Privacy Policy — Morphé

Morphé needs to know two things about you: an email address to which your licence key can be sent, and which computer that licence is running on. This policy sets out precisely what is collected, who holds it, where, why, and for how long.

Who is responsible for your data. The data controller is Metamorphic Additive Manufacturing Ltd, registered in England and Wales under company number 13634827, whose registered office is at Osprey House, Pegasus Business Park, Castle Donington, Nottingham, DE74 2TQ, United Kingdom. Our registration with the Information Commissioner's Office is number ZC241154.

For any question, or to exercise any right set out below, email support@morphe-design.app, quoting your subscription reference if you have one (it begins sub_ and appears in every email we send you). Email is our preferred channel and the quickest way to reach us. A request sent by any other means will still be accepted, but may take considerably longer to reach us and to be answered. We have not appointed a Data Protection Officer, and are not required to.

1. Summary
2. What the plug-in does on your computer
3. What we collect, why, and our lawful basis
4. Education eligibility, and the automated check
5. Who else handles your data
6. International transfers
7. How long we keep things
8. Your rights
9. Erasure, and the records we keep against it
10. Cookies and tracking
11. Security
12. Children
13. Changes to this policy
14. How to complain

1. Summary

Morphé sends no telemetry and collects no usage analytics. We do not know which components you use, how often you open Rhino, or what you make with it.
Your geometry never leaves your computer. Morphé uploads no model, mesh, field or Grasshopper definition anywhere.
We never see your card details. Stripe handles payment as merchant of record, and card numbers do not reach us.
We do not sell your data, share it with advertisers, or send marketing email. We collect no marketing consent at checkout, so there is no marketing list.
What we hold is an email address, a name, a plan, and a one-way fingerprint of each computer on which a licence is activated.

2. What the plug-in does on your computer

The machine fingerprint

In order to tie a seat to a computer, Morphé constructs a fingerprint: it takes the identifier Windows generated for itself at installation (MachineGuid, from the registry) together with your computer's name, and passes them through the SHA-256 hashing function. What leaves your machine is the resulting string — a one-way hash that cannot be reversed into either input.

Only if neither of those can be read does Morphé fall back to network-adapter hardware addresses. Nothing else is used: no processor identifier, no disk serial number, no graphics-card identifier, and no user name.

Your computer's name is also sent separately, in plain text, and stored as the display name of the activation, so that the seats on a multi-seat licence can be distinguished in support. Computer names are often personal ("Anna-Laptop").

The local licence file

Morphé stores a file at %LOCALAPPDATA%\Morphe\license.dat, encrypted with Windows DPAPI scoped to your Windows user account, so that no other account on the same computer can read it. It is kept in the local rather than the roaming part of your profile deliberately, so that on a network with roaming profiles it does not follow you to other computers. It contains:

your licence key;
the signed authorisation ("machine file") from the last successful check, which is what allows Morphé to work offline for 14 days, and which includes the licence record it belongs to and the fingerprint this computer was activated with;
the latest date and time this installation has seen, so that a clock wound backwards can be detected;
the last blocked state reported by the server, if any, so that the reason survives a restart.

The file resides on your computer, not ours, and we cannot read it. When you deactivate this computer, the file keeps only your licence key, still encrypted, so that you can activate again without retyping it; the authorisation and the fingerprint are removed, and the computer stays deactivated until you choose to activate. Forget key in the licence dialog removes the key as well — for instance before passing the computer to someone else. Deleting the file by hand removes the licence from this computer but does not release the seat; only deactivating from within Morphé, or asking us, does that.

What Morphé connects to

Morphé communicates with one destination: our licence provider's API (Keygen). It does so when you activate or deactivate, in the background when Morphé loads in Grasshopper and then about every six hours while Rhino stays open, and when you click Recheck now or Try again in the licence dialog. Each needs a connection, and Morphé keeps working without one for 14 days. Those requests carry your licence key, the fingerprint and the computer name; as with any internet request, your IP address is visible to the service receiving it.

