Privacy Policy

This notice explains how Morphic Technologies Ltd. ("Morphic", "we", "us") handles personal information when you visit www.morphicai.io, use the product, connect a hosting account, or contact us. For privacy questions, contact liam@morphicai.io.

1. Our role and the host's role

We determine how account, subscription, support, security and website information is used to run Morphic. For those purposes we act as a data controller.

When a host uses Morphic to handle guest conversations, reservations, property guidance, reviews or turnover work, we normally process that information on the host's instructions. The host is usually the controller. If the host manages a property for another controller, the host may instead be a processor and Morphic a subprocessor. A host being an individual rather than a company does not by itself change these roles.

This notice is not a data processing agreement. A separate, accepted agreement is needed where applicable. Hosts remain responsible for their lawful basis, guest notices, authorized staff access and instructions. Airbnb and other connected platforms have their own responsibilities and privacy policies.

2. Information we receive

• Account and subscription information: contact details, login identifiers, account settings, subscription and payment-status records. Stripe processes payment details under its own terms.
• Connected hosting information: listing details, reservation dates and status, available guest names and contact information, message history, reviews and operational information made available by the connected service and permissions.
• Information you provide: property guides, instructions, host replies and draft edits, cleaner or team contacts, support correspondence, uploaded attachments and voice messages where you use those features.
• Service information: access and device information, timestamps, identifiers, delivery status, operational logs, errors and AI-operation records.

A connection can expose an account-level directory of listings before you select the listings to activate. Do not assume that selecting one listing prevents all information about other listings on the same account from being read. The data available also depends on the integration and the connected platform.

Messages and attachments may contain information about health, accessibility, children or other sensitive matters. We do not ask you to upload identity documents, payment-card details, passwords or unnecessary sensitive information. Free-text messages are not guaranteed to exclude such information. Hosts should contact us before instructing processing that requires additional safeguards or supplier agreement.

3. Why we use information

We use account information to provide and administer the service, subscriptions and support; service and security information to diagnose problems, protect accounts and maintain reliable operations; and records needed to meet legal obligations. For controller processing, our legal bases are performance of a contract where applicable, legitimate interests in operating and protecting the service, legal obligations, and consent where required. You can contact us about the interests we rely on or to object.

On a host's instructions, hosting information supports guest replies and draft review, property guidance, reservation context, reviews, reminders and turnover coordination. Enabled communication channels may deliver information to the host, authorized team members or intended guests. We do not make the host's decision about the lawful basis for this guest processing.

4. AI assistance and human control

Relevant conversation and property information may be sent to an AI inference service to draft replies, identify requests, suggest guide changes or support authorized operations. Voice features may send audio to a transcription service. Copilot review and enabled automation settings determine which supported actions require host review. AI output can be wrong; hosts should review decisions involving safety, access, money or exceptions.

For the OpenRouter inference route, our account is configured to restrict routing to endpoints designated as zero-data-retention eligible, with paid and free model training permissions disabled and input/output logging disabled. This is a routing restriction, not a promise that Morphic's own messages, operational records, diagnostics or every other supplier use zero retention. Model-provider eligibility is based on the provider information maintained by OpenRouter.

Product-specific guide updates are different from training a general-purpose model. Inference routing restrictions do not determine how long the application's own records are retained.

5. Services and recipients

Depending on the features and connection used, recipients include Supabase for database and authentication services; Fly.io for backend and worker hosting; Vercel for website and frontend delivery; Repull or Channex for hosting-platform connectivity; OpenRouter and the model endpoints serving its requests for AI inference; and configured messaging, email, payment and diagnostic services.

Diagnostic services include Sentry and, where tracing is enabled, LangSmith. Diagnostic records may include conversation inputs, outputs, tool results and identifiers. Alternative inference services, including 0G where used, have their own processing arrangements. Not every recipient receives every category of information.

We may disclose information to authorized service providers, on your instructions, to comply with a binding legal requirement, or in a business transfer subject to applicable protections. Connected platforms and payment providers may act as independent controllers for their own purposes. Their policies do not replace our responsibilities.

6. Processing locations and international transfers

Our backend deployment is configured for London. This does not mean all data stays in the United Kingdom: database, frontend, integration, inference, support and diagnostic providers may process information in other countries, including the United States. A hosting region does not establish a supplier's support, log or backup locations.

International transfers are subject to applicable data protection requirements. Depending on the transfer, relevant mechanisms include adequacy decisions or contractual safeguards such as EU Standard Contractual Clauses and the UK Addendum. Contact us for information about the safeguards applicable to your service and how to obtain a copy.

7. Retention, disconnection and deletion

We retain information according to its purpose, your instructions, service requirements and applicable legal obligations. Disconnecting an integration stops the connected service's authorized use according to the disconnection workflow; it is not the same as deleting all previously imported information.

Our support team manually handles requests for export, correction, restriction and deletion. Contact liam@morphicai.io with your request. We verify identity and authority, identify the relevant records and coordinate the request with connected service providers where needed.

We will explain any lawful retention requirements or limitations relevant to your request. Backup and diagnostic retention can differ from the active database. We respond within the periods required by applicable law.

8. Security

We use access controls, encrypted network connections, managed infrastructure and operational monitoring to protect information. Authorized support and operational access may be needed to resolve incidents. Security depends on both our implementation and the providers we use; no system is completely secure. Keep your connected accounts, devices and team access secure.

9. Your rights

Depending on applicable law and the processing involved, you may have rights to access, correct, delete or obtain your information, restrict processing, object, withdraw consent and complain to a supervisory authority. Withdrawal does not affect earlier lawful processing. We may need to verify identity and authority before acting.

For guest information processed on a host's instructions, contact the host first where possible. If you contact Morphic, we will help identify the responsible host and handle the request in line with our role and applicable law. For our controller processing, contact liam@morphicai.io. UK residents can complain to the Information Commissioner's Office; EEA residents can contact their local supervisory authority.

10. Cookies and measurement

With your permission, we use a first-party measurement cookie to remember the campaign parameters that brought you to Morphic for up to 30 days. This helps us understand which marketing activity leads to account creation.

Where Google Ads or Meta measurement is enabled, the Google tag and Meta Pixel may load in your browser. Signup-completion events may be sent to enabled advertising services. Those browser conversion events do not include your name or email address, but advertising services may process technical browser and cookie data under their own policies. Other enabled advertising measurement, including OpenAI Ads, may process campaign and event information.

Where Meta server-side signup measurement is enabled, the conversion event includes a hashed version of your email address and may include your IP address and browser user agent. Hashing does not make this information anonymous; Meta may use it to match the event to its users. This is separate from the browser conversion events described above.

We use Ahrefs Web Analytics on public marketing and content pages for aggregated traffic measurement without cookies or persistent identifiers. It processes page URLs, referrers, device and browser information, language, and city-level location derived from IP addresses; raw IP addresses are not retained by Ahrefs. We do not load it in the signed-in product, authentication, or payment flows. Necessary authentication and service storage are separate from advertising measurement.

11. Updates and contact

We may update this notice as the service and processing arrangements change. We will identify the revised date and provide additional notice when required by law. For support, contact office@morphicai.io; for privacy matters, contact liam@morphicai.io.