sole discretion to reflect changes in the Website, applicable law, business practices, or risk management requirements. Any revised version will be posted on the Website with an updated “Last Revised” date and will become effective as of the updated effective date stated in the revised Terms, unless a later effective date is expressly stated.

By continuing to access or use the Website after revised Terms become effective, you agree to be bound by the updated Terms. If you do not agree to the revised Terms, you must stop using the Website immediately upon the effective date of the changes.

The Company is not obligated to provide individualized notice of every revision unless required by applicable law, and you are responsible for reviewing these Terms periodically for updates.

16. Governing Law and Dispute Venue

These Terms, and any dispute, claim, or controversy arising out of or relating to the Website or these Terms, will be governed by and construed in accordance with the laws of the State of Washington, without regard to its conflict of laws principles.

To the extent permitted by applicable law, the state and federal courts located in Washington will have exclusive jurisdiction over any action or proceeding arising out of or relating to the Website or these Terms, and each party irrevocably submits to the personal jurisdiction and venue of those courts and waives any objection based on inconvenient forum or improper venue.

Because the Website is available nationwide, nothing in this section is intended to displace any consumer-protection or other right under the law of your home jurisdiction that cannot be waived by contract.

17. Notices and Contact Information

These Terms are provided by Morning Star AI Group LLC. Users may contact the Company regarding the Website or these Terms by email at eric@morningstaraigroup.com.

Any legal notice, demand, or other formal communication relating to the Website or these Terms must be sent to Morning Star AI Group LLC at 305 East 1st Street, #1237, Cle Elum, WA 98922 and, if available, by email to eric@morningstaraigroup.com. Notices to the Company will be effective when actually received.

Users are responsible for providing complete and accurate contact information in any communication sent under these Terms. The Company may use the contact information provided by a user to respond to inquiries, provide service-related communications, address alleged violations of these Terms, or deliver other notices permitted by applicable law.

18. Entire Agreement

These Terms constitute the entire agreement between the user and the Company with respect to the user's access to and use of the Website and supersede all prior or contemporaneous understandings, communications, proposals, and agreements, whether electronic, oral, or written, relating to that subject matter.

This entire-agreement clause applies only to use of the Website. It does not apply to, and is not intended to supersede, any separate executed subscription agreement, pilot agreement, order form, statement of work, or Data Processing Agreement between the Company and a Bearing or Cadence Customer, each of which is governed by its own entire-agreement provision.

No course of dealing, course of performance, trade practice, or informal statement will modify or supplement these Terms unless the Company expressly adopts that modification in a written or electronic update made available through authorized channels.

19. Severability and Waiver

If any provision of these Terms is held to be invalid, illegal, unenforceable, or incapable of being enforced to its full extent, that provision will be interpreted to the maximum extent permitted by law and the remaining provisions will remain in full force and effect.

No waiver of any provision of these Terms, and no failure or delay in exercising any right, remedy, or privilege under these Terms, will operate as a waiver of that provision or of any other provision. Any waiver must be clear, intentional, and made in writing by an authorized representative of the Company.

A single or partial exercise of any right or remedy under these Terms will not prevent any further exercise of that right or remedy or the exercise of any other right or remedy.

Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Morning Star AI Group LLC, a Washington limited liability company (“Morning Star,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information in connection with Bearing and Cadence, and our marketing website at morningstaraigroup.com (together, the “Services”).

Bearing and Cadence sits on top of a subscribing company's existing operations to capture day-by-day, litigation-grade records of a project — daily logs, photos, voice-memo transcriptions, and jobsite communications — and to give that company's clients transparent, ongoing visibility into their build.

