Privacy Policy
Last updated:
This policy explains how your personal data is processed when you use Morpho (morphoads.com and the app). It is also the privacy notice required by Article 10 of Turkey's Personal Data Protection Law No. 6698 (KVKK).
In short
- We process the data needed for your account, your brand and the ads you create; we do not sell your data.
- For AI work, your inputs are sent to AI providers; under their API terms they do not use this data to train their models by default.
- Analytics cookies (Google Analytics) only run if you allow them, and are never used for advertising or remarketing.
- To access, correct or delete your data, contact us: Contact form coming soon.
KVKK privacy notice
The points KVKK Article 10 requires you to be told about are covered in these sections:
| Topic | Section |
|---|---|
| Who the data controller is | Data controller |
| What data, collected how | Data we process, How we collect data |
| Purposes and legal bases | Purposes and legal bases |
| Who receives it and why | Sharing and service providers, International transfers |
| Your rights under KVKK Article 11 | Your rights |
Data controller
The data controller is Efekan Kahraman (sole proprietorship, trading as Morpho), Istanbul, Türkiye.
Contact: Contact form coming soon
Data we process
- Account: name, e-mail address and password (stored only as a one-way hash). If you sign in with Google, the name, e-mail and profile picture Google shares with us.
- Workspace and team: workspace name, the e-mail addresses and roles of teammates you invite.
- Brand data: content read from the website you connect (text, logos, colours, fonts, products), logos, product lists, photos and videos you upload, your brand kit settings.
- Chat and outputs: messages, briefs and feedback you give the AI team, and the copy, images, videos, voiceovers and work logs it produces.
- Usage and billing: credit balance and movements, credits charged per job, plan details; billing details once payments go live. We do not store card details; the payment provider processes them.
- Approval link visitors: the name a visitor enters, their decisions (approve, request changes, reject) and comments; their e-mail if they were invited by e-mail; an irreversible hash derived from their connection, to prevent abuse.
- Report link visitors: view counts for a shared report, questions visitors ask it, and the same kind of connection hash.
- Connected accounts: if you connect a Meta ad account, the access token Meta issues (stored encrypted), the account name and the permissions granted.
- Technical logs: IP address, browser details and error logs kept by our hosting infrastructure for security and operations.
- Cookies and analytics: session and preference cookies; with your consent, Google Analytics 4 page views with cleaned addresses and steps such as signing up or creating a brand (no e-mail, name, brand name or creative copy is sent). Details: Cookie Notice.
If you add other people's data to your brand content (for example people in photos, customer reviews), you are responsible for having the right to use it; we process it on your behalf to provide the service.
How we collect data
We collect data electronically, by automated or partly automated means: through sign-up and sign-in forms, what you type and upload in the app, the websites and accounts you ask us to connect (Google, Meta), approval and report links, and cookies.
Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Opening your account, signing you in, managing your team | Formation and performance of a contract (5/2-c) |
| Analysing your brand, producing ads, running approval and report links | Performance of a contract (5/2-c) |
| Calculating credit usage, billing, keeping accounting records | Performance of a contract (5/2-c), legal obligation (5/2-ç) |
| Sending service e-mails (invites, approval notices, password resets) | Performance of a contract (5/2-c) |
| Security, abuse prevention, debugging, improving the service | Legitimate interest (5/2-f) |
| Responding to legal requests, protecting rights | Legal obligation (5/2-ç), establishing, exercising or defending a right (5/2-e) |
| Measuring site use with analytics cookies | Explicit consent (5/1) |
You can withdraw consent at any time; this does not affect processing before the withdrawal.
AI processing
Morpho's team works with AI models. When you start a job, the relevant inputs (your messages, brand kit, products, images) are sent to AI providers, which process them to produce the output. Under their API terms, these providers do not use this data to train their models by default; they may keep it for a limited time to monitor abuse.
AI output can be wrong or incomplete; reviewing it before you publish is up to you. We do not make decisions with legal effects about you based solely on automated processing.
Sharing and service providers
To provide the service we share data with these providers, who process it on our behalf and on our instructions:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database, sign-in, file storage | European Union (Frankfurt) |
| Vercel | Hosting the site and the app | United States and global servers |
| Anthropic (Claude) | Chat, strategy, copy, design and web research | United States |
| Google (Gemini) | Image generation and editing | United States and global servers |
| ElevenLabs | Voiceover and music | United States / European Union |
| Amazon Web Services or GitHub Actions | Rendering videos | EU (Frankfurt) / United States |
| Resend | Sending service e-mails | United States |
| "Sign in with Google" (only if you choose it) | United States | |
| Google Analytics 4 | Measuring site use; only with consent, advertising features off | United States |
| Meta | Working with the ad account you connect; competitor research in the Meta Ad Library | United States / Ireland |
| Payment provider (planned: iyzico) | Taking payments, once live | Türkiye |
Beyond these, we only disclose data to authorities legally entitled to it, on request and as far as the law permits. If you connect Morpho to an AI assistant or another app, that app accesses your data on your behalf, within the permissions you grant.
International transfers
Some of the providers above are outside Türkiye. Your personal data is transferred to them to provide the service, in line with the conditions of KVKK Article 9.
Retention
- Account, brand and output data: while your account is open. When it is closed, it is deleted or anonymised within a reasonable time.
- Invoices and accounting records: for the period the law requires (for example up to 10 years under the Turkish Commercial Code and Tax Procedure Law).
- Approval and report link records: as long as the link and its brand exist; deleted with the link.
- Technical logs: for the short period needed for security and operations.
- Analytics data: at most 14 months in Google Analytics.
Security
Connections are encrypted with HTTPS. Passwords and link passwords are stored as one-way hashes; Meta access tokens are stored encrypted. Each workspace can only reach its own data, and access is limited by role. No system is risk-free; if a breach happens, we notify as the law requires.
Your rights
Under KVKK Article 11 you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- ask for incomplete or inaccurate data to be corrected,
- ask for it to be deleted or destroyed under the conditions of KVKK Article 7,
- ask for corrections and deletions to be notified to third parties it was transferred to,
- object to an outcome against you that results solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
Send your request, with details that let us verify your identity, through: Contact form coming soon. We answer within 30 days at the latest, as a rule free of charge. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (KVKK Kurulu).
Children
Morpho is for businesses and professionals; people under 18 should not use it. If we learn we hold data of someone under 18, we delete it.
Changes
We may update this policy. The current text is published on this page with its last-updated date; we announce significant changes by e-mail or in the app.
For the rules of use, see the Terms of Use.