Who we are
Prophetizo LLC, a Wyoming, USA limited liability company doing business as MorphIQ Labs ("MorphIQ Labs," "we," or "us"), provides the Ferro API and this website. We are responsible for the personal information described in this notice. Contact legal@prophetizo.com about this notice or your personal information, and support@morphiqlabs.com for account support.
Information we handle
Account information. When you sign up or sign in, we handle your email address, a random account identifier, verification and sign-in times, and a record of the policy versions you accepted and when. Verification codes and session tokens are stored only as keyed hashes.
Usage records. When you call the API, we record usage for your account: your account and API key identifiers, the Ferro Compute Units (FCU) charged, an internal request identifier and the time. We also keep allowance balances and the last time each key was used. API keys are stored as digests; we show a key's secret once, when you create it, and cannot recover it.
Request content. The API computes results from the inputs you send and returns them. We do not store request inputs or computed results, and the API servers do not log them or your IP address. Please do not include personal information or secrets in API inputs.
Account website requests. Requests to the account service (accounts.morphiqlabs.com) pass through a Google Cloud load balancer, and Google Cloud logs each request, including your IP address, the requested path, the response status, your browser's user agent and the outcome of our rate limits. These logs do not contain request bodies, cookies, codes or tokens.
Email. Our email provider processes your email address and the message, including the verification code, to deliver it. We send only account emails, such as verification codes; we do not send marketing email.
Website analytics. This website uses Vercel Web Analytics, which records page views with the page address, referrer, and approximate country, device type, browser and operating system. It does not use cookies. We do not use advertising or cross-site tracking tools.
Support. If you contact us, we handle the information you choose to provide.
Cookies
The account service sets two cookies on accounts.morphiqlabs.com: a verification cookie that expires after ten minutes, and a sign-in session cookie that expires after seven days or when you sign out. Both are strictly necessary, restricted to that host, and not readable by scripts. The rest of this website does not set cookies.
How we use information
We use this information to verify your email address and sign you in, record the agreements that apply to your account, provide the API and enforce plan allowances and limits, protect the service against abuse and security threats, provide support, and meet legal obligations. Where a law such as the GDPR requires a legal basis, we rely on performing our agreement with you, on our legitimate interests in securing, measuring and improving the service, and on legal obligations.
We do not sell personal information, share it for cross-context advertising, or use your API inputs to train models.
Service providers
We use these providers to run the service:
- Google Cloud hosts the API, the account service, their databases, backups and operational logs. The servers and databases are in Northern Virginia, USA (
us-east4). - Resend delivers account emails.
- Vercel hosts this website and provides its analytics.
- Cloudflare provides DNS for our domains. It does not receive API or account traffic.
Each provider receives the information needed for its service and may process it in other locations under its own terms. We may also disclose information where required by law, to address fraud, abuse or security incidents, or as part of a business transfer subject to this notice.
Retention
- Verification challenges expire after ten minutes and sessions after seven days, or at sign-out. An hourly job deletes expired challenges, sessions and rate-limit records.
- Account information, policy acceptances and usage records are kept while your account exists. After you close your account, you can ask us to delete them and we will do so, except for records we need to keep to meet legal obligations, resolve disputes or protect the service.
- Load balancer and other operational logs are kept for 30 days. Google Cloud's administrative audit logs, which record changes made by our operators, are kept for 400 days.
- Database backups are kept as the latest 14 daily copies, with seven days of recovery history. Data deleted from the live database remains in backups until they are replaced.
Security
The account service and API use HTTPS. The databases have no public network endpoint; our workloads connect through authenticated, encrypted connections with separate identities and permissions. Codes, session tokens and API keys are stored only as hashes or digests. No system is entirely secure; if you suspect unauthorized use of your account or keys, contact support@morphiqlabs.com.
Your choices and rights
You can sign out to end your current session, and revoke API keys from your account. To access, correct or delete your information, contact legal@prophetizo.com from your account email. Self-service email changes and account deletion are not currently available. We may need to verify your identity, and we may keep information where the law permits or requires it.
Depending on where you live, you may also have rights to obtain a portable copy of your information, to restrict or object to particular processing, and to complain to a data protection authority. Contact legal@prophetizo.com to exercise them. Acknowledging this notice at signup does not waive them. We will not discriminate against you for exercising your rights.
The service is not directed to children, and accounts require that you are at least 18.
International processing
We are based in the United States, and your account information is processed and stored there. If you use the service from another country, your information will be processed outside that country, and our providers may process it in other locations. Data protection laws differ between countries. Contact legal@prophetizo.com for information about how a transfer of your information is safeguarded.
Changes
We publish each version of this notice at a permanent link with its effective date, and keep earlier versions available. We will present a changed notice when you next sign in and give additional notice of material changes where required.