Your data

The controller of your personal data is João Queiroz, NIF 223419486, Rua José Fernandes Ferreira, 75, 1.º Esq., 4705-802 Braga, Portugal. For any question about your data, write to hello@morphyourone.com.

• When you generate: an anonymous session identifier (a cookie), the artworks shown to you and the ones you keep, and technical data such as your IP address, used to protect the service from abuse. You do not need to give us your name or email to generate.
• When you order: your name, email, phone number (optional, used for MB WAY and the delivery), delivery address and country, the artworks, sizes and colours you buy, and the order history.
• When you pay: the payment is handled by our payment provider. From it we receive only the payment status, the method used (card, Apple Pay, Google Pay, MB WAY or Multibanco), the amount, the date and a transaction reference. We never receive, see or store your card number, expiry date, security code or banking credentials: card details are entered directly on the provider’s secure page. For MB WAY, your phone number is sent to the provider so the payment request reaches your app.
• When you write to us: your message and the contact details you use.

• To run the generator and your bag: keeping the artworks you reserve and preventing the same artwork from being sold twice. Basis: the steps you ask for before a contract and the contract itself (GDPR art. 6(1)(b)).
• To process, deliver and support your order, including guarantee claims. Basis: performance of the contract (art. 6(1)(b)).
• To issue invoices and keep accounting records. Basis: legal obligation (art. 6(1)(c)).
• To take your payment, confirm it and, when due, refund it. Basis: performance of the contract (art. 6(1)(b)).
• To keep the service secure, limit abuse and prevent payment fraud. Basis: our legitimate interest (art. 6(1)(f)).

We do not send marketing emails. If we ever offer a newsletter, it will be only with your consent.

Only the providers we need to serve you, bound by contract to use the data solely on our behalf:

• the hosting of the website and of the shop;
• the payment provider, IFTHENPAY, Lda. (NIF 510450024, Rua do FeiraPark, 50, Edifício FeiraPark, 4520-632 São João de Ver, Portugal), a payment institution authorised and supervised by Banco de Portugal (registration no. 8707). It receives the order reference, the amount and what is needed to take the payment (for MB WAY, your phone number). As a payment institution it also processes payment data under its own legal obligations — strong customer authentication, fraud prevention and the prevention of money laundering — and is responsible for that processing under its own privacy policy;
• when you pay by card, Apple Pay or Google Pay, the payment is also processed by the card schemes (Visa, Mastercard) and the bank that issued your card, and, for wallets, by Apple or Google under their own terms and privacy policies;
• the printing partner, which receives the artwork and the order details needed to produce it;
• the carrier, which receives your name, address and phone number to deliver the parcel;
• our accountant and, when the law requires it, public authorities.

Your data is stored in the European Union. Card schemes, Apple and Google may process payment data outside the European Economic Area, under the safeguards required by the GDPR (such as the European Commission’s standard contractual clauses or adequacy decisions). If one of our own providers ever processes it outside the EEA, we will make sure it is protected by those same safeguards.

• Artworks you generate but do not keep are archived and no longer linked to you; the anonymous session cookie expires 30 days after your last visit.
• Order data is kept for as long as needed to deliver the order and handle the legal guarantee (three years from delivery).
• Invoices, accounting records and payment records (method, amount, date and transaction reference) are kept for 10 years, as required by Portuguese tax law.
• The register of sold artworks (artwork number and order) is kept permanently, because it is what guarantees that each artwork is sold only once; it does not contain your contact details.

We use only what is strictly necessary for the site to work, so no consent banner is needed:

• morph_sid — an anonymous session cookie that keeps your reserved artworks yours (30 days after your last visit).
• morph_lang — remembers the language you chose for the site (1 year).
• Your bag and, if you have used the checkout, your delivery details are saved in your own browser (local storage) so you do not lose them. They stay on your device; you can clear them at any time in your browser settings.
• The payment page uses the shop’s session cookies, needed to complete the payment securely. When you pay by card, Apple Pay or Google Pay, the payment provider’s secure page may use its own strictly necessary cookies and security checks.

We do not use analytics, advertising or social media tracking.

You can ask us at any time to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. Write to hello@morphyourone.com; we answer within one month. Some data cannot be deleted while the law requires us to keep it (for example invoices).

You also have the right to lodge a complaint with the Portuguese data protection authority, the CNPD — Comissão Nacional de Proteção de Dados (cnpd.pt).

Connections to the site and to the payment page are encrypted (HTTPS/TLS), the generator never exposes your session, and access to order data is limited to the people who need it to fulfil your order. Card payments are processed only by our payment provider, under the card schemes’ security standards (PCI DSS) and with strong customer authentication (3-D Secure); card details never pass through our servers.

If this policy changes, the new version is published here with its date. The terms of sale are in our Terms & Conditions.