Your data. Clearly explained.

This privacy policy applies to the Morfable website and app. It explains how data is processed when you use the local camera, cloud-based AI features, accounts, purchases, support, diagnostics and this website.

When you visit the website, technically necessary connection data is processed, including your IP address, the time of the request, the requested URL, data transferred, referrer, and browser and device information. This supports secure delivery, troubleshooting and abuse prevention under Article 6(1)(f) GDPR. The website currently uses no advertising or profiling cookies. Depending on the domain you visit, it is delivered through Vercel or through OpenAI Sites with Cloudflare. The Morfable gateway runs on Vercel. Hosting providers process the connection data and server logs required for delivery, security and operation.

The local camera preview is not uploaded. Only when you select an AI style does Morfable send the necessary image frames, style or prompt, and technical session data over an encrypted connection to the Morfable gateway and the provider selected for that feature. The microphone is activated only for a recording or voice input you explicitly start. Facial features are processed for visual transformation, not for unique identification or to build a facial database.

Recordings, thumbnails, saved looks and settings are generally stored on your device. When you export or share content, you create a separate copy outside Morfable. Deleting content in the app later does not delete that copy.

Depending on the feature selected, Morfable may use Xmax or Reactor for live transformations, Decart for Lucy live models, JoyAI infrastructure operated by Morfable, fal.ai for studio try-ons, or OpenAI for speech-to-text. Supabase provides authentication, a database and private media storage; Vercel hosts the gateway; RevenueCat processes subscription entitlements. Sentry receives technical crash data only when diagnostics are enabled.

Data for requested transformations, recordings, saving and sharing, account management and billing is processed to perform a contract or take steps before entering into a contract under Article 6(1)(b) GDPR. Legally required billing and documentation data is processed under Article 6(1)(c) GDPR. Security, abuse prevention, stability and cost controls, and technically necessary logs rely on Article 6(1)(f) GDPR. Optional diagnostics, notifications and other expressly voluntary features rely on Article 6(1)(a) GDPR; you may withdraw your consent at any time with effect for the future.

Data is shared only with parties that need it for the selected feature: hosting and infrastructure partners, AI and media providers, authentication and private storage services, app stores and billing services, and diagnostics services only when enabled. Providers are selected on the server; long-lived provider keys are not stored in the app. Camera and media content is not shared for advertising or sold.

Limited technical events, such as the model, duration, latency, errors and cost values, help us operate the service and measure quality. The analytics pipeline does not accept raw images, videos, audio, full prompts, email addresses or direct authentication user identifiers. Private try-on inputs are normally deleted after one hour and no later than six hours. Client analytics are retained for no more than 90 days, technical usage events and security reports for no more than 180 days, and ended sessions and completed job metadata for no more than 30 days.

Data is transferred over encrypted connections; long-lived provider keys remain on the gateway. Depending on a service provider’s location, data may be processed outside the European Economic Area. Where no adequacy decision applies, we rely on appropriate safeguards, in particular EU Standard Contractual Clauses, or an applicable legal exception. You can request information about the specific safeguards from the contact address above.

You can revoke camera and microphone permissions in your operating system and delete your Morfable account and associated cloud data in the app. Depending on where you live, your rights include access, rectification, erasure, restriction, objection and data portability, as well as the right to complain to a data protection authority. The provider’s competent supervisory authority is generally the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

www.lda.bayern.de. Contact Morfable at support@roamscape.app.

Morfable does not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI results are creative outputs. We update this policy when features, providers or legal requirements change materially. The current effective date is shown on this page.

2026-08-31