Morphos
Try it now

Privacy policy

This English version is provided for information only. The German version is the legally binding one.

Privacy policy

For the website morphos-ai.de and the Morphos AI app

Last updated: 19 September 2026

I. General information

1. Controller and contact

The controller within the meaning of the GDPR is:

Nonna Völk (sole proprietorship), trading as "Morphos AI"
Reutlinger Str. 4
73230 Kirchheim unter Teck
Germany
Email: support@morphos-ai.de

If you have questions about this policy or would like to exercise your rights, please send your request to support@morphos-ai.de.

2. Legal bases

We process personal data only on the basis of a statutory permission: with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), for the performance of a contract or to take steps prior to entering into a contract (Art. 6(1)(b) GDPR), to comply with a legal obligation (Art. 6(1)(c) GDPR) or to safeguard legitimate interests, provided that your interests and fundamental rights do not override them (Art. 6(1)(f) GDPR).

Health data and other special categories of personal data are processed by us exclusively on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR. Further details in section II.1.

3. Duration of storage

In the case of a termination or a withdrawal from a contract via the public forms, we process the name, the email address for the confirmation, contract details, the type of statement and the time of receipt; in the case of terminations, where applicable also the reason given and the desired end date. This information serves to process and to document your statement (Art. 6(1)(b) and (c) GDPR as well as (f) for defending against claims); you receive an acknowledgement of receipt by email. To protect against misuse, we briefly use a check value derived from the IP address and hashed with a secret key. We do not store the original IP address in the termination table.

Unless otherwise stated in the following notices, we store personal data only for as long as is necessary to achieve the respective processing purpose or to fulfil our contractual and legal obligations. We then delete or anonymise it.

Statutory retention obligations, in particular under commercial and tax law provisions, remain unaffected. If data is affected by these, we block it from any further use.

Data based on consent is processed by us until you withdraw it. Data required for the performance of the contract is processed for the duration of the contractual relationship and beyond, insofar as this is necessary for asserting or defending against claims.

4. Recipients of the data

When processing your data, we use processors, in particular for hosting, IT operations, support, payment processing, subscription management, email dispatch and push notifications. Processors do not use the data for their own purposes but exclusively in accordance with our instructions and are contractually obliged under Art. 28 GDPR to take appropriate technical and organisational measures.

In addition, we may transmit data to bodies such as our bank, tax advisor or the tax authorities as well as to public authorities and courts, insofar as we are legally obliged to do so. Further recipients result from the following notices.

You can request a current overview of the service providers used at support@morphos-ai.de.

5. Transfer to third countries

Our processing operations may involve the transfer of personal data to third countries. Such a transfer only takes place if the European Commission has determined an adequate level of data protection, if appropriate safeguards pursuant to Art. 46 GDPR exist or if one of the conditions of Art. 49 GDPR is met.

Insofar as there is no adequacy decision and nothing else is stated below, we use the standard contractual clauses of the European Commission as an appropriate safeguard. In the case of certified US providers, we additionally rely on the EU-US Data Privacy Framework. You can request a copy of the standard contractual clauses at support@morphos-ai.de.

We point out that in third countries, despite these safeguards, access by local authorities cannot be entirely ruled out and that data subject rights may not be enforceable there in the same way.

6. Your rights

As a data subject you have in particular the following rights:

  • Access pursuant to Art. 15 GDPR and Section 34 BDSG as to whether and to what extent we process data relating to you
  • Rectification of inaccurate or incomplete data pursuant to Art. 16 GDPR
  • Erasure pursuant to Art. 17 GDPR and Section 35 BDSG
  • Restriction of processing pursuant to Art. 18 GDPR
  • Data portability pursuant to Art. 20 GDPR
  • Withdrawal of consent pursuant to Art. 7(3) GDPR with effect for the future; the lawfulness of the processing carried out until then remains unaffected
  • Complaint to a supervisory authority pursuant to Art. 77 GDPR

To exercise these rights, a message to support@morphos-ai.de is sufficient. We answer requests within the statutory time limits.