1.1 Two Categories of Individuals This Policy Covers

Bearing and Cadence's data flows are not symmetrical, and this policy is written to reflect that:

• Direct users — the staff, superintendents, and administrators of a subscribing company (“Customer”) who create accounts, log into Bearing and Cadence, and enter data. For direct users, and for visitors to our marketing website, Morning Star acts as the business/controller with respect to their own account and usage data.
• Represented individuals — the homeowners and other clients of a Customer, whose information (contact details, family information, jobsite communications, etc.) is entered into Bearing and Cadence by the Customer's staff, not by the individual directly. For represented individuals' data, Morning Star acts primarily as a service provider/processor on behalf of the Customer, who determines what information is collected and why. Requests from represented individuals are honored consistent with our obligations to the Customer and applicable law, as described in §11.

This distinction matters throughout this policy and is central to how we route privacy rights requests.

Our relationship with each Customer regarding Customer-instructed processing of represented individuals' data is further governed by a separate Data Processing Agreement between Morning Star and that Customer. If a conflict arises between this policy and a Customer's Data Processing Agreement as to that Customer-instructed processing, the Data Processing Agreement controls.

Questions about this Privacy Policy may be directed to info@morningstaraigroup.com.

2. Our Data Practices at a Glance

This section states our commitments in plain language. The detailed sections that follow implement these commitments; nothing later in this policy is intended to narrow them.

2.1 What We Do

• We collect only the information reasonably necessary to operate Bearing and Cadence's daily-log and jobsite-documentation features, run our marketing website, and support our customers.
• We enforce tenant data isolation at the database level: one subscribing company's data is never visible to another.
• We restrict the most sensitive client data (family and personal details) to company administrators only, enforced on the server — not just hidden in the interface.
• We make certain jobsite records tamper-evident and immutable once created, using database-level controls, because the reliability of that record is the reason customers use Bearing and Cadence.
• We use a limited set of named subprocessors, under contract, to host, store, and process data on our behalf (§6).
• We apply the privacy rights described in §11 to every user, in every U.S. state, regardless of where you or the applicable law would otherwise require it.

2.2 What We Don't Do

• We do not sell personal information.
• We do not share personal information for cross-context behavioral or targeted advertising, except through the LinkedIn Insight Tag on our marketing website, and only if you opt in (§7).
• We do not build advertising profiles, and we do not combine a Customer's client data with any other Customer's data.
• We do not permit our AI subprocessors to use Customer data to train their own general-purpose models outside the scope of providing the Service to us.
• We do not collect personal information directly from children, and Bearing and Cadence is not directed at children.
• We do not use session-replay tooling. On our marketing website we use cookieless Cloudflare Web Analytics to count visits in aggregate, and the only ad-tracking technology we use is the opt-in LinkedIn Insight Tag; neither is used in Cadence or Bearing (§7).

3. Definitions

• “Personal information” means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual or household. It does not include de-identified or aggregated information.
• “Sensitive personal information” means the subset of personal information subject to heightened protection under applicable law, including precise geolocation, as described in §8.
• “Customer” means the company or professional-services firm that subscribes to Bearing and Cadence.
• “Represented individual” means a homeowner, client, or other third party whose information a Customer enters into Bearing and Cadence, as described in §1.1.
• “Immutable record” means a jobsite log entry, photo, transcription, or audit-trail entry that, once created, cannot be altered or deleted through the application — only appended to — by database-enforced design (§13).
• “Service provider” or “subprocessor” means a third party that processes personal information on our behalf and under our instructions, as listed in §6.

4. Information We Collect

4.1 Information Collected on the Marketing Website

• Contact and inquiry information you provide: name, email, phone number, and company name, when you contact us, book a call, or subscribe to updates.
• Standard technical data collected automatically: browser type and general device and usage information, governed by §7.

4.2 Information Collected Through Bearing and Cadence

Bearing and Cadence organizes client/customer profile information into three access tiers. All tiers are entered by a Customer's staff about the Customer's own clients, not self-reported by the represented individual.

