Privacy Policy

1. Controller

MORFOSAI ("we") is the controller of personal data collected through this website and app. Contact: info@morfosai.com.

2. Data we collect

• Account data: name, email, password (stored only as a hash).
• Profile data: gender, birth year, city, self-described ancestry, skin type, lifestyle, goals.
• Photos and derived biometric data: the face photos you upload, facial landmark coordinates and measurements computed from them. These may qualify as special-category data; they are processed only with your explicit consent.
• Usage data: session cookie, language preference, error logs.

3. Purposes and legal basis

Your photos and derived data are processed solely at your request to produce facial analysis, protocol and visualisations (explicit consent). Account and contact data are processed for the performance of the contract.

4. AI processors

Analysis texts and visualisations are generated through contracted processors (large-language-model and image-generation providers). Your photos are transmitted to these providers only for the duration of processing and are never used for model training.

5. Where your data is stored

Your account data, photos and analyses are hosted on Supabase in the Australia (Sydney) region, and our application servers run in the same region on Vercel. Your data is therefore stored outside Türkiye. This transfer relies on the explicit consent you give at sign-up (KVKK Art. 9). Data is encrypted in transit and at rest; photos are kept in a private storage bucket reachable only through your session.

6. Retention

Photos and analyses are retained while your account is open. When you delete your account, all data is permanently erased within 30 days.

7. Your rights

You have the right to access, rectify, erase, object to processing and to data portability. You can download your data or delete your account from the Settings page.

8. Cookies

Only strictly necessary cookies (session, language) are used. No marketing cookies.