Privacy Policy
Effective date: 9 October 2026
This policy explains what data Morphia collects, why, and how long we keep it. It covers the morphiaone.ai website, the developer dashboard and the Morphia API (together, the "Service").
Morphia is in private beta. During the beta, the Service is run by the Morphia team. When our company is formed, we will update this policy with the company name and tell registered users by email.
1. Our two roles
- Account data. For data about you as a user (your account, usage and messages), we decide how it is used. We are the "controller".
- API data. For images and other content you send to the API, and the results we return, we act only on your instructions. We are the "processor". You, our customer, are the controller and are responsible for your end users.
2. What we collect
- Account data: name, email, company name, role, and login details (including Google or GitHub login if you use it).
- API data: images, parameters and other inputs you send, and the results the models return.
- Usage data: API keys used, request counts, credits, errors, IP address, browser and device type, and pages visited.
- Messages: anything you send us by email, form or chat.
- Cookies: cookies needed to run the site and keep you logged in, and analytics cookies only if you allow them. See Cookie Settings.
We do not collect payment data during the beta.
3. How we use data
- To create and run your account and API keys
- To process API requests and return results
- To track credit usage and limits
- To keep the Service secure and stop abuse
- To fix problems and improve the product using usage statistics (not your images)
- To send service updates and, if you agree, product news
- To follow the law
4. Photos and face data
Many Morphia models analyze human faces, skin, hair, nails and teeth. Some features measure face shape or landmarks. In some laws this counts as biometric data. Our rules:
- We use images only to return the result you asked for.
- We do not use your images or results to train or improve our models.
- We do not use images to find out who a person is, and we do not build face databases.
- We do not sell, rent or trade images or face data.
- Images and results are deleted automatically within 30 days after the request. You can ask us to delete them sooner.
- Only a small number of authorized team members can access API data, and only to fix a problem or investigate abuse.
If you send us images of other people (for example, your app's users), you must tell them how their images are used and get any consent the law requires. This includes laws like GDPR, KVKK, and US biometric laws such as the Illinois Biometric Information Privacy Act (BIPA).
5. Legal basis
We process data because it is needed to provide the Service (contract), because the law requires it, because we have a legitimate interest in keeping the Service safe and working, or because you gave consent (for example, marketing emails). For API data, we rely on the legal basis our customer has.
6. Who we share data with
We share data only with service providers that help us run the Service, such as:
- Cloud hosting and compute: Microsoft Azure
- Content delivery and bot protection: Cloudflare
- Dashboard sign-in: WorkOS
- Email: Resend
These providers may use the data only to provide their service to us. We may also share data if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business. We do not sell personal data and we do not use it for targeted advertising.
7. International transfers
Our servers are in the European Union (Microsoft Azure, Ireland and France). Our team and service providers may access data from the countries where they work. When we move data across borders, we use legal safeguards such as standard contract clauses where required.
8. How long we keep data
| Data | How long |
|---|---|
| API images and results | Up to 30 days, then deleted automatically |
| Request logs (no images) | Up to 90 days |
| Account data | While your account is open, plus up to 12 months after you close it |
| Messages to us | Up to 24 months |
| Data we must keep by law | As long as the law requires |
9. Security
We protect data with encryption in transit, access controls and API key protection. See our Security page for details. No system is 100% secure. If a breach affects your data, we will tell you as the law requires.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or limit some processing, and to withdraw consent. This includes rights under GDPR, KVKK and US state laws such as the California Consumer Privacy Act. To use these rights, email [email protected]. We will reply within 30 days. You can also complain to your local data protection authority.
If you are an end user of one of our customers' apps, please contact that company first. We will help them answer your request.
11. Children
The Service is for businesses and developers aged 18 or older. We do not knowingly collect data from children. If you think a child has sent us data, contact us and we will delete it.
12. Changes
We may update this policy. If the changes are important, we will email registered users before they take effect. The date at the top shows the latest version.
13. Contact
Morphia — morphiaone.ai
Email: [email protected]