4.2.1 Tier 1 — Core Identity and Contact (visible to all Customer staff/admins)

• Preferred name or nickname, separate from legal name
• Jobsite address and a separate mailing address
• Primary and secondary phone numbers and email addresses, each labeled by type
• Social media profile URLs (LinkedIn, Instagram, Facebook), where provided

4.2.2 Tier 2 — Relationship Context (visible to all Customer staff/admins)

• Referral source
• Occupation or employer
• Team-authored communication preference notes and free-text relationship notes

4.2.3 Tier 3 — Family and Personal Data (Customer company-admin only)

• Spouse or partner name
• Names and ages of children
• Anniversary and other significant dates

Tier 3 data is redacted at the server for any role below company admin — on both read and write requests — and is entered only where a Customer has affirmatively chosen to use this optional feature.

4.2.4 Account and Platform Data

• Staff/admin account information: name, email, role, and company/office assignment
• Session and authentication data

4.2.5 Field and Jobsite Data

• Daily logs and related written entries
• Voice memos, captured via device microphone and transcribed through our subprocessor OpenAI (Whisper)
• Photographs, captured or selected on-device and stored through our subprocessor Cloudflare (R2)
• Precise GPS coordinates, captured at the moment a field user creates a daily log entry, used to verify the entry was made on-site (see §8)

4.2.6 Support and Audit Data

• Support ticket content, including optional screenshots and the page URL where the ticket was filed
• System audit-trail and chain-of-custody logs, generated automatically whenever a record is viewed, edited, or locked

4.2.7 Automatically Collected Technical Data

• Server-side request logs: IP address, timestamps, and endpoints accessed, retained on a 90-day rolling basis
• Session cookies necessary to keep a logged-in user signed in

4.3 Information Generated by the System

Some information is not collected from a person but generated by Bearing and Cadence from the data above: risk scores, sentiment digests, and AI-drafted communications, produced through our subprocessor Anthropic (Claude API). This is processing of personal information and is described further in §5 and §6.

4.4 Sources We Do Not Use

We do not purchase or receive personal information from data brokers, analytics vendors, marketing partners, or other third-party sources. All personal information we hold is either entered directly by a user or a Customer, or generated by our own systems as described above.

5. How We Use Information

We use personal information only for the following purposes:

• To perform the Service: delivering daily logs, jobsite records, and client-facing features for the subscribing Customer.
• To maintain and improve Bearing and Cadence, including debugging and error resolution using server and application logs.
• To maintain security and detect misuse: the audit-trail logging that underlies our litigation-grade record-keeping, and the ongoing detection and remediation of cross-tenant access issues, unauthorized-access attempts, and similar risks.
• To provide customer support, including reviewing support tickets and any screenshots or page context submitted with them.
• To handle authentication and session management.
• To verify the origin of field records — GPS verification of log entries and enforcement of record immutability.
• To conduct internal research and development on our own systems, using aggregated or de-identified data where feasible. Where we use AI-derived outputs (such as risk scores) for a purpose beyond serving that output back to the Customer that generated it, we treat that as a distinct purpose requiring its own disclosure, not an extension of “performing the Service.”

Where we represent that data has been de-identified or aggregated, we commit to maintain and use it only in that de-identified form, to not attempt to re-identify it, and to contractually require the same of any recipient of that data.

• To comply with legal obligations and to establish, exercise, or defend legal claims.

Apart from the opt-in LinkedIn Insight Tag on our marketing website (§7), we do not use personal information for cross-context behavioral advertising, and we do not build consumer profiles across unrelated businesses. Each Customer's client data remains scoped to that Customer at the database level — an enforced technical boundary, not only a policy commitment.

6. How We Share Information

6.1 Subprocessors

We share personal information with the following subprocessors, each of which processes data solely on our behalf and under contractual confidentiality and security obligations:

• Render — application and database hosting, including our production PostgreSQL database.
• Cloudflare (R2) — object storage for uploaded photos and related files.
• OpenAI (Whisper API) — transcription of voice-memo daily log entries.
• Anthropic (Claude API) — generation of risk scores, sentiment digests, and AI-drafted communications from Customer and jobsite data.

