Privacy Policy

1.1 Information you provide directly

Account information: name, email address, organisation or institution name (for institutional accounts), and billing information (processed by Lemon Squeezy — we never store payment card details).

Research inputs: the text you submit (abstract, results, or key findings), plus any DOI, PubMed ID, patent number, UN document number, or ArXiv ID you use to import metadata for already-published work.

Generated content: social media posts, scientific illustrations (2D and 3D), video abstracts, News & Views summaries, and hashtag sets produced through the platform — stored to power your account history, downloads, and refinements. Under Section 7 of our Terms of Service, morphedra may display generated content from individual accounts in public galleries, demonstrations, or marketing materials unless you opt out where an opt-out is available, and content generated under free plans may be displayed publicly after 90 days. Content generated under Team, Institutional, and Enterprise plans is never displayed publicly or used in marketing materials without your prior written permission.

Communications: messages you send to our support team and any feedback you provide.

1.2 Information collected automatically

• Usage data: pages visited, features used, generation history, session duration
• Technical data: IP address, browser type, device identifiers, operating system
• Authentication logs via Firebase (Google)
• Error logs and performance data for service reliability

1.3 Information we do NOT collect

• Full-text journal articles or PDF content
• Patient data or protected health information (PHI)
• Biometric data of any kind
• Data from users under 18

We use your information solely to:

• Provide, operate, and improve the morphedra platform
• Process research metadata and generate requested outputs
• Store your generation history and enable downloads
• Process payments and manage subscription status
• Send essential transactional emails (receipts, renewal notices, security alerts)
• Detect, investigate, and prevent fraud, abuse, and policy violations
• Maintain security logs and audit trails required for compliance
• Send service update notifications (you may opt out of non-essential communications)

We share your information only with the following categories of recipients, and only to the extent necessary to deliver the Service:

We may also disclose information: (a) if required by law or valid legal process; (b) to protect the rights, property, or safety of morphedra, our users, or others; (c) in connection with a merger, acquisition, or sale of assets, in which case the acquirer will be bound by this policy or notify you of changes.

When you submit research inputs, we send the minimum necessary content (typically your abstract or DOI metadata) to third-party providers (OpenAI, Google, Anthropic) solely to generate the output you requested. This processing is governed by each provider's API terms, which include data confidentiality commitments.

You are responsible for reviewing all the generated content before publication. morphedra outputs may contain inaccuracies and should be validated by domain experts prior to submission to journals, grant bodies, or public platforms.

Upon account deletion, we delete your account data within 90 days, and backups are cleared within 180 days after that. Billing records are retained for legal compliance regardless of account status.

Depending on your jurisdiction, you may have some or all of the following rights:

To exercise any right, email founder@morphedra.com with the subject line "Privacy Request — [Right]". We respond within 30 days.

For users in the European Union and European Economic Area, we comply with the General Data Protection Regulation (GDPR). Our lawful bases for processing are:

• Contract performance: processing necessary to deliver the Service you subscribed to
• Legitimate interests: fraud prevention, security, service improvement
• Legal obligation: retention of billing records and compliance with legal processes
• Consent: non-essential marketing communications (withdraw anytime)

Data is transferred to the United States for processing and hosting. We use Standard Contractual Clauses (SCCs, 2021) approved by the European Commission to safeguard these transfers. Our Data Processing Agreement (DPA), available at /dpa, applies automatically to Team, Institutional, and Enterprise plan customers, and a signed copy is available on request.

EU/EEA users may lodge a complaint with their national supervisory authority. A list of authorities is available at edpb.europa.eu .

Pakistan's comprehensive personal data protection legislation has not yet been enacted. Until it takes effect, we apply the following principles to all users, including those in Pakistan, and we will update this policy when such a law comes into force:

• Lawful processing: we process data only with a valid lawful basis
• Purpose limitation: data collected for one purpose is not used for incompatible purposes
• Data minimisation: we collect only what is necessary
• Storage limitation: data is not kept longer than necessary (see Section 5)
• Security: appropriate technical and organisational measures are in place

Pakistan-based users can exercise the rights described in Section 6 by contacting founder@morphedra.com.

We implement industry-standard security measures including:

No method of transmission or storage is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify affected users and relevant authorities in accordance with applicable law.

We use the following categories of cookies:

Where required by applicable law, we obtain your consent before setting non-essential cookies. You may manage cookie preferences through your browser settings. Note that disabling essential cookies will impair platform functionality.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered users
• Display an in-app notification for significant changes

Continued use of the platform after changes take effect constitutes acceptance of the revised policy. If you disagree with material changes, you may close your account before they take effect.