Last updated: September 30, 2026
This Privacy Policy explains how Philip Morales collects, uses, discloses, and retains personal information in connection with philipmoralesai.com and related professional communications. It also explains the choices available to you and how to contact us about your information.
The website presents professional experience, case studies, research, and information about potential employment, advisory, consulting, speaking, and collaboration opportunities. This policy applies to visitors and people who contact us through the website or by email. It does not replace a separate privacy notice or data processing agreement that applies to a particular client engagement.
1 Who is responsible for your information
Philip Morales is responsible for the personal information covered by this policy and is referred to as “we,” “us,” or “our.” Where applicable data protection law uses the term “controller,” Philip Morales is the controller for this information.
Privacy contact: philip@philipmoralesai.com
2 Information we collect and its sources
Information you provide. When you submit a contact form, send an email, or discuss a professional opportunity, we collect the information you choose to provide. Depending on your inquiry, this can include your name, email address, telephone number, company, job title, professional profile, the subject and contents of your message, project requirements, budget or timing preferences, and attachments or links you send.
Please provide only information relevant to your inquiry. A required form field is needed to process the corresponding request; if you do not provide it, we may be unable to respond or provide the requested information. Optional details are voluntary.
Technical information. Our website infrastructure and service providers may record your IP address, browser and operating system, device type, requested pages or files, referring website, access dates and times, error information, and security events. An approximate location may be inferred from an IP address. This information supports website delivery, troubleshooting, and protection against misuse.
Professional referrals and public sources. In connection with an inquiry, we may receive your business contact details from a recruiter, colleague, referral partner, or other person you have authorized, or review relevant information you have made publicly available on a professional website. We use that information to understand and respond to the opportunity, subject to applicable law.
Sensitive information. The website is not intended as a channel for patient records, protected health information, government identification numbers, payment-card details, account passwords, biometric identifiers, or other sensitive personal information. References to healthcare or AI in our work do not make the website a patient portal. Please do not send confidential client datasets or another person’s sensitive information through the contact form or ordinary email. If an engagement requires such information, appropriate arrangements should be agreed separately.
3 How we use information
We use personal information for purposes reasonably connected to your interaction with us, including to:
Respond to questions, provide requested materials, and communicate about employment, projects, speaking, research, or other professional opportunities.
Evaluate the scope and suitability of an inquiry, arrange discussions, prepare proposals, and manage a professional relationship.
Operate, maintain, troubleshoot, and secure the website and its communications, including detecting spam, fraud, abuse, and unauthorized access.
Understand website performance and improve content or usability, subject to applicable privacy requirements and any necessary consent.
Keep appropriate business and consent records, handle privacy requests, meet legal obligations, and establish, exercise, or defend legal claims.
We do not treat a general contact inquiry as consent to receive unrelated promotional messages. If we propose to use information for a materially different purpose, we will provide any additional notice and obtain any permission required by applicable law.
4 Legal grounds where required
Where the EU General Data Protection Regulation, UK GDPR, or another law requires a lawful basis, the basis depends on the purpose of the processing:
Requested steps or contract: responding to a request you make before entering a contract with us, or carrying out a contract to which you are a party.
Legitimate interests: handling ordinary professional correspondence, administering business relationships, keeping the website secure, and maintaining proportionate records, where our interests are not overridden by your rights. For corporate inquiries, this may apply when your organization, rather than you personally, is the contracting party.
Consent: activities that require your permission, including non-exempt cookies or optional communications where applicable. You may withdraw consent without affecting processing that was lawful before withdrawal.
Legal obligations: keeping legally required records and responding to binding legal requirements.
We assess the appropriate basis for each purpose. We do not rely on a person merely visiting the website as blanket consent to every activity described in this policy.
5 Cookies and website technologies
Cookies are small files stored on a device. Similar technologies include local storage, pixels, and scripts that access device information. Depending on the configuration, these technologies can support security, remember preferences, measure traffic, or enable content provided by another service. Session cookies ordinarily expire when the browser session ends; persistent cookies remain until they expire or are deleted.
