Morph

Data Processing Agreement (DPA)

Last updated: April 12, 2026

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Terms of Service ("Agreement") between Manikandan G, trading as Ironmint ("Morph", "we", "Processor"), and the customer using the Service ("Customer", "you", "Controller").

It applies whenever we process personal data on your behalf in connection with the Service. It accepts automatically when you sign up for Morph, and a signed copy is available on request.

1. Definitions

In this DPA the following terms have the meanings given to them in the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and, where applicable, the UK Data Protection Act 2018 and the UK GDPR:

Any capitalized terms used but not defined here have the meaning given in the Agreement.

2. Roles

In relation to Customer Personal Data (personal data about your site visitors and other individuals whose data you submit to the Service):

In relation to personal data we collect about you as our customer (account email, billing details, usage logs), we are the Controller. That processing is governed by our Privacy Policy, not this DPA.

3. Subject matter and duration

| Item | Detail | |---|---| | Subject matter | Processing of personal data about your site visitors to deliver the personalization Service | | Duration | For as long as the Agreement is in force, plus any retention period set out in the Privacy Policy | | Nature and purpose | Receiving visitor context (referrer, device, location, return state), matching it against your rules, returning the appropriate variant, logging aggregate counts, and storing first-party cookies on your behalf | | Types of personal data | Approximate geolocation (country/region) derived from IP, referrer URL and query parameters, device and browser characteristics, a random opaque cookie ID for return-visitor detection. We do not intentionally process special categories of personal data. | | Categories of data subjects | Visitors to your Framer site |

4. Customer instructions

We will process Customer Personal Data only:

  1. On your documented instructions, including as set out in the Agreement, this DPA, and instructions you give through the Service (e.g. rule configuration).
  2. As required by applicable law — in which case we will inform you unless the law prohibits it on public-interest grounds.

You warrant that your instructions to us comply with applicable data protection law, that you have a valid legal basis for the processing, and that your privacy notice to visitors accurately describes Morph's role.

If we believe an instruction infringes data protection law, we will notify you promptly and may suspend the processing until resolved.

5. Confidentiality

We will ensure that any person authorized to process Customer Personal Data is bound by a duty of confidentiality, whether by statute or contract.

At the time of writing, production data access is limited to Mani, the sole operator of the Service. Any future additions to that access group will be bound by written confidentiality obligations at least as protective as those in the Agreement.

6. Security

We will implement appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include, at minimum:

Technical measures

Organizational measures

A fuller description is in Annex II at the end of this DPA.

7. Assistance to the Controller

We will provide reasonable assistance to you, taking into account the nature of the processing and the information available to us, with:

For data subject requests received directly by us, we will promptly forward them to you and will not respond substantively unless you instruct us to.

If your assistance requests become materially burdensome beyond what is necessary for compliance, we may charge reasonable fees at cost after giving you notice.

8. Personal Data Breaches

We will notify you of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within 72 hours after becoming aware of it.

Our notification will include, to the extent known at the time:

We will also reasonably assist you in meeting your own notification obligations under Articles 33 and 34 GDPR, including notifications to supervisory authorities and data subjects where required.

9. Sub-processors

9.1 General authorization

You give us general authorization to engage sub-processors to process Customer Personal Data, subject to the rest of this Section.

A current list of our sub-processors is at Subprocessors and is incorporated into this DPA by reference. At the time of writing it includes: Supabase, Vercel, Lemon Squeezy, and Resend.

9.2 Conditions

For each sub-processor, we will:

9.3 New sub-processors — objection right

We will give you at least 30 days' notice before adding or replacing a sub-processor, by updating the subprocessors page and notifying you through the Service (email or in-app).

You have 30 days from that notice to object on reasonable data protection grounds. If we cannot accommodate your objection (e.g. by continuing to provide the Service without the new sub-processor), your exclusive remedy is to terminate the Agreement for the affected part of the Service and receive a pro-rata refund for any prepaid but unused period.

10. International transfers

Where we or a sub-processor transfer Customer Personal Data out of the EU/EEA, UK, or Switzerland to a country that does not have an adequacy decision, the transfer will be made under:

The SCCs are incorporated into this DPA by reference and are deemed signed on the effective date of the Agreement. To the extent there is any conflict between this DPA and the SCCs, the SCCs prevail.

Where required, we will assist you in carrying out a transfer impact assessment for onward transfers to third countries.

11. Audits

We will make available to you all information reasonably necessary to demonstrate compliance with this DPA.

We will allow and contribute to audits, including inspections, by you or an independent auditor mandated by you, subject to reasonable conditions:

As Morph grows, we may obtain third-party security certifications or audit reports. If available, you agree to accept those in place of on-site audits where they reasonably satisfy the relevant requirement.

12. Deletion and return of data

On termination of the Agreement, we will, at your choice:

Deletion is completed within 90 days of account termination, in line with the retention schedule in the Privacy Policy. Backups are overwritten on the ordinary backup rotation cycle.

We may retain Customer Personal Data to the extent required by applicable law, provided that confidentiality and security obligations continue to apply for as long as the data is retained.

13. Liability

The liability of each party under this DPA is subject to the limitation of liability provisions in the Agreement.

Where Module Two or Module Three of the SCCs applies, Clause 12 of the SCCs (Liability) applies in addition.

14. General

Annex I — Description of processing

A. List of parties

Data Exporter (Controller)

Data Importer (Processor)

B. Description of transfer

| Item | Detail | |---|---| | Categories of data subjects | Visitors to Customer's Framer site | | Categories of personal data | Approximate geolocation (country/region), referrer URL and query parameters, device and browser characteristics, a random opaque first-party cookie ID | | Sensitive data transferred | None intentionally. Customer agrees not to submit sensitive personal data (special categories under Article 9 GDPR) to the Service. | | Frequency | Continuous, triggered by page loads on Customer's site | | Nature of the processing | Receiving visitor context, matching it against Customer's rules, returning the appropriate variant, logging aggregate counts, storing first-party cookies on Customer's behalf | | Purpose of the processing | Delivering the personalization Service to Customer | | Retention | Per retention schedule in the Privacy Policy. Site/rule data: life of account + 90 days for paused accounts. Logs: 30 days. Aggregate counts: retained as anonymized aggregates. | | Sub-processors | See Subprocessors |

C. Competent supervisory authority

The supervisory authority competent for the Customer (Controller) applies. For a Customer established in the EU/EEA, this is the supervisory authority of the EU/EEA member state where the Customer has its main establishment or sole establishment. Morph does not currently have an EU representative appointed under Article 27 GDPR.

Annex II — Technical and organizational measures

This Annex describes the measures we take to ensure a level of security appropriate to the risk.

1. Encryption

2. Access control

3. Availability and resilience

4. Data integrity

5. Vendor management

6. Incident response

7. Secure development

8. Data minimization and retention

9. Staff

10. Physical security