3. What we collect, why, and our lawful basis

We rely on the UK GDPR and, where you are in the EU, the EU GDPR. "Contract" below means Article 6(1)(b) — processing necessary to provide what you have bought. "Legitimate interests" means Article 6(1)(f), and we name the interest in each case.

What	Why	Lawful basis
Name, email address, billing address, and business name and VAT number where given	To issue the licence, send the key, invoice you, answer support enquiries, and send the emails about your subscription described in section 5, among them reminders before a payment, notice of your 14 days to cancel, and confirmation when you cancel	Contract. For those subscription emails, also legal obligation where consumer law requires them. For our own copies of invoice records: legal obligation (tax and company records)
Card details	To take payment	Contract — but held by Stripe alone. They do not reach us
Subscription details: plan, seat count, dates, status, and your Stripe customer and subscription identifiers (the subscription identifier is the reference we print on every email)	To establish what you are entitled to, and to end that entitlement when the subscription ends	Contract
Machine fingerprint (hashed), computer name, activation and deactivation timestamps, and last check-in time	To tie seats to computers, to allow you to move a seat, and to enforce the seat limit you purchased	Contract, and legitimate interests in preventing licence sharing
University email address and academic role, on education purchases only	To verify eligibility for education pricing, and to deliver the licence key — which is sent to that address and no other	Contract, and legitimate interests in preventing misuse of a discounted price
Delivery records: that a licence key was emailed, to which address, the address that paid, when, and the mail provider's message identifier	To avoid sending a second key on a retry, to detect a bounce, and to be able to answer a card dispute	Legitimate interests in reliable delivery and in defending payment disputes — the reason this record outlives the others is explained in section 9
A log of computers activated and removed	The only record of seat movement that exists; used to establish whether a licence has been passed around, and to support a dispute	Legitimate interests in enforcing the licence and defending disputes
Operational alerts to our own support mailbox, which may quote your email address and subscription identifier	So that a person sees a held purchase, a failed delivery or a dispute the same day	Legitimate interests in operating the service correctly
Records of a full refund or a card dispute: the charge, the amount, the date, your email address and, for a dispute, the reason your bank gave	So that a refunded subscription is not left to bill again unnoticed, and so that a dispute can be answered and a decision taken about the subscription	Legitimate interests in operating the service correctly and in defending payment disputes
Support correspondence	To answer you, and to keep a record of what was agreed	Contract, and legitimate interests in maintaining a support history
Server logs from our licence service	To diagnose a failed purchase or a defect	Legitimate interests in security and reliability
When you visit this website: your IP address, browser details, the pages you view, the site you came from, and your cookie choice. If you accept analytics cookies, also an identifier that lets Squarespace recognise your browser when you return	To deliver the pages securely, and to count visits and see which pages are read	Legitimate interests in running a secure website and knowing how it is used. For analytics cookies, your consent, which you can withdraw at any time (section 10)

We do not use your data for profiling or advertising, and we neither sell nor rent it.

4. Education eligibility, and the automated check

When an education licence is purchased, the address given is checked automatically against a list of nearly 10,000 recognised university domains, a short list of research institutes and national academic namespaces that we maintain ourselves, and the address endings that registries reserve for education, such as .edu and .ac.uk. The checkout page asks for a university email address as a required field, and that address is checked first.

If the address is recognised, the key is issued immediately and sent to that university address, and to no other. Delivery is itself part of the check: it confirms that the address exists and that you can read it.

If no address is recognised, nothing is refused automatically. The purchase is held, you are emailed, and a person makes the decision on the basis of what you tell us. This is therefore an automated screening step with a human decision behind it, and not a solely automated decision within the meaning of Article 22.

The university email address and the academic role you select are stored as labels on your licence record at Keygen, and are visible to us. The check does not run on a licence we invoice by hand, because a person has already confirmed who the customer is.

5. Who else handles your data

Five services are involved, each used for a single purpose. Where each one stores data, and how the transfer out of the UK is covered, is set out in section 6.

