Privacy Policy

Effective date: 2026-09-18

This policy is available in English and Mongolian. If the two versions differ, the English version prevails.

1. Who we are

Mora is operated by Кратос нөвлэж ХХК, registration number 7066553, registered address Улаанбаатар, Налайх дүүрэг, 2-р хороо, 1, 13 тоот (Khoroo 2, 1, Door 13, Nalaikh District, Ulaanbaatar, Mongolia). Phone: +976 91114009. Facebook: Mora Facebook Page.

In this policy, "we", "us" and "our" mean that company.

2. Scope

This policy applies to this website, including the early access request form, and to the Mora app, the web application that businesses use to connect their Facebook Page and ad account and to track results.

3. Data we collect

From Facebook Login

• The user's name.
• The user's Facebook user ID.
• The user's email address, if the user grants permission to share it.

Facebook Page data

• Page ID.
• Page name.
• Page picture.

Messenger conversation data for connected Pages

• Conversation (thread) ID.
• The customer's Page-scoped ID (PSID) and public name.
• The time the conversation started.
• Ad referral data: ad ID, ad name and campaign.

Ads data

• Ad account ID.
• Campaign, ad set and ad names.
• Spend.
• Basic delivery metrics, such as impressions and clicks.

Data entered by business staff

• Booking status.
• Arrival status.
• Payment amount.
• Notes. Notes are for operational details only (see section 4).

From the early access form

• Your name.
• Business name.
• Business type.
• Phone number.
• Optionally, your email address, Facebook Page link and a message.
• The page language and the time you sent the form.

We do not store your IP address with the form.

Technical data

Server logs containing IP address, browser type, time of request, pages or endpoints requested, and errors. We use them for security and troubleshooting. This website sets no cookies and uses no analytics.

4. Data we do not collect

• Medical or health information. Mora does not ask for diagnoses, treatment details or medical history, and business staff are instructed not to enter them in notes or any other field.
• Payment card numbers. Payment amounts are entered manually by business staff, and Mora does not process payments.
• Message content. Mora receives conversation metadata and ad referral data. We do not read message text beyond what is needed to identify the conversation and the ad that started it.

5. How we use data

We use data only to:

• show each business its own ad to revenue results; and
• operate, secure, maintain and support the service.

We use the details you send in the early access form only to contact you about early access to Mora.

We do not:

• sell data;
• use data for our own advertising;
• use data to build profiles for others; or
• share one business's data with other customers.

6. Legal basis and consent

Businesses connect their Facebook Page and ad account voluntarily and can disconnect them at any time. Each business decides whether to use Mora for its own customers' conversations, and is responsible for having a lawful basis for that use and for informing its customers.

We process personal data in line with the Law of Mongolia on Personal Data Protection (Хүний хувийн мэдээлэл хамгаалах тухай хууль).

7. Sharing and processors

This website and the data sent through the early access form are hosted on Cloudflare (Cloudflare Pages and Cloudflare D1 database).

For the Mora app, we use service providers for hosting and database services: Cloudflare, Inc. (hosting and the Cloudflare D1 database). They process data only on our instructions.

We may disclose data if required by law or in response to a valid legal request. We never sell data.

8. Meta Platform Data

Data we receive from Meta through Facebook Login, Pages, Messenger and the Marketing API is handled in line with the Meta Platform Terms and Developer Policies. We use it only for the purposes described in this policy. We do not transfer it to data brokers, and we do not use it for advertising outside the business's own results.

9. Retention

We keep data from a connected account while the account is active, and delete it within 90 days after the account is closed or disconnected. Server logs are kept for 30 days.

Early access form details are kept until early access ends or until you ask us to delete them, whichever comes first.

When a user disconnects their account or requests deletion, data is deleted as described on the Data Deletion page.

10. Security

• Encryption in transit (HTTPS/TLS).
• Access controls on our systems.
• Least-privilege access for staff, so each person can reach only what their work needs.
• Access tokens are stored securely.

11. Your rights

You have the right to:

• access your data;
• correct your data;
• delete your data; and
• withdraw consent by disconnecting your account.

To use these rights, call +976 91114009 or send a message to our Mora Facebook Page, and include your Facebook Page name. We respond within 30 days.

12. Data deletion

See the Data Deletion page for step by step instructions, including instructions for people who messaged a business that uses Mora. You can also ask us to delete the details you sent in the early access form in the same way.

13. Children

Mora is for businesses and is not directed at children under 18. We do not knowingly collect data from children through the app itself.

14. International transfers

Our servers may be located outside Mongolia: Cloudflare's global network, with the database stored in the Asia-Pacific region. We take reasonable steps so that data is protected as described in this policy.

15. Changes to this policy

We post the updated policy on this page with a new effective date. For significant changes, we notify connected businesses by email or in the app.

16. Contact

• Кратос нөвлэж ХХК
• Улаанбаатар, Налайх дүүрэг, 2-р хороо, 1, 13 тоот (Khoroo 2, 1, Door 13, Nalaikh District, Ulaanbaatar, Mongolia)
• Phone: +976 91114009
• Facebook: Mora Facebook Page