The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, https://www.baden-wuerttemberg.datenschutz.de.

7. Right to object

Pursuant to Art. 21(1) GDPR you have the right to object at any time, on grounds relating to your particular situation, to processing operations based on Art. 6(1)(e) or (f) GDPR.

If your data is processed for direct marketing purposes, you can object to this processing at any time pursuant to Art. 21(2) and (3) GDPR.

8. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. These include in particular encrypted transmission via TLS, encrypted storage on the servers, storage of passwords exclusively as a cryptographic hash, access restrictions based on the principle of least privilege as well as regular backups. Our measures are continuously adapted to the state of the art.

9. Minors

Our service is intended exclusively for adults aged 18 and over. Parental consent does not allow minors to use it. We use the date of birth provided in the profile to check eligibility and calculate nutrition goals. The eligibility check serves performance of the user agreement and enforcement of our access requirements (Art. 6(1)(b) and (f) GDPR); section II.1 additionally applies to health data. We do not send new usage requests to our AI services when the age requirement is missing or not met. If we become aware of data relating to a minor, we restrict access, clarify the situation and delete data that is no longer necessary, subject to statutory retention requirements. Individuals and guardians can contact support@morphos-ai.de.

10. Changes

We adapt this privacy policy if our offering or the legal situation changes. The respective current version is available at https://morphos-ai.de/datenschutz and in the app. In the case of material changes, we will inform you in advance and, where necessary, obtain new consent.

II. Data processing in the Morphos AI app

1. Health data

Morphos AI is an app for recording nutrition, calories and nutritional values. In doing so, we process data that provides information about your health and is therefore specially protected under Art. 9 GDPR. This includes in particular:

Height, weight and weight history, target weight, age and gender, body measurements and body fat percentage, calories consumed as well as macro- and micronutrients, individual meal entries, dietary style and nutrition goals, intolerances and allergies, water intake, fasting times, activity level, steps and workouts, recorded or imported vital values such as blood pressure, blood glucose or resting heart rate, cycle data as well as body and meal photos, insofar as you save them.

The legal basis is your explicit consent pursuant to Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR. We obtain it separately during onboarding, separately from acceptance of the terms and conditions.

Purposes: calculation of your individual calorie and nutrient target, evaluation of your entries, presentation of history and progress, provision of personalised notes and recipe suggestions as well as the synchronisation with health platforms requested by you.

Without this consent we cannot provide the core functions, because calculating your target is technically impossible without body data. Use of the app is voluntary. You can withdraw your consent at any time in the app settings or by sending a message to support@morphos-ai.de; we will then delete the data concerned.

We do not use health data for advertising, for advertising audiences or for profiling for advertising purposes. We do not sell it and do not pass it on to advertising networks.

2. User account

A user account is required to use the app. Mandatory details are the email address and password; we store the password exclusively as a cryptographic hash. You can voluntarily provide a name or display name and a profile picture.

Alternatively, you can register via "Sign in with Apple" or "Continue with Google". In doing so we receive a user identifier and, depending on your selection, your email address or a forwarding address, and with Google additionally, optionally, your name and profile picture. The providers are Apple Distribution International Ltd. (Ireland) and Google Ireland Limited (Ireland).

Legal basis: Art. 6(1)(b) GDPR.

3. Camera, photos and AI recognition

The app uses the camera for the barcode scanner and for photo recognition of meals. When scanning a barcode, the recognised code is processed for the product search; the camera image itself is not stored.

In the case of photo recognition, we transmit the image you have taken or selected to our AI service provider (section II.5) and receive back an estimate of the foods and nutritional values, which you can confirm or correct. We do not evaluate location details from image metadata.

In addition, you can save body and progress photos; we treat these as health data pursuant to section II.1.

You grant access to the camera and photo library via your operating system's system prompt and can withdraw it there at any time. The relevant function is then no longer available.

