Privacy Policy

Last updated: October 4, 2026

Morphing ("we," "our," or "us") operates the morphing.app building platform and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our services, and how we process data on behalf of the Builders that use Morphing to run their own applications.

How to read this policy: our two roles

Morphing is a multi-tenant building platform. That means we handle data in two different roles, and it matters which one applies:

• As a controller — Builder account data. When a Builder signs up and uses Morphing, we are the controller of that Builder's account and usage data (name, email, authentication data, billing data, and how they use the platform). This policy governs that data directly.
• As a processor / sub-processor — End-User data. Builders create applications that collect data from their own end-users and customers ("End-Users"). For that End-User data, the Builder is the controller and Morphing is a processor (sub-processor) acting on the Builder's behalf and under the Builder's instructions. Our processing of End-User data is governed by our agreement with the Builder, including our Data Processing Addendum. If you are an End-User of an application built on Morphing, the Builder that operates that application is responsible for its own privacy notice and for your data-subject requests — see "Your Rights" below.

1. Information We Collect

Account Information (Builder — Morphing as controller)

When you create a Builder account, we collect your name and email address, authentication credentials (or OAuth provider data), and, if applicable, your business name, billing information, and contact information.

End-User Data (Builder as controller; Morphing as processor)

When a Builder uses Morphing, its application may store End-User data including client names, phone numbers, email addresses, appointment schedules, service records, invoices, orders, and messages exchanged with the Builder's customers. The Builder is the controller of this data; Morphing processes it on the Builder's behalf, isolated per workspace.

Phone Numbers, SMS & Consent

If you or a Builder's End-Users opt in to receive SMS notifications, we collect phone numbers for the sole purpose of sending those notifications. Consent is obtained through an opt-in checkbox during booking, in account settings, or by texting a keyword (e.g., START/JOIN) to the number. Consent is always explicit and optional. Builders are responsible, as controllers, for obtaining and recording opt-in consent from their End-Users.

Usage Data

We automatically collect certain technical information when you use our services, including IP address, browser type, pages visited, and timestamps.

On morphing.app we additionally use advertising cookies, with your consent, and report completed purchases to Meta. What is collected and how to decline is described in Section 4B.

Mobile App (iOS and Android)

If you use the Morphing mobile app, we additionally collect a push-notification token for your device, your device's model, operating-system version, app version and language setting, and your notification preferences. We use these to deliver notifications and to show you which of your devices are signed in. If you sign in with Apple or Google, we receive the account identifier and email address that provider shares with us; with Apple's "Hide My Email" that is a relay address. The app uses your camera, microphone or photo library only when an app in your workspace asks for it and your device has asked for your permission. It does not access your location or your contacts. You can remove a device under Account → Devices in the app, and delete your account under Account → Delete account.

2. Categories of Data and How We Use It (CCPA/CPRA)

For residents of California and other U.S. states with similar laws, this section describes the categories of personal information we collect and how we use it:

• Identifiers — name, email, phone number, account and device identifiers.
• Customer records — billing contact and, for End-Users, the records a Builder chooses to store in its application.
• Commercial information — subscription, transaction, and usage records.
• Internet/network activity — log data, pages visited, and interactions with the Service.
• Communications content — the content of messages sent or received through the Service on a Builder's behalf.

We use this information to provide, secure, and improve the Service, to bill Builders, to deliver messaging, and to comply with law. We do not sell your personal information. We do not use SMS/WhatsApp opt-in data or message content for advertising, and we do not use Platform Data or End-User Data to train general-purpose AI models.

Sharing for cross-context behavioral advertising. On morphing.app's own marketing pages we use a Meta advertising pixel and report completed purchases to Meta, as described in Section 4B. Under California law this may be treated as "sharing" personal information for cross-context behavioral advertising. You can opt out at any time using the Cookie choices control shown on our pages, or by enabling a Global Privacy Control signal in your browser, which we honour. Separately, Builders may run their own advertising pixels on the pages they publish with Morphing; in that case the Builder decides that, and we act on their instructions as processor — see Section 4B. California residents may exercise the rights described in "Your Rights" below without discrimination.

3. Legal Basis and International Transfers (GDPR/UK GDPR)

Where the GDPR or UK GDPR applies, our lawful bases for processing Builder account data as controller include: performance of our contract with you (to provide the Service), our legitimate interests (to secure and improve the Service and prevent abuse), compliance with legal obligations, and consent where required. For End-User Data, the Builder (as controller) is responsible for establishing the lawful basis; Morphing processes that data on the Builder's documented instructions as processor.

We store and process data primarily in the United States. Some of the AI model providers listed in Section 6 are based outside the United States: DeepSeek and Xiaomi are based in China, and content sent to them may be processed there. Where personal data is transferred across borders (for example, to a sub-processor in another region), we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with supplementary measures where required. The SCCs are incorporated into our Data Processing Addendum for End-User Data we process on a Builder's behalf.