We require our subprocessors, by contract, not to use personal information for any purpose other than providing services to us, and not to use it to train their own general-purpose models outside that scope.

6.2 Categories We Do Not Share With

• Data brokers or list-resale companies
• Advertising or ad-technology networks, except LinkedIn, and only for marketing-website visitors who opt in (§7). Customer data is never shared with any advertising network.
• Analytics providers, except Cloudflare, which provides cookieless, aggregate visit counts for our marketing website only (§7). Customer data is never shared with an analytics provider.
• Social media platforms (social URLs on client profiles are staff-entered references, not data pushed to those platforms)

6.3 Other Disclosures

• Legal and regulatory disclosure, where required by law, subpoena, court order, or to protect the rights, property, or safety of Morning Star, our users, or others.
• Business transfers, in connection with a merger, acquisition, financing, reorganization, or sale of assets, including during due diligence, subject to confidentiality obligations and this policy's continued application to any transferred data.
• Affiliates, professional advisors, auditors, and insurers, where reasonably necessary for internal administration, compliance, or protection of our rights.

We do not sell personal information. We share personal information for targeted advertising only through the LinkedIn Insight Tag, only for marketing-website visitors who opt in, and never from Cadence, Bearing, or Customer data.

7. Cookies and Tracking Technologies

7.1 Marketing Website

• Strictly necessary cookies, required for core site functionality (e.g., session and security tokens). These cannot be disabled without affecting site function.
• The LinkedIn Insight Tag, an advertising pixel provided by LinkedIn, loads only if you turn on Targeting & Advertising on our Cookie Preferences page. It is off by default. When active, it sets LinkedIn cookies and sends LinkedIn the page viewed, IP address, browser and device details, and visit time, so LinkedIn can measure our ad campaigns (including Fragmentation Score completions and inquiry submissions), let us show our ads on LinkedIn to past visitors, and give us aggregated, de-identified audience reports. LinkedIn does not identify individual visitors to us, and processes this information under the LinkedIn Privacy Policy.
• Cloudflare Web Analytics, a cookieless tool that counts page views and visits in aggregate. It sets no cookies, does not use local storage, and does not identify or track individual visitors across sites; Cloudflare processes basic request data (such as the page viewed, referring site, and browser type) under the Cloudflare Privacy Policy.
• No analytics or functional cookies, and no other pixels or third-party SDKs, are active.
• If we change these technologies, we will update this policy and honor any preference already recorded.
• Cookie preferences are stored in your browser's local storage; this is a functional storage mechanism, not a tracking cookie.

7.2 Bearing and Cadence Application

• Session and authentication cookies, required to keep a logged-in user signed in. Disabling these will prevent you from remaining signed in.
• No analytics, advertising, or third-party tracking SDKs are in use.
• Server-side request logs (timestamps, endpoints, IP addresses), retained on a 90-day rolling basis, function as infrastructure logging rather than a tracking technology, but are disclosed here for completeness.

7.3 Your Choices

You may control cookies through your browser or device settings, or through our Cookie Preferences page, where turning off Targeting & Advertising stops the LinkedIn Insight Tag from loading on your next page view. You can also opt out of LinkedIn ad retargeting in your LinkedIn ad settings. Disabling strictly necessary cookies may prevent parts of the Services from functioning, including staying signed in to Bearing and Cadence.

7.4 Global Privacy Control and Similar Signals

Some browsers and browser extensions send an automated opt-out preference signal, such as Global Privacy Control (GPC). We honor a validly transmitted GPC signal on our marketing website as a request to opt out of sale, sharing, and targeted advertising for that browser: when we detect it, the LinkedIn Insight Tag does not load, even if Targeting & Advertising was previously turned on. We do not currently respond differently to the general, non-standardized “Do Not Track” browser header, because no consistent legal or technical standard governs it.