Legal basis: Art. 6(1)(b) GDPR, and for photos relating to your body or nutrition profile additionally Art. 9(2)(a) GDPR.

4. Recipes and your own content

You can create recipes and import them from external sources. In doing so, we process the texts, ingredients and quantities you enter, uploaded images, the transmitted source URL together with the content read from it, as well as your favourites, collections and plans. Your recipe collection is not made available to other users or published as a public recipe catalogue. Recipe images are stored in non-public storage; the app retrieves them through time-limited access links. Necessary access by processing providers and authorised access for operation, troubleshooting and support remain possible as described in the relevant sections of this policy.

Legal basis: Art. 6(1)(b) GDPR, and where there is a health-related aspect additionally Art. 9(2)(a) GDPR.

For the link import triggered by you, we use Apify and Firecrawl depending on the source. For this, the source URL and the content to be retrieved from it are transmitted to the respective service. The retrieved recipe content can then be structured by Google Gemini (section II.5). Therefore, do not transmit links containing private access data or secret sharing keys. Provider information: https://docs.apify.com/legal/privacy-policy and https://www.firecrawl.dev/privacy-policy.

5. Artificial intelligence

We use AI models to recognise foods and portions in photos, estimate nutritional values, convert free-text entries into structured entries, structure imported recipes and create suggestions for you.

The technical service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

The data transmitted via the programming interface is not used to train or improve the provider's models. The transmission is limited to what is necessary for the respective request; we do not transmit real names, email addresses or account data.

Legal basis: Art. 6(1)(b) GDPR, and insofar as health data is concerned additionally Art. 9(2)(a) GDPR.

AI-generated results are approximate values and can be incomplete or inaccurate. No automated decision in an individual case within the meaning of Art. 22(1) GDPR takes place.

Voluntary voice input: If you start the dictation function, the speech recognition available in your browser or operating system processes the recording in accordance with the respective provider's terms. If this function is not available, the recording is transmitted to Google Gemini for transcription. The recognised text is displayed to you for further use. Microphone access and AI processing require the corresponding permissions; you can enter text instead.

6. Linking with health platforms

You can optionally connect the app with Apple Health, Health Connect or Samsung Health. This link is voluntary and not required for use.

Depending on the permissions granted, the following may be transmitted: steps, distance, energy expenditure, workouts, weight, body measurements, body fat percentage, blood pressure, blood glucose, resting heart rate and cycle data. From us to the platform, dietary energy, nutrients, water intake and weight may be written back.

Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR, in each case in addition to your operating system's system prompt.

We use data from Apple Health exclusively for health and fitness functions within the app, not for advertising, marketing or data mining and not for passing on to third parties for these purposes. For Health Connect we comply with the access and permissions policy including the requirements for restricted use. If Android requires a location permission for individual Health Connect functions for system-related reasons, we nevertheless do not collect or store your location.

You can remove any link at any time in the app settings or in the respective platform.

Providers: Apple Inc. / Apple Distribution International Ltd. (Ireland), Google Ireland Limited (Ireland), Samsung Electronics Co., Ltd. (Republic of Korea; an adequacy decision of the European Commission exists).

7. Technically collected data

When installing and using the app, we process device type, operating system and version, app version, language and region, time zone, shortened IP address, time of installation and registration, an installation-related identifier as well as error and crash reports.

Purpose: operation, stability, troubleshooting as well as prevention of misuse and fraud.
Legal basis: Art. 6(1)(b) and (f) GDPR. Insofar as information on your device is accessed that is not strictly necessary for provision, this only takes place with your consent pursuant to Section 25(1) TDDDG.

8. Push notifications

Voluntary reminders: You can switch on reminders for breakfast, lunch and dinner individually and set their times. All three are switched off initially. For the reminder function, we store your selection, times and time zone in your Morphos account. Before sending, our server checks whether you have already logged the relevant meal on that day. This check takes place in our backend.