Where applicable law requires consent, we obtain your permission before using non-exempt cookies and similar technologies. Essential or otherwise exempt technologies are treated according to the relevant legal requirements. When we request consent for a feature, we provide a way to change your choice and withdraw consent as easily as it was given.
You can also manage or delete cookies through your browser. Blocking essential cookies may affect functionality. Browser cookie controls do not necessarily prevent all server logs, pixels, or other data collection, and deleting cookies may remove a saved privacy choice. Simply continuing to browse is not a substitute for consent where consent is required.
6 Who receives information
We disclose personal information only as appropriate for the purposes described in this policy and subject to applicable law. Recipient categories include:
Service providers supporting hosting, website administration and maintenance, form handling, email delivery and storage, backups, and security. They receive the information needed for the relevant service.
Professional advisers, such as legal, accounting, or insurance advisers, when necessary for advice, recordkeeping, a claim, or a legal obligation.
A person or organization you ask us to contact or share information with, within the scope of your instruction or other lawful authorization.
Authorities, courts, or other parties when disclosure is legally required or reasonably necessary to protect lawful rights, investigate abuse, or address a genuine security issue, consistent with applicable law.
A prospective or actual successor in a reorganization, transfer, or sale of the relevant business or assets, subject to appropriate confidentiality, legal requirements, and notice where required.
Messages sent through the website may be stored in the website system and delivered to the email services used to manage correspondence. Forwarding a message between providers can create copies of its contents, attachments, and delivery metadata. Our responsibility for choosing providers and handling your information is not removed by using those services.
Where required, we use appropriate agreements with providers to govern confidentiality, security, permitted processing, and assistance with privacy obligations. You can contact us for further information about providers that process your information.
7 Email and optional communications
We use the contact details you provide to respond to your inquiry and manage the related conversation. If you separately subscribe to updates or other optional communications, we use those details for that purpose in accordance with applicable consent and marketing rules.
You can ask us to stop optional promotional messages by using an unsubscribe link where provided or by emailing philip@philipmoralesai.com. We may still send a response you requested or a message needed for an existing engagement, a privacy request, or a legal obligation. We may retain a limited record of an opt-out to respect it.
8 How long information is retained
We retain personal information only for as long as reasonably necessary for the disclosed purpose, subject to applicable legal requirements. The period depends on the record and circumstances:
Inquiries and correspondence: the time needed to resolve the inquiry, manage relevant follow-up, and retain a proportionate record of the relationship.
Engagement and business records: the duration of the relationship and applicable contractual, accounting, tax, or legal-claims requirements.
Technical and security records: the period reasonably needed for operation, troubleshooting, abuse prevention, or investigation. An identified incident can justify retaining relevant records longer.
Consent, preference, and privacy-request records: the period needed to demonstrate compliance and apply your choices. Information used solely to verify a request is kept only as needed for that purpose or a legal requirement.
When information is no longer needed, we delete it or de-identify it as appropriate. Backup copies may remain until the applicable backup cycle expires and are kept subject to relevant protections. Retention may be extended for a legal hold or unresolved claim. Information that has been effectively de-identified is not used to re-identify you except where permitted by law.
9 Information security
We use reasonable administrative, technical, and organizational measures intended to protect personal information against unauthorized access, loss, misuse, or disclosure. These measures address the nature of the information and risks, including access to and maintenance of the systems used for the website and correspondence.
No website, email system, or method of electronic storage can guarantee complete security. Please avoid sending sensitive information through ordinary email or the contact form. If an incident requires notification under applicable law, we will provide the required notifications. This policy does not limit any rights you have under that law.
10 International processing
Our service providers may store or process information in countries other than the country where you live, including the United States. Those countries may have different data protection laws.
When a transfer is subject to a legal restriction, we use an applicable lawful transfer mechanism and any required supplementary safeguards. Depending on the circumstances, these may include an adequacy decision or approved contractual safeguards, such as the European Commission’s standard contractual clauses and a relevant UK transfer instrument. We do not claim that a provider is covered by an adequacy framework or certification unless the applicable coverage has been verified.
You may contact us to ask about safeguards relevant to your information and, where required by law, obtain information about or a copy of them, with appropriate redactions. Using the website alone is not blanket consent to an otherwise restricted transfer.
