Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains how CodeMorf Gran Canaria (“Morf.Codes,” “we,” “us,” or “our”), established in Gran Canaria, Spain, collects, uses, and protects your information when you use the Morf.Codes platform at app.morf.codes and related services (the “Service”). We are the data controller for the personal data described here.

1. Information We Collect

Information you provide

• Account information: name, email address, password (hashed with Argon2id), country or region, language preference, and optionally a profile photo
• OAuth identity: if you sign in with GitHub or Google, we receive your basic profile (name, email, avatar)
• User Content: projects, prompts, code, files, chat messages, and other content you create or upload
• Payment details: handled by our payment processor (Stripe). We receive billing status and identifiers, never full card numbers
• Communications: messages you send to our support or legal addresses

Information collected automatically

• Usage data: pages visited, features used, and actions taken in the Service
• Device and connection data: IP address, browser type, operating system, and timestamps
• Country estimate: derived from your IP address by our CDN (Cloudflare) and used only to choose your default language. We do not store the raw IP for this purpose
• Log data and diagnostics: error reports and performance traces used to keep the Service running

Information from third parties

If you connect an integration, we receive the data you authorise that integration to share, such as your GitHub repositories or your Google profile. If you sign in through an AI provider, we receive only the authentication result.

2. How We Use Your Information

• Provide, operate, and maintain the Service
• Authenticate you and keep your account secure
• Generate the code and content you ask for, and save your projects
• Show the interface in your language and region
• Process payments and manage subscriptions
• Send service messages, security alerts, and — only with your consent — product news
• Detect, investigate, and prevent abuse, fraud, and security incidents
• Comply with legal obligations and enforce our Terms of Service

3. AI Providers and Your Prompts

When you ask the Service to generate code or text, your prompt and the relevant project context are sent to the AI provider configured for your workspace. Depending on your configuration that may be Anthropic, OpenAI, GitHub Copilot, Google, or a provider you configure yourself. Their handling of that data is governed by their own privacy policies: Anthropic, OpenAI, GitHub.

We do not use your prompts or your projects to train our own models. Where a provider offers a training opt-out for API traffic, we use it. If you configure your own API key, your prompts go directly from our servers to that provider.

4. Legal Bases for Processing

Where the GDPR applies, we rely on: performance of a contract (providing the Service you signed up for), legitimate interests (keeping the Service secure, preventing abuse, improving the product), legal obligation (tax, accounting, and lawful requests), and consent (marketing communications and non-essential cookies), which you may withdraw at any time.

5. Cookies and Local Storage

We use strictly necessary cookies and local storage to keep you signed in and to remember your language and country preference (`morf_locale` and `morf_country`). We use analytics to understand aggregate usage. See our Cookie Policy for the full list and for how to control them.

6. Information Sharing

We do not sell your personal data. We share it only with processors that help us run the Service, and only as needed:

• Cloudflare — CDN, DNS, and country detection
• Hosting provider — the infrastructure that runs the Service
• Stripe — payment processing
• AI providers — the models that generate your content, as described above
• Google and GitHub — if you choose to sign in with them
• Email delivery — transactional messages such as signup confirmation and password resets

We may also disclose data where the law requires it, to protect our rights, or in connection with a merger or acquisition, in which case we will notify you.

7. Data Retention

We keep your account data while your account is active. If you delete your account, we remove your personal data and User Content within 30 days, except where we must retain records for tax, accounting, or legal reasons, or where data is held in backups until those backups rotate out. Aggregated, de-identified statistics may be kept indefinitely.

8. Security

Passwords are hashed with Argon2id. Sensitive values such as integration credentials are encrypted at rest with envelope encryption. Generated projects run in a sandbox with restricted filesystem, process, and network access. Access to production data is limited and audited. No system is perfectly secure, so please use a strong, unique password and report suspected issues to [email protected].

9. Your Rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority; in Spain that is the Agencia Española de Protección de Datos (aepd.es).

To exercise any of these rights, write to [email protected]. We will respond within one month, and we may ask you to verify your identity first.

10. International Transfers

We are established in the European Union, but some of our processors — for example Cloudflare, Stripe, and the AI providers — may process data outside the EEA. Where they do, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where relevant, the EU–US Data Privacy Framework. You can ask us for details of the safeguards in place by writing to the privacy address below.

11. Children’s Privacy

The Service is not directed to children under 14. We do not knowingly collect personal data from children under 14; in Spain, 14 is the age at which a minor can consent to information society services without parental authorisation. If we learn we have collected such data, we will delete it.

12. California Privacy Rights (CCPA/CPRA)

California residents have the right to know what personal information we collect, to request its deletion or correction, and to opt out of the “sale” or “sharing” of personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising. To exercise these rights, write to [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. For material changes we will provide additional notice, such as an email or an in-app banner.

14. Contact

Questions about privacy, or a request about your data? Write to [email protected].

CodeMorf Gran Canaria
Gran Canaria, Spain
Privacy: [email protected]