Provider and delivery: For server push we use OneSignal, Inc., 201 S. B Street, Suite 200, San Mateo, CA 94401, USA. On Android, delivery takes place via Firebase Cloud Messaging from Google, on iOS via the Apple Push Notification service. Messages can also appear when the app is closed if you allow notifications in the operating system.

Personal return reminder: You can optionally save your personal reason for your goal. This alone does not enable notifications. If you explicitly enable the return reminder, we store your latest use of the app in the foreground, your chosen time, time zone and language. After 3, 7 and 14 days without using the app, we may send one friendly notification containing your goal and your own reason or selected motivation. No further reminders follow until you use the app again. Missed earlier reminders are not sent together later. This message is shared with OneSignal and may appear on your lock screen. No AI-generated text is used for this feature. We keep only the latest app-use time and a current sending record, not a history of your app activity. You can disable the feature and change or remove your reason at any time. Disabling it deletes the associated app-use time and sending record. Your voluntarily saved reason stays in your profile until you remove it or delete your account.

Data processed: When it is initialised and used, the OneSignal SDK contained in the native app processes push tokens, device and subscription identifiers, permission status, device model, operating system, app version, language, time zone as well as technical usage data such as session times and duration. In addition, there is the message content and available sending, delivery and open information. The IP address is processed for the connection and an approximate country assignment; according to OneSignal, IP addresses of users in the EU are not stored there. Provider information: https://documentation.onesignal.com/docs/en/data-collected-by-the-onesignal-sdk.

For assignment to your signed-in session, we transmit a random identifier. Our meal reminders contain a general prompt to open the app. In doing so, we do not transmit any email address, meal content, calorie values, weight details or photos to OneSignal. We do not use the push data for advertising audiences.

Legal bases and withdrawal: The voluntary reminders are based on your consent pursuant to Art. 6(1)(a) GDPR; insofar as information that is not strictly necessary is stored on or read from your device, additionally on Section 25(1) TDDDG. The check of your nutrition entries is additionally governed by section II.1. You can switch off individual meal reminders in the app settings or block the display of all notifications in the operating system settings. The system permission concerns the display of messages; withdrawing it does not automatically delete identifiers already stored at the provider.

Storage and transfer to the USA: The push settings and assignments are stored for the reminder function for as long as they are needed for it; section I.3 and your rights under section I.6 apply in addition. You can request access and erasure at support@morphos-ai.de. OneSignal also processes data in the USA. The provider indicates certification under the EU-US Data Privacy Framework; in addition, its data processing agreement provides for standard contractual clauses for relevant third-country transfers. Further information: https://onesignal.com/privacy_policy, https://onesignal.com/dpa and https://documentation.onesignal.com/docs/en/eu-us-data-privacy-framework.

Local notifications: Cooking timers and locally configured supplement reminders are scheduled via the native app with your device's operating system. For scheduling these messages we do not send any request to OneSignal. Depending on your device settings, notifications may be visible on the lock screen.

9. Backend and storage

We operate the database, authentication and file storage at Supabase, Inc. (USA) in the EU Central region (Frankfurt am Main) on servers in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place.

As the provider is based outside the EU, access from a third country in the context of support and administration cannot be entirely ruled out. In this case, the safeguards under section I.5 apply.

10. Deletion of your account

You can delete your account at any time in the app under Settings, via https://morphos-ai.de/konto-loeschen or by sending a message to support@morphos-ai.de. To protect against misuse, you confirm the deletion via a link that we send to the email address of your account; only then is the deletion carried out.

In doing so, we delete your account data, all health, nutrition and body data including entries, histories, photos and evaluations, your recipes and plans, links to third-party services as well as device- and installation-related identifiers.

If backups still contain copies of this data, these are overwritten as part of the regular backup cycle. Until then, the data is no longer available for ongoing operations.