Service	What it holds	Role
Stripe payments and subscriptions	Your name, email address, billing address, business name and VAT number where given, card details, invoices and receipts, subscription history, your acceptance of our terms at checkout, and the two education custom fields	Merchant of record for self-serve purchases, under Stripe's Managed Payments: for the sale itself Stripe is an independent controller with its own privacy policy, and we are additionally a controller of the customer records we read back from it. For a licence we invoice by hand, we are the seller and Stripe acts as our processor, issuing the invoice and taking the payment on our instructions
Keygen the licence server	Your licence key, your email address on the licence record, your Stripe customer and subscription identifiers, plan labels, the education flags and university address where given, and for each activated computer the hashed fingerprint, the computer name and activation timestamps	Processor acting on our instructions
Cloudflare our licence service and its key-value store	De-duplication markers for payment events; records of held education purchases (the email addresses given at checkout, domain, trial end date); delivery receipts for licence keys, and records of keys waiting to be sent again; reminders of full refunds and records of card disputes, each with the email address; the log of computer activations (which includes each computer's name and fingerprint); queued operational alerts; and short-lived server logs	Processor acting on our instructions
Resend email delivery	The recipient address and the content of the emails we send you, including your licence key, together with delivery, bounce and spam-complaint events	Processor acting on our instructions. Email is sent from Resend's EU region; its records are stored in the United States (section 6)
Squarespace this website	Your IP address and browser details, the pages you view and the site you came from, your cookie choice, and, if you accept analytics cookies, an identifier for your browser	Processor acting on our instructions, under Squarespace's Data Processing Addendum. For information it uses to run and secure its own platform, Squarespace is an independent controller with its own privacy policy

We also use an ordinary business mailbox (Microsoft 365, supplied through GoDaddy) for support@, sales@ and billing@. Anything you email us is held there.

Our own emails about your subscription are sent through Resend: the licence key, with a summary of the subscription's terms; reminders before a payment, 7 days before a free trial ends, 30 days and again 7 days before a yearly renewal, and 7 days before a monthly payment once every six months; a notice of your 14 days to cancel after the first payment following a trial and after each yearly renewal; confirmation when you cancel; on an education licence, the yearly check that you still qualify; and a notice when something about the subscription needs your attention or has ended: an education purchase held while we check eligibility, more computers activated than the licence has seats, a second subscription bought during a free trial, a fixed term about to end, and a subscription that has ended. When the key goes to an address other than the one that paid, the address that paid receives the same summary without the key. They are part of the service rather than marketing, so they are sent while the subscription runs and, where one is due, when it ends.

Stripe's own emails to you are sent by Stripe under Managed Payments, from Stripe's own addresses. Some are sent in every case and cannot be switched off: the confirmation when a trial begins, the reminder before it ends, receipts, invoices and refund notices. Others are sent because we have chosen to switch them on: reminders before a renewal, and notices about failed payments and expiring cards.

This website is hosted by Squarespace. Section 10 lists the cookies it uses and the choice you have about them.

6. International transfers

Keygen, Cloudflare and Resend are operated from the United States. Stripe contracts with us from Ireland and the United Kingdom, and Squarespace from Ireland, and both process data on infrastructure that includes the United States. Personal data therefore leaves the UK and the EEA, and for each service the transfer is covered as follows.

Stripe — contracting entities Stripe Payments Europe Limited (Ireland) and Stripe Payments UK Limited. Stripe's Data Processing Agreement incorporates the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU–US Data Privacy Framework.
Keygen — Keygen LLC, United States. Data is hosted on Amazon Web Services in Virginia, with encrypted backups elsewhere in the United States. Keygen relies on the Standard Contractual Clauses for transfers from the EEA and the UK, and its Data Processing Addendum forms part of its terms of service.
Cloudflare — Cloudflare, Inc., United States. Key-value data is stored in the United States and the European Union and cached at Cloudflare's edge locations. Cloudflare relies on the EU Standard Contractual Clauses as amended by the UK Addendum, and is certified under the EU–US Data Privacy Framework and its UK extension.
Resend — Plus Five Five, Inc., United States. Email content and delivery records are stored in the United States; the EU sending region we use governs where email is sent from, not where records are kept. Resend relies on the EU Standard Contractual Clauses, the UK Addendum, and the EU–US Data Privacy Framework with its UK extension.
Squarespace — contracting entity Squarespace Ireland Limited, with data processed by Squarespace, Inc. in the United States. Squarespace's Data Processing Addendum incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and Squarespace, Inc. is certified under the EU–US Data Privacy Framework and its UK extension.