4. WhatsApp Business Messaging (Meta Platform Data)

Morphing is a Technology Provider for the WhatsApp Business Platform. A Builder may connect their own WhatsApp Business Account (WABA) and phone number to Morphing through Meta's Embedded Signup. When they do, we process "Platform Data" received from Meta strictly to provide the messaging service to that Builder:

• What we receive from Meta: the Builder's WhatsApp Business Account ID and phone number ID, the Builder's access tokens, connection health (messaging tier and quality rating), the content of inbound messages the Builder's customers send to the Builder's number, delivery/read status callbacks, and message-template status updates.
• What we do with it: deliver inbound messages to the Builder's unified inbox; send replies the Builder types or the Builder's AI assistant drafts, within Meta's 24-hour customer-service window; send pre-approved message templates the Builder uses for notifications (e.g., appointment reminders) to customers who have opted in; and display connection health to the Builder.
• On whose behalf: We act only for the Builder that owns and authorized the connected number. Morphing never messages on numbers it does not manage on a Builder's behalf.
• What we do NOT do: We do not use WhatsApp/Meta Platform Data for advertising, we do not sell or rent it, and we do not share it with third parties except the sub-processors listed in Section 6 that are required to deliver the service. We do not use Platform Data to build or train general-purpose models.
• Opt-out: A customer can reply STOP at any time; we stop proactive messaging to that number and record the opt-out. See Section 5.
• Retention & deletion: Platform Data is retained only as long as the Builder's connection is active. When a Builder disconnects WhatsApp, or a user requests deletion, the associated tokens and message data are deleted as described in Section 8 and on our Data Deletion page. Meta's own handling of WhatsApp data is governed by the WhatsApp Business Messaging Policy and Meta's Privacy Policy.

4B. Advertising, Cookies and Measurement (Meta)

Morphing uses Meta advertising tools in two distinct roles. Which one applies depends on whose website you are on, and it changes who is responsible for your data.

On morphing.app — Morphing as controller

• Advertising cookies. With your consent we load Meta's pixel, which sets the _fbp cookie and may read an _fbc value from an ad click. These let Meta recognise a browser across sites and are used for measurement and for showing you our ads elsewhere.
• Server-side purchase reporting. When someone completes a purchase or subscription with us, we send Meta a conversion event through Meta's Conversions API. It contains: your email address, phone number, city, postal code, country and an internal account identifier — each hashed with SHA-256 before it leaves our servers, so Meta receives fingerprints rather than the values themselves — together with the _fbp and _fbc cookie values (not hashed), the purchase amount and currency, and our payment reference as an order id. We do not send your name, your IP address or your browser's user-agent string.
• Why. To measure which of our advertisements lead to sign-ups, and to reach people who resemble our customers.
• Your choice. Use the Cookie choices control on any of our pages. If you choose essential cookies only, no pixel loads and no conversion event is sent. We also honour Do Not Track and Global Privacy Control signals, and in the EEA and UK nothing is loaded until you have chosen.

On a Builder's published pages — Morphing as processor

• Whose pixel. A Builder may connect their own Meta advertising account and install their own pixel on the pages they publish. That pixel is the Builder's, the data goes to the Builder's Meta account, and the Builder is the controller. We install and fire it on their documented instruction.
• What is collected. Page views, and the specific actions the Builder has chosen to count as a result — for example a completed booking. The Builder maps each action to a standard Meta event; we send that event to their pixel.
• Custom Audiences. A Builder can ask Meta to build an audience of people who visited their pages, so they can advertise to them again. This is created from the Builder's own pixel activity inside Meta. We do not upload customer lists, email addresses or phone numbers to Meta to create audiences — the instruction we send Meta contains only the Builder's pixel identifier, a web address fragment, and a time window.
• Your choice. The same Cookie choices control appears on Builder pages that run a pixel, and declining stops both collection and use for ad targeting. To exercise other rights over data a Builder holds about you, contact the Builder — see "Your Rights".

What we receive from Meta when a Builder advertises

To let a Builder create and manage advertisements from Morphing, we receive and store, for as long as their connection is active: their advertising account identifier, name and currency; their business portfolio and Facebook Page identifiers; the configuration of the campaigns created through us; delivery and spend figures reported by Meta; their pixel identifier; and the identifiers of any Custom Audiences created through us. We use this only to operate the advertising features they asked for, and to apply the spend allowance of their Morphing plan. It is deleted as described in Section 8 and on our Data Deletion page.

Once an event has been sent to Meta, Meta holds it under Meta's own Privacy Policy and we cannot recall it. Meta's use of information collected through its business tools is described in its Business Tools Terms.

5. Opt-in and Opt-out (SMS & WhatsApp)

• Opt-in: Messages are only sent to people who have opted in — by messaging the Builder first, checking an opt-in box at booking, or texting an opt-in keyword. Opt-in is never pre-selected or required as a condition of service.
• Opt-out: Recipients can opt out at any time by replying STOP. We honor opt-outs immediately, send a single confirmation, and suppress further proactive messages to that number.
• Re-subscribe / Help: Reply START to opt back in, or HELP for assistance. You may also email hello@morphing.app.
• Message frequency: Message frequency varies with your appointments and account activity — typically 1-5 messages per month.
• Message and data rates may apply. We are not responsible for charges from your mobile carrier.
• AI assistance disclosure: Replies may be drafted by a Builder's automated assistant. The assistant identifies itself as automated and, on request, hands the conversation to a human on the Builder's team.
• No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Text-messaging originator opt-in data and consent are never shared, sold, or rented to any third party. The sub-processors listed in Section 6 receive only the data needed to deliver the messaging service and never use it for their own marketing.