We retain invoices and payment records due to commercial and tax law obligations pursuant to Section 147 AO and Section 257 HGB and block them from any further use. These include the subscription events from RevenueCat (purchase, renewal, termination), which after deletion contain only a pseudonymous user identifier. They contain no health data.

11. Recipe links via Instagram

When you send a recipe post to our Instagram profile @morphos.app, our automated link service may reply with a link to import it into Morphos. The service processes the sender identifier, message identifier, timestamp and shared recipe link supplied by Instagram. It does not permanently connect your Instagram account to your Morphos account. Your existing Morphos sign-in is used only when you open the import link; the consent and safeguards for AI processing in section II.5 still apply. No Morphos profile, health or subscription data is sent back to Instagram.

The import link is valid for 24 hours. Our technical delivery records contain the public recipe URL, keyed check values derived from the sender and message identifiers, the time and delivery status. We do not store complete message texts, Instagram passwords or the original sender identifier in those records. The check values prevent duplicate replies and limit abuse. Recipe URLs are removed at the next hourly cleanup after 24 hours; the remaining check values are removed at the next hourly cleanup after seven days. Imported recipes follow the normal storage and deletion rules of your Morphos account.

Instagram and the linked business inbox may continue to contain your original message and our reply. The Instagram provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; information about its processing and your rights is available at https://www.facebook.com/privacy/policy/. We also use our inbox to handle your enquiries. Please do not send health data via Instagram. For access or erasure requests addressed to us, contact support@morphos-ai.de and identify the Instagram profile concerned.

Legal bases: Art. 6(1)(b) GDPR for the import service you request and Art. 6(1)(f) GDPR for the narrowly limited delivery and abuse controls. The general information about recipients and international transfers in section I also applies.

III. Purchases, subscriptions and payments

1. Purchases via the app stores

You can purchase Morphos AI Pro as an in-app purchase via the Apple App Store or Google Play. Payment processing takes place entirely via the respective distribution platform; we do not receive any complete payment data. We process the subscription status, start, renewal and end date, a transaction identifier of the platform as well as the country of the store account.

Legal basis: Art. 6(1)(b) and (c) GDPR.

2. Purchase via our website

For purchases via https://morphos-ai.de we use RevenueCat Billing for checkout, subscription management and invoices. Payment processing takes place via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

We transmit to Stripe the information required for processing, in particular name, email address, invoice amount and term. You enter your payment data directly with Stripe; we do not receive or store it. Only a pseudonymous payment method identifier and the payment status are reported back to us.

Stripe otherwise processes payment information on its own responsibility, in particular for fraud prevention and to fulfil its own regulatory obligations. Further information: https://stripe.com/de/privacy

Legal basis: Art. 6(1)(b) and (c) GDPR as well as Art. 6(1)(f) GDPR for fraud prevention.

3. Subscription management

For the technical management and synchronisation of subscriptions across platforms, we use RevenueCat, Inc. (USA) as a processor. Processed are a pseudonymous app user identifier, purchase and receipt data of the respective platform, subscription status, term and trial phase status as well as device and app information.

For web subscriptions, RevenueCat additionally processes your email address as well as the invoicing and transaction details required for checkout, invoices and tax calculation. RevenueCat uses these to send receipts and notifications regarding your subscription.

RevenueCat does not receive any health data. Complete card details are processed by Stripe and not stored by us.

A data processing agreement pursuant to Art. 28 GDPR is in place; for the transfer to the USA the safeguards under section I.5 apply. Further information: https://www.revenuecat.com/privacy

Legal basis: Art. 6(1)(b) GDPR.

IV. Use of our website

1. Hosting

The website morphos-ai.de and the web application morphos-app.de are provided via Cloudflare, Inc. (USA). In doing so, Cloudflare processes in particular the IP address, technical connection data and the content required to execute the respective request. The infrastructure is distributed worldwide; processing exclusively in Germany is not guaranteed for this. For third-country transfers, the information in section I.5 applies. Further information: https://www.cloudflare.com/privacypolicy/. Legal basis: Art. 6(1)(b) GDPR for the requested app functions and Art. 6(1)(f) GDPR for secure technical provision.