You may ask us for a copy of the safeguards that apply.

7. How long we keep things

These are the periods actually configured, not intentions.

Record	Kept for
Payment-event de-duplication marker (an event identifier; no personal data)	7 days
"Key delivered" marker against a subscription	30 days
A licence key that did not arrive: the address it was sent to, the reason and when, kept so that the key can be sent again and our daily report lists it until it is	Until the key is sent again, and at most 60 days
Held education purchase: the email addresses given at checkout, domain, trial end date, customer identifier	90 days, or until resolved
Computer activation and removal log (event type, time, computer name and fingerprint)	400 days
Operational alert to our support mailbox	14 days after it is sent. An alert that could not be sent is kept until it is
Reminder of a full refund (charge identifier, amount, email address, date and billing period), kept so we can check the subscription was then cancelled or paid again	Until either happens, or until we confirm that the refund needs nothing further, and at most 400 days
Record of a card dispute (email address, amount, the reason your bank gave, the date, and the charge, subscription and licence identifiers), kept so we can answer the dispute and decide about the subscription	Until the dispute is decided and nothing is left to decide about the subscription, and at most 400 days
Licence-key delivery receipt (the address the key was sent to, the address that paid, plan, seats, licence identifier, customer identifier, message identifier, timestamp)	600 days — the reason is in section 9
Our licence service's logs	Up to 7 days
Email records at Resend	30 days
Keygen's own event log	3 days
Keygen's request log (IP address, the software that made the request, and the request and its response)	Up to 2 weeks
Your cookie choice on this website, stored in your browser	30 days
Squarespace's analytics cookies, stored in your browser, only if you accept them	Up to 2 years
Visit statistics for this website in Squarespace Analytics	In accordance with Squarespace's own policy
The licence record and its machine records (key, name, email address, the university address if given, plan, and per machine: fingerprint hash, computer name, timestamps)	While the subscription runs, and 12 months after it ends; then deleted automatically, machines and all
Stripe's records of the sale	In accordance with Stripe's own policy. Stripe is the merchant of record and keeps what tax and financial-services law requires of it
Our accounting copies of invoices and payouts	6 years plus the current financial year, as UK tax law requires
Support correspondence	24 months from the last message in the exchange, or until any related payment dispute is closed, whichever is later

Keeping a licence record for a year after a subscription has ended is deliberate: a card dispute can arrive months after a charge, and if everything has been deleted we cannot answer it. The standard dispute window is 120 days from the charge, so a year after the subscription ends covers it with room; the delivery receipt above is kept longer for the rare case that runs on.

8. Your rights

Under UK and EU data protection law you may ask us to:

Provide a copy of the personal data we hold about you (access).
Correct anything inaccurate or incomplete. You can change your own name and billing address in the customer portal. To change your email address, write to us from the address currently on your account; we change it for you, and your licence follows the new address automatically.
Delete your data (erasure). Section 9 explains the records we keep for a time after everything else is deleted, and why.
Restrict what we do with it while a question about it is resolved.
Provide a portable copy of the data you gave us, in a machine-readable form.
Cease processing based on legitimate interests, where your particular situation gives you grounds to object.

Email support@morphe-design.app, quoting your subscription reference. We respond within one month, and will tell you if a request is complex enough to require longer. There is no charge.

Some requests are dealt with more quickly at source: Stripe holds the payment side and is the controller for the sale itself, and its privacy policy explains how to contact it. Before asking Stripe, or Onelink, to delete your data, please note that Stripe then cancels your Morphé subscription at once, and the licence stops the same day, whatever remains of the period you have paid for. If you want to keep using Morphé until the end of that period, ask us instead, or ask Stripe after the period has ended.