6. Third-Party Sub-processors

We use the following providers to operate the platform. They access data only as necessary to perform their function. The list below is also maintained, with change-notification and objection rights, in our Data Processing Addendum:

• Meta Platforms (WhatsApp Business Platform / Cloud API) — delivery of WhatsApp messages on connected business numbers.
• Twilio — sending and receiving SMS, and carrying calls to and from business phone numbers.
• AI model providers: Anthropic (Claude), OpenAI (GPT), DeepSeek, Xiaomi (MiMo) and Meta Platforms (Muse Spark) — the language models behind the in-app AI assistant, the app builder, and the Builder's customer-facing assistant. When one of these features runs, the content it needs is sent to the provider chosen for that task, which generates the response. That content can include what you type, files you attach, and business context, including End-User details such as customer names, bookings and message content. This applies to SMS and WhatsApp customer messages that are handled by the assistant, as well as the in-app builder. Which provider handles a given task can change as we select models for quality, speed and cost. Each provider processes this content under its own API terms. Anthropic does not use this content to train its models. In the Morphing mobile app, nothing is sent to these providers until you allow it, and you can change that choice under Account → AI assistant.
• xAI (Grok) — the real-time voice model that answers calls for Builders who let AI answer their business phone line. During an AI-answered call, the caller's voice is streamed to xAI as it is spoken, together with the assistant's instructions and the business context the call needs (for example, open booking times or the caller's own appointments), and xAI speaks the reply. xAI processes this content under its own API terms. A written transcript of the call is kept in the Builder's inbox.
• Resend — sending transactional email.
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) — delivering push notifications to the Morphing mobile app. A notification's title and text, which can name a customer or quote a message, pass through these services on the way to your device.
• Stripe — payment processing for Morphing subscription billing, and a payment rail Builders may connect for their own commerce. Card data is handled by Stripe and not stored on our servers.
• Square — a payment rail Builders may connect (via their own Square account) to process charges to their own customers. Where connected, Square processes payment and transaction data for that Builder's commerce. Card data is handled by Square and not stored on our servers.
• Cloudflare (R2 & Pages) and Railway — hosting, storage, and infrastructure.

7. Data Security

• Encryption in transit (TLS) and of sensitive data at rest.
• WhatsApp/Meta access tokens and other credentials encrypted at rest (AES-256-GCM).
• Inbound webhooks are signature-verified; the WhatsApp webhook validates Meta's X-Hub-Signature-256.
• Isolated database schemas per workspace to prevent data leakage between Builders.
• Regular security reviews of our codebase.

8. Data Retention & Deletion

One limit worth stating plainly: a conversion event that has already been sent to Meta, and any Custom Audience Meta has built, are held by Meta under Meta's own policies. Deleting your Morphing data does not withdraw them from Meta. To reach data Meta holds, use the controls in your Meta account.

We retain data for as long as an account is active or as needed to provide the service. If you delete your Builder account, we delete your personal data within 30 days, except where retention is required by law. When a Builder disconnects a WhatsApp number, its Meta tokens and associated connection data are deleted. End-User Data is retained for as long as the Builder maintains its application and is deleted, returned, or purged when the Builder deletes the application or account, or on the Builder's instruction, as described in the Data Processing Addendum. To request deletion of your data — including WhatsApp/Meta data we hold — see our Data Deletion page or email hello@morphing.app. Some records may remain in backups for a limited period before being purged.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, restrict, or delete your personal data, to object to certain processing, to opt out of the "sale" or "sharing" of personal information, and to opt out of messaging at any time by replying STOP. How you exercise these rights depends on which role applies:

• If you are a Builder (Morphing is the controller of your account data): contact us at hello@morphing.app and we will handle your request directly.
• If you are an End-User of an application built on Morphing (the Builder is the controller): direct your request to the Builder that operates that application, which is responsible as controller for responding. As the Builder's processor, Morphing will assist and forward requests to the relevant Builder, and will act on the Builder's instructions, but Morphing does not decide these requests on the Builder's behalf.

You may also lodge a complaint with your local data-protection authority.

10. Children's Data

Platform-wide minimum age. Builder accounts and the Morphing platform are not directed to, and may not be used by, individuals under the age of 18. We do not knowingly collect personal information from children through Builder registration.

Builder responsibility for End-Users. Builders are responsible for compliance with laws protecting children in any application that may reach minors, including the U.S. Children's Online Privacy Protection Act (COPPA) and GDPR provisions on children's consent (GDPR-K). A Builder must not use the Service to knowingly collect personal data from children in violation of applicable law, and must obtain any required verifiable parental consent as the controller. If we learn that an End-User application is collecting children's data unlawfully, we may suspend it under our Acceptable Use Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time and will post the updated policy here with a revised "Last updated" date.

12. Contact Us

Email: hello@morphing.app
Website: morphing.app