STRATO remains the service provider for domain registration and the email mailboxes set up there. We send automatic account and notification emails via Resend. For this, the dispatch service receives the recipient address and the content of the respective message, for example a confirmation or recovery link. Further information: https://resend.com/legal/privacy-policy.

2. Server log files

When the website is accessed, the server automatically collects the browser type and version, operating system, referrer URL, shortened IP address, date and time of the request as well as the file accessed and the amount of data transferred. We do not merge this data with other data sources.

Purpose: technical provision, stability, security and investigation of misuse.
Legal basis: Art. 6(1)(f) GDPR.

3. Cookies and comparable technologies

We use technically necessary cookies and comparable storage mechanisms for sign-in, account security and order processing. Insofar as they are strictly necessary for the service you have expressly requested, access takes place pursuant to Section 25(2) no. 2 TDDDG; the data processing serves the performance of the contract and secure operation (Art. 6(1)(b) and (f) GDPR). For processing by the payment providers on their own responsibility, their information in section III applies in addition.

Optional services for reach and advertising measurement are loaded exclusively following your voluntary selection under "Cookie settings". Without consent, no connection to these tracking services takes place, and no cookieless measurement either. You can see there which services are actually activated and selectable. The app at morphos-app.de does not use any advertising tracking.

Your selection is stored locally in your browser for up to 180 days together with the time, validity period and the associated configuration version (morphos_marketing_consent). This necessary storage serves to implement your decision and not to ask you again on every page view. It is not linked to your Morphos account. If the providers used change or the period expires, we ask again. Legal basis: Section 25(2) no. 2 TDDDG as well as Art. 6(1)(c) GDPR for observing your consent decision.

Website language: We use the country code supplied by our hosting provider Cloudflare for the initial language: For supported countries we choose an available language; other or unknown countries receive English. We do not contact an additional location service or store the IP address in a separate language database. You can change the language at any time. We remember your explicit choice in the morphos_site_lang cookie for up to one year; it contains only the language code and is not used for advertising measurement.

4. Contacting us

WhatsApp support and feedback: You may voluntarily contact us via WhatsApp Business at +49 1523 3896509. We process your telephone number, displayed profile name, messages and voluntarily submitted attachments to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering questions and improving our service based on feedback. The retention periods in section I.3 apply. We use anonymised findings for general product improvements wherever possible.

Our WhatsApp links are simple external links. WhatsApp is opened only when you follow a link; we do not load a WhatsApp widget or automatically pass your Morphos profile or health data to it. For users in the European Economic Area, the service is provided by WhatsApp Ireland Limited. WhatsApp also processes connection and usage data under its own terms, including possible processing outside the EU/EEA. See the WhatsApp Privacy Policy for details.

Please do not send health data, passwords or payment details via WhatsApp. For account-related matters, use the support chat in Morphos or support@morphos-ai.de. WhatsApp is not required to obtain support. Contacting us does not subscribe you to marketing messages. For access or deletion requests addressed to us, identify the telephone number concerned; WhatsApp's own processing is governed by its privacy policy.

If you write to us by email, we process your details in order to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR. If your enquiry concerns health data, additionally Art. 9(2)(a) or (f) GDPR.

V. Reach measurement and advertising

1. Your selection and the events measured

On the public marketing pages of morphos-ai.de we may use the services named below with your consent. Services that are not set up are marked as not activated in the cookie settings and are not loaded. You can reject all optional services, select individual ones or change your decision at any time via "Cookie settings". Rejecting and withdrawing do not impair use or the conclusion of a subscription. The lawfulness of the processing prior to a withdrawal remains unaffected.

Measurement using provider scripts is limited to the home page and the pricing page as well as the click that starts the funnel. In doing so, IP address, browser and device information, time, public page address and cookie or ad click identifiers may be processed. These identifiers can be linked to an existing user account at the provider. Campaign texts, URL fragments and freely entered form values are not transmitted as event data by our measurement integration. Account, login, onboarding, checkout, profile, legal and support pages are excluded from the optional tracking scripts.