8. Sensitive Personal Information

We collect one category of sensitive personal information as defined under applicable state privacy laws: precise geolocation data, captured at the moment a field user creates a daily log entry, used solely to verify that the entry was made on-site.

We limit our use of this data to that verification purpose, which is a use reasonably necessary and proportionate to provide the Service the Customer requested — the category of use that does not require separate opt-in consent under applicable state frameworks, though we disclose it here affirmatively. We do not use precise geolocation for any advertising, profiling, or secondary purpose. Where applicable law grants a right to limit the use of sensitive personal information, we already limit our use to this purpose by default; no further action from you is required, though you may still submit a request under §11.

We do not collect: Social Security numbers, government identification numbers, or financial account numbers; health or medical information; biometric or facial-recognition data (photographs are stored but not processed for biometric identification); or racial, ethnic, religious, sexual-orientation, or immigration-status data.

9. Data Retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy. Retention periods differ by data category because Bearing and Cadence's core value — a tamper-evident, litigation-grade record — depends on certain records being kept longer, and being unalterable once created. The table below is both our public disclosure and our internal retention schedule.

You may request deletion of deletable categories by contacting us at info@morningstaraigroup.com or, for represented individuals, through the subscribing Customer. See §13 for the limits that apply to immutable records.

10. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including:

10.1 Access Control and Tenant Isolation

• Company-scoped data access enforced on the server for every relevant endpoint, checking the company boundary before any role-based access rule.
• Server-side gating of the entire administrative area, not reliant on interface-level hiding.
• Server-side redaction of Tier 3 sensitive profile data for any role below company admin, on both reads and writes.

10.2 Data Integrity

• Database-level enforcement of record immutability for jobsite logs, described further in §13.
• Automatic audit-trail and chain-of-custody logging of record views and edits.

10.3 Storage Security

• File storage using short-lived signed URLs rather than public access.

10.4 Application Security

• Cross-site request forgery protections on state-changing actions.
• Ongoing security review and remediation of cross-tenant access risks, including access-control and authorization testing as a standing practice rather than a one-time audit.
• Rate limiting on resource-intensive operations; sanitized error messages that do not leak internal details to end users.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will notify affected Customers and, where legally required, affected individuals and regulators, consistent with applicable breach-notification law.

11. Your Privacy Rights

Consistent with our commitment in §2 to apply the most protective available standard uniformly, every user of the Services — regardless of state of residence — has the following rights with respect to their personal information:

11.1 How to Exercise These Rights

Direct users (Customer staff/admins) and marketing-site contacts may submit a request to info@morningstaraigroup.com. We will take reasonable steps to verify your identity before processing a request.

Represented individuals (a Customer's clients) whose information appears in Bearing and Cadence should, in the first instance, direct requests to the subscribing Customer, who controls that data and determines how it is used. If you contact us directly, we will forward your request to the relevant Customer and provide reasonable assistance, consistent with our role as a service provider for that data.

You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide written proof of authorization, and we may still require you to separately verify your own identity directly with us before we complete the request.

11.2 Marketing Communications

You may opt out of marketing emails at any time using the unsubscribe link in any such email, or by contacting us directly. Opting out of marketing messages does not affect service-related, transactional, or security communications, which are necessary to operate your account.

12. State-Specific Disclosures

Because we apply a uniform, nationwide standard, the rights and disclosures in §11 already meet or exceed the specific requirements of the California Consumer Privacy Act (as amended by the CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, and comparable state privacy statutes. This section restates the categories those laws specifically require us to disclose.

12.1 Categories of Personal Information Collected, Used, and Disclosed (Preceding 12 Months)

Identifiers; contact information; account and professional information; sensitive personal information (precise geolocation only, §8); internet or network activity information; and, where entered by a Customer, family/relationship information (Tier 3, §4.2.3).