9. Erasure, and the records we keep against it

We can delete almost everything on request. There are two records we will normally decline to delete immediately: the delivery receipt for your licence key, and your erasure request with our reply to it. It is fairer to explain them here than to leave you to discover them in an email.

When a licence key is emailed, we write a delivery receipt: the address it was sent to, the address that paid, the plan and seat count, the licence and customer identifiers, the mail provider's message identifier, and the time. It is the only evidence that what you paid for was in fact delivered. Everything else expires — the mail provider keeps email data for 30 days and our service logs for at most 7 — whereas a cardholder generally has 120 days in which to dispute a charge, and some card-scheme reason codes extend to approximately 540. A receipt written today therefore has to survive long enough to answer a dispute raised a year and a half later, and it is kept for 600 days.

We rely on Article 17(3)(e) of the UK GDPR: the right to erasure does not apply where the data is necessary for the establishment, exercise or defence of legal claims. In practice, if you ask us to erase your data:

we delete your licence record, your machine activations, your held-purchase record and your support correspondence, apart from your erasure request and our reply to it;
we keep your erasure request and our reply for 24 months from the reply, as our record that the erasure was carried out, and use them for nothing else;
we keep the delivery receipt, and we tell you that we have, and why;
we restrict it, so that it is used for nothing except answering a payment dispute about that sale;
it is deleted automatically at 600 days, by which point no dispute about that payment can be raised.
if a card dispute about one of your payments is still open, we keep its record on the same terms until the dispute is decided, and then delete it.

You are entitled to disagree, and if you do you may complain to the ICO (section 14).

10. Cookies and tracking

This website is hosted by Squarespace, which sets two kinds of cookie.

Necessary cookies are always set, because the site cannot run securely without them: crumb, which protects the site against forged requests and lasts until you close your browser; short-lived cookies that test whether your browser accepts cookies; and two that remember your cookie choices for 30 days.
Analytics cookies (ss_cid, ss_cpvisit, ss_cvisit, ss_cvr and ss_cvt) let Squarespace Analytics recognise a returning browser and link the pages viewed in one visit. They are set only if you accept them in the cookie banner. If you decline, or make no choice, they are not set. The longest-lived lasts 2 years.

Squarespace counts page views whether or not you accept analytics cookies; without them, it cannot tell one visitor from another.

To change your choice, clear this site's cookies in your browser, and the banner will ask again. There are no advertising cookies, and nothing on this site follows you to other sites.

Stripe's checkout and customer portal are separate pages operated by Stripe, and they set their own cookies. Stripe's privacy policy and cookie notice cover those.

The Morphé plug-in sets no cookies and does not track you.

11. Security

Card details do not reach us. Stripe holds them.
The licence file on your computer is encrypted with Windows DPAPI, scoped to your Windows user account.
Licence files are signed by our licence provider with RSA-2048, and the signature is verified on every load, so a forged or altered licence is rejected.
Our licence service holds its credentials as encrypted platform secrets, never in source code. Payment notifications are signature-verified before being acted upon.
The plug-in authenticates to the licence server with your own licence key, which can only query, activate and deactivate itself. No master credential ships inside Morphé.

No system is perfect. If we suffer a breach likely to place your rights at risk, we will notify the ICO within 72 hours and tell you without undue delay.

If you believe you have found a security problem in Morphé, please write to support@morphe-design.app.

12. Children

Morphé is professional and academic software, and is not directed at children. We do not knowingly collect data from anyone under 16. Education licences are intended for students in higher education. If you believe a child's data has reached us, please tell us and we will delete it.

13. Changes to this policy

The current version is always published at morphe-design.app/privacy, dated at the top. Where we make a change that materially affects you, we will email the address on your subscription before it takes effect.

14. How to complain

Please write to us first — support@morphe-design.app — since most matters are resolved more quickly that way.

You also have the right to complain to a data protection regulator. In the United Kingdom that is the Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113. If you are in the EU, you may complain to the supervisory authority in the country where you live or work.