Health, weight, nutrition and vital data as well as onboarding answers are not used for advertising or advertising audiences and are not transmitted to advertising networks. Automatic or manual matching of email address, telephone number or Morphos user identifier with advertising networks is not activated. The native app and morphos-app.de do not use any advertising tracking. The optional RevenueCat SDK analytics events and the automatic collection of campaign parameters by RevenueCat also remain deactivated.

Legal basis for optional measurement: your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

2. Meta pixel (Facebook and Instagram)

The provider for persons in the EU is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel helps to attribute visits and start clicks to our Meta ads and to evaluate their effectiveness. Meta can link the information to your Meta account and process it for its own purposes explained in its privacy policy. Automatic event detection and advanced matching are switched off in our setup. Typical first-party browser cookies are _fbp and _fbc with a usual lifetime of up to 90 days; browser restrictions can shorten these.

For the collection and transmission of event data there is joint controllership pursuant to Art. 26 GDPR to the extent of the Meta agreement; the subsequent processing by Meta is its responsibility. Information on the agreement: https://www.facebook.com/legal/controller_addendum. Information on data processing and on exercising your rights towards Meta: https://www.facebook.com/privacy/policy/.

3. TikTok pixel

The providers in the European Economic Area are TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited, United Kingdom, in accordance with the relevant TikTok terms. The pixel serves to attribute visits and start clicks to TikTok ads. TikTok can link events to an existing TikTok account and use them for the purposes described in its information. Automatic advanced matching, automatic event detection and additional collection of page content are switched off for our setup. Typical identifiers are _ttp and ttcsid or pixel-specific variants. For its pixel cookies, TikTok generally states up to 13 months, depending on the cookie and browser.

Information on the respective responsibility, processing and storage period: https://ads.tiktok.com/i18n/official/policy/business-products-terms and https://www.tiktok.com/legal/page/eea/privacy-policy/de. Information about pixel cookies: https://ads.tiktok.com/help/article/using-cookies-with-tiktok-pixel.

4. Google Ads and Google Analytics 4

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads serves to attribute visits to our ads. Google Analytics 4 evaluates visits and start clicks on the public marketing pages. Both services can be selected separately. Google Signals, automatic enhanced measurement, enhanced conversions with contact data and personalised advertising audiences are not activated in this setup. The IP address is processed technically when the connection is established; Google states that it does not log or store it in GA4.

We use Google's Consent Mode in its basic variant: without the corresponding consent, the Google script is not loaded. Typical cookies are _ga or _ga_* for Analytics and _gcl_* for ad attribution. Our Google tag configuration limits the cookie lifetime to 180 days; individual cookies may apply for a shorter period. The retention of event data is additionally governed by the settings of the respective service.

With your Google Ads consent, we also store a Google click identifier on the home, pricing, recipe and weekly planning pages for up to 30 days. The protected cookie __Host-morphos_ads contains a random reference. After sign-in, we link it internally to the purchase account. To measure the first confirmed paid web purchase, Google may receive only the click identifier, purchase time, actual amount paid, currency and a separate random order identifier. Email addresses, internal user identifiers, profile and health data are not transmitted. Free trials and sandbox payments do not count as purchases. Refunds are reviewed for correction.

We remove the click identifier after at most 30 days or on withdrawal. Internal consent and review records are generally kept for up to 180 days; outstanding corrections are retained until resolved. Withdrawal through “Cookie settings” also blocks server-side attribution. If the connection fails, we display this and retry withdrawal when connectivity returns or on your next visit. This does not affect the lawfulness of prior processing. If you no longer have access to the original browser, contact support@morphos-ai.de.
Further information: https://policies.google.com/privacy?hl=de and https://policies.google.com/technologies/partner-sites?hl=de.

