Data Processing Addendum

Last updated: October 4, 2026

This DPA forms part of the Terms of Service between the Builder ("you," the "Controller") and morphing.app LLC, a limited liability company with its principal place of business at 6636 Wapiti Dr, Lewiston, Idaho 83501 ("Morphing," the "Processor"). It governs Morphing's processing of personal data that you collect from your end-users and customers ("End-User Data") through the Service, where you act as the controller and Morphing acts as your processor. It reflects the requirements of Article 28 of the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and analogous data-protection laws. Where this DPA conflicts with the Terms of Service regarding processing of End-User Data, this DPA controls.

1. Roles of the Parties

For End-User Data, you are the Controller and Morphing is the Processor (and may engage sub-processors as described below). You are responsible for the lawfulness of the End-User Data and of your instructions. Morphing processes End-User Data only on your documented instructions, which include the Terms of Service, this DPA, and your configuration and use of the Service, unless required to act otherwise by law (in which case Morphing will inform you, unless the law prohibits it). For Builder account data, Morphing is the controller as described in the Privacy Policy; that data is outside the scope of this DPA.

2. Subject-Matter, Duration, Nature and Purpose

• Subject-matter: Morphing's provision of the building platform and related services to you.
• Duration: The term of your account plus any period during which Morphing continues to hold End-User Data, until deletion or return as described in Section 8.
• Nature and purpose: Hosting, storing, transmitting, and otherwise processing End-User Data as necessary to operate your application and deliver the Service on your behalf (including messaging, scheduling, records, payments rails, and optional AI assistance you enable).
• Types of personal data: As determined by you, which may include names, contact details (phone, email), appointment and service records, order and transaction data, message content, and any other data you choose to collect.
• Categories of data subjects: Your end-users, customers, clients, and message recipients.

3. Processor Obligations

• Process End-User Data only on your documented instructions, including for international transfers, unless required by law to do otherwise.
• Ensure that personnel authorized to process End-User Data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (Section 5).
• Respect the conditions for engaging sub-processors (Section 4).
• Assist you with data-subject requests and with your obligations regarding security, breach notification, data-protection impact assessments, and prior consultation (Sections 6-7), taking into account the nature of processing and the information available to Morphing.
• Delete or return End-User Data at the end of the provision of services (Section 8).
• Make available information necessary to demonstrate compliance and allow for audits (Section 10).

4. Sub-processors

You provide general authorization for Morphing to engage sub-processors to process End-User Data in order to deliver the Service. Morphing imposes data-protection obligations on each sub-processor that are substantially the same as those in this DPA, and remains responsible for its sub-processors' performance. The current sub-processors are:

Which AI model provider handles a given task can change as Morphing selects models for quality, speed and cost. An AI model provider receives End-User Data only for the tasks routed to it.

Change notice and objection. Morphing will notify you of any intended addition or replacement of a sub-processor at least thirty (30) days before the new sub-processor begins processing End-User Data, giving you an opportunity to object on reasonable data-protection grounds. If you object, the parties will work in good faith to resolve the concern; if it cannot be resolved, you may terminate the affected part of the Service as your sole remedy. Notices are given by email to your account contact and/or by posting an updated list on this page.

5. Security Measures

Morphing implements and maintains appropriate technical and organizational measures designed to protect End-User Data, including:

• Encryption of data in transit (TLS) and of sensitive data at rest, including credentials and access tokens (AES-256-GCM).
• Logical isolation of each workspace's data in separate database schemas to prevent leakage between Builders.
• Access controls and authentication, with least-privilege principles for personnel.
• Signature verification of inbound webhooks (e.g., Meta's X-Hub-Signature-256).
• Regular security reviews of the codebase and infrastructure.

6. Personal Data Breach Notification

Morphing will notify you without undue delay after becoming aware of a personal-data breach affecting End-User Data you control, and in any event within the timeframe required by applicable law. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Morphing will reasonably assist you in meeting your own breach-notification obligations to authorities and data subjects. Morphing's notification is not an acknowledgment of fault or liability.

7. Assistance with Data-Subject Requests

Taking into account the nature of the processing, Morphing will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection, and opt-out). If Morphing receives a request directly from one of your end-users, it will not respond substantively except on your instruction, and will instead forward the request to you as the responsible controller, as described on our Data Deletion page.

8. Deletion or Return of Data

On termination of the Service, deletion of your account, or deletion of a Builder application — or otherwise on your instruction — Morphing will delete or return End-User Data associated with that application or account, and delete existing copies, except to the extent retention is required by law. End-User Data may persist in backups for a limited period before being purged in the ordinary course. Deletion mechanics are described on our Data Deletion page.

9. International Transfers

End-User Data is processed primarily in the United States. Some AI model providers listed in Section 4 are based outside the United States: DeepSeek and Xiaomi are based in China, and End-User Data sent to them may be processed there. Where Morphing or a sub-processor transfers End-User Data to a country that does not provide an adequate level of protection, the transfer is governed by an appropriate transfer mechanism, including the European Commission's Standard Contractual Clauses (SCCs) and, for UK data, the UK International Data Transfer Addendum, together with any supplementary measures required. The applicable SCCs are incorporated into this DPA by reference and apply to such transfers between you (as data exporter) and Morphing (as data importer), and onward to sub-processors.

10. Audit

Morphing will make available to you information reasonably necessary to demonstrate compliance with this DPA and Article 28, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. To protect the confidentiality and security of Morphing's systems and other customers' data, audits will be conducted on reasonable prior notice, no more than once per year (except where required by a supervisory authority or following a breach), during business hours, subject to confidentiality obligations, and Morphing may satisfy audit requests by providing relevant documentation, security summaries, or third-party reports where available.

11. Governing Law

This DPA is governed by the law identified in the Terms of Service (the State of Idaho), except that, where the SCCs apply, the SCCs are governed by the law they specify.

12. Contact

Data-protection contact: hello@morphing.app
Website: morphing.app