12.2 Categories of Recipients

The subprocessors listed in §6.1; LinkedIn, for marketing-website visitors who opt in to Targeting & Advertising (§7); professional advisors and auditors where necessary; and government authorities or other parties where required by law, as described in §6.3.

12.3 Sale, Sharing, and Targeted Advertising

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We share internet or network activity information with LinkedIn for cross-context behavioral and targeted advertising only for marketing-website visitors who opt in (§7), and never from Cadence, Bearing, or Customer data.

12.4 Right to Appeal

If we deny a rights request in whole or in part, you may appeal by emailing info@morningstaraigroup.com with the word “Appeal” in the subject line. We will respond to appeals within 45 days, with one 45-day extension where reasonably necessary, and will explain our decision in writing. If your appeal is unsuccessful, some states permit you to contact your state Attorney General or applicable regulator.

13. Immutable Records: Limits on Correction and Deletion

Bearing and Cadence's core function is to produce a tamper-evident, litigation-grade record. Once a daily log entry, photo, transcription, or audit-trail entry is created, it cannot be altered or deleted through the application — this is enforced at the database level, not merely a policy choice, and it is the mechanism the product's reliability depends on.

This has the following practical effects, which we state here directly rather than implying a blanket right that does not exist:

• Correction: an immutable entry cannot be edited. Instead, a correction is made by adding a new, linked addendum entry that supplements the original and is itself visible in the record — preserving both the original entry and the correction, consistent with how a chain-of-custody record is properly maintained.
• Deletion: an immutable entry cannot be deleted on request. It is retained for the period specified in §9 and disposed of only when that period expires, except where a litigation hold or legal obligation requires longer retention.
• Deletable data: account data, session data, and mutable profile fields (Tiers 1–2, company profile, marketing contact records) are not subject to this limitation and can be corrected or deleted as described in §11.

If you submit a correction or deletion request that touches an immutable record, we will process the deletable portions of your request and explain this limitation with respect to the rest, rather than silently declining or silently complying in a way that would compromise record integrity.

14. Children's Privacy

The Services are intended for users who are at least 18 years old. We do not knowingly collect personal information directly from children, and the Services are not directed at children.

Tier 3 profile data (§4.2.3) may include the names and ages of a Customer's client's children. This information is entered by an adult member of the Customer's staff, about an adult client's family, as part of a business record — a child never accesses, logs into, or directly provides information to Bearing and Cadence. This data receives the same server-side, company-admin-only access restriction as the rest of Tier 3.

If we learn that personal information has been collected directly from a child in a manner inconsistent with applicable law, we will take reasonable steps to delete it. A parent or guardian who believes a child has provided personal information to us directly may contact us at info@morningstaraigroup.com.

15. International Data Transfers

Morning Star is based in the United States, and personal information is stored and processed in the United States through our subprocessors listed in §6.1. We currently offer the Services only to businesses operating within the United States. If our footprint expands internationally, we will update this policy to describe the safeguards applicable to any cross-border transfer before doing so.

16. Third-Party Services and Links

Our marketing website links to third-party browser-support pages for managing cookies (e.g., browser vendor help pages). These are outbound reference links; no data is transmitted to them by us when you click through. We are not responsible for the privacy practices of any third-party site or service that we do not control, and we encourage you to review their privacy policies directly.

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. We will post the updated policy with a revised “Last Revised” date, and where the change is material, we will provide notice by email (once transactional email is operational) and by an in-application notice before or at the time the change takes effect. Continued use of the Services after a material change takes effect constitutes acknowledgment of the updated policy, subject to any additional consent required by law.

18. Contact Information

Morning Star AI Group LLC

Email: info@morningstaraigroup.com

Mailing Address: 305 East First Street, #1237, Cle Elum, WA 98922

To help us process a request, please provide enough information for us to verify your identity and understand your inquiry. We may request additional information as reasonably necessary to confirm your identity, protect personal information, and respond in accordance with applicable law.