5. Transfers and withdrawal

When these providers are used, processing outside the EU/EEA is possible. The applicable adequacy decisions or appropriate safeguards are authoritative, in particular standard contractual clauses and supplementary measures; details are given in the linked provider information. Certification or a particular safeguard is not assumed here across the board for every provider and processing step.

Upon withdrawal, we stop the corresponding measurement calls and reload the page so that tracking programs already loaded are terminated. Known optional identifiers on our domain are removed as far as technically accessible. Third-party cookies set by the providers themselves and data already stored there cannot be deleted by us directly in your browser or provider account; the browser settings and the rights procedures of the respective provider are available for this.

VI. Newsletter and advertising by email

1. Sign-up

You can subscribe to our newsletter; in it we provide information about functions, recipes, nutrition topics and offers. Sign-up takes place using the double opt-in procedure: after you have entered your details, we send you an email with a confirmation link and only add you to the distribution list after your confirmation. Processed are the email address and, optionally, your first name.

During pre-launch, you can join the waitlist for the exclusive introductory offer and subsequent Morphos newsletter. We store your chosen language and signup source to send suitable emails and identify eligibility for the waitlist offer. Joining is free and does not create a paid subscription. We provide the introductory offer's price and terms before any purchase.

Legal basis: Art. 6(1)(a) GDPR. Sign-up is voluntary and not a prerequisite for using our services.

2. Logging

To document a proper sign-up, we log the time of entry, the time of confirmation and the shortened IP address used in the process. Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 7 UWG. We keep these logs to document consent and process them exclusively for this purpose.

3. Performance measurement

If you have given separate consent, we measure whether and when you opened an email and which links you clicked in order to better tailor content. Legal basis: Art. 6(1)(a) GDPR. You can withdraw this consent independently of receiving the newsletter.

We do not use any health data to select recipients.

4. Advertising to existing customers

We may use the email address received in connection with a purchase for direct advertising of our own similar services. Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG. You can object to this at any time without incurring costs other than the transmission costs at the basic rates; an unsubscribe link is included in every email.

5. Unsubscribing

You can unsubscribe at any time via the unsubscribe link in every email or by sending a message to support@morphos-ai.de.

6. Dispatch service provider

For dispatch we use an email dispatch service provider as a processor. We will inform you of the provider currently used on request to support@morphos-ai.de.

VII. Creator programme

In the Creator Studio we process account and contact details, business and representative details, public social profiles, billing addresses, tax information and bank details (account holder, IBAN, optional BIC and bank information). We also process individual terms, contract versions and acceptance records, commission entries, invoices and, where specifically requested, additionally signed agreements. This serves to establish and perform the partnership, settle commissions and document agreements. The legal basis is Article 6(1)(b) GDPR and, for statutory retention duties, Article 6(1)(c). Processing representatives' details and necessary security and evidence logs is based on Article 6(1)(f), our legitimate interest in secure and accountable management of business relationships.

Creators can access their own records; authorised Morphos administrators manage the programme. Banking details, invoices and agreements are not public. Contract copies are sent using Resend. We use Supabase for accounts, the database and private files, and Cloudflare for the website. The executing bank receives details needed for payment. The general information on these providers and possible international transfers applies.

When a customer explicitly uses a creator code, we remember it for up to 24 hours in the browser tab's session storage. Confirmed web transactions are attributed to the code to apply the offer and account for commissions. Creators receive pseudonymous customer references and transaction amounts, not customer names, email addresses, nutrition or health data. This processing is based on performing the requested offer and our legitimate interests in accurate commission accounting and fraud prevention (Article 6(1)(b) and (f)). Attribution does not use advertising pixels and is separate from optional marketing consent.

Records are retained for the partnership and subsequently where statutory retention or the establishment, exercise or defence of claims requires this. They are then deleted or anonymised. The rights and contact details in Section I apply to creators as well. Without necessary business, contract and billing information we cannot administer participation or payouts.