11 Your choices and privacy rights
You can choose not to submit an inquiry, limit the optional information you provide, manage applicable cookie choices, and opt out of optional communications. Depending on where you live, the law that applies to us, and the processing involved, you may also have rights to:
Ask whether we process your information, access it, and receive information about its sources, purposes, and disclosures.
Correct inaccurate information, request deletion, or receive a portable copy where the relevant right applies.
Object to or restrict certain processing, and withdraw consent for processing based on consent.
Opt out of a covered sale, sharing for cross-context behavioral advertising, targeted advertising, or certain significant profiling, and limit covered uses of sensitive information where the relevant law provides those rights.
Appeal a denied request where applicable law provides an appeal, and complain to an appropriate regulator.
These rights are subject to legal conditions and exceptions. For example, we may need to retain information to comply with a legal obligation, protect another person’s rights, or address a legal claim. We will not unlawfully discriminate or retaliate against you for exercising a privacy right.
12 Additional regional information
United States. State privacy laws differ and may apply only when particular coverage conditions are met. Where a relevant law applies, the rights and request procedures in this policy are available to eligible residents. The earlier sections describe the information we collect, where we obtain it, how we use and disclose it, and our retention practices. This policy does not assume that every state privacy law applies to this website solely because it is accessible in that state.
California. If we are subject to the California Consumer Privacy Act, as amended, the applicable rights include knowing, accessing, correcting, and deleting covered information, opting out of covered sale or sharing, and limiting certain uses of sensitive information. An authorized agent may act for you as permitted by law. California residents may also contact us regarding disclosures for third parties’ own direct marketing under California’s Shine the Light law, where applicable.
European Economic Area and United Kingdom. Where the applicable law covers our processing, the legal grounds in Section 4 apply. You may object to processing based on legitimate interests and to direct marketing, withdraw consent, and request access, correction, erasure, restriction, or portability as applicable. You may complain directly to a competent data protection authority, including the UK Information Commissioner’s Office. You do not need to contact us first to exercise a complaint right.
13 How to make a privacy request
Email philip@philipmoralesai.com with the subject “Privacy Request.” Explain the right or concern, the email address used to contact us, and enough information for us to locate the relevant records. You do not need to create an account to make a request.
For requests that require verification, we may ask for proportionate information to confirm identity or an agent’s authority. We will avoid requesting unnecessary sensitive information and use verification information only for verification and related lawful purposes. We will not impose identity-verification requirements on an opt-out request where the law prohibits them.
We respond within the time required by the applicable law and explain any permitted extension. If we decline a request, we will explain the reason to the extent required. Where an appeal is available, reply to the decision with the subject “Privacy Appeal” and explain why you believe it should be reconsidered. We will provide the legally required response and information about further complaint options.
Requests are ordinarily free. Any fee or refusal for an excessive, repetitive, or manifestly unfounded request will be limited to circumstances allowed by the relevant law. If we process the requested information only on behalf of a client, we may direct you to that client or assist it in responding, as appropriate.
14 Children and young people
The website is intended for a professional adult audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the website. If you believe a child has provided information, contact philip@philipmoralesai.com. If we learn that information was collected without any consent or other authorization required by law, we will take appropriate steps to delete it or otherwise comply with the applicable requirements. Additional protections for older minors apply where required.
15 External links and third party features
The website may link to professional profiles, research publications, reference materials, and other websites. When you follow a link, the destination operator handles information under its own policy. A link is not a representation that the other operator follows this policy.
If content or tools from another provider are embedded within a page, that provider may receive technical information when the feature loads or is used. The provider’s own privacy notice describes its handling of information.
16 Changes to this policy
We may update this policy when our practices, services, or applicable requirements change. The current version will be published on this page with a revised “Last updated” date. For a material change, we will provide any additional notice required by law and obtain consent where required before implementing the relevant new processing. A policy update or your continued use of the website does not itself override a choice you made or provide consent that the law requires separately.
17 Contact us
For questions about this policy or our handling of personal information, contact:
Philip Morales
Email: philip@philipmoralesai.com
Website: https://philipmoralesai.com