Legal

Privacy Policy

Last updated: March 16, 2026

1. Who We Are

Morphic CI is operated by Pixel Familiar Inc., a company incorporated in Manitoba, Canada. In this policy, "we," "us," and "our" refer to Pixel Familiar Inc.

2. What Data We Collect

We collect the following categories of data:

Account Information

Email address and password hash when you create an account. We do not store passwords in plaintext. Authentication is managed through Supabase Auth.

Agent Test Data

When you run tests through Morphic CI, we process the following:

  • Baseline intent prompts you define
  • Generated prompt variations (created by our perturbation engine)
  • JSON-RPC payloads returned by your agent endpoint
  • F1 consistency scores and diff results
  • Webhook URLs for your agent endpoints

Important: We intercept and temporarily process the payloads your agent sends during test execution. These payloads may contain data that your agent generates, which could include sensitive content depending on your agent's configuration. You are responsible for ensuring that data submitted for testing complies with applicable privacy laws.

Usage and Telemetry

Test run history, timestamps, project configurations, and performance metrics. This data powers your dashboard and is used to improve the Service.

Payment Information

Billing is processed through Stripe. We do not store credit card numbers, bank account details, or other payment credentials on our servers. Stripe's privacy policy governs payment data handling.

3. How We Use Your Data

We use your data to:

  • Provide and operate the Service (running tests, computing scores, displaying results)
  • Authenticate your identity and manage your account
  • Process payments for paid subscription plans
  • Send transactional emails (account verification, billing receipts, critical service notifications)
  • Improve the Service through aggregated, anonymized usage analysis

We do not sell your data to third parties. We do not use your agent payloads to train machine learning models. We do not share identifiable test data with other users.

4. Data Retention

Account data: Retained for the duration of your account. Deleted within 30 days of account termination upon written request.

Test payloads: Raw JSON-RPC payloads intercepted during test execution are retained for up to 90 days to support your dashboard and historical telemetry. After 90 days, raw payloads are automatically purged. Aggregated scores and metadata (pass/fail counts, response times) may be retained indefinitely in anonymized form.

Billing records: Retained as required by Canadian tax law (typically 7 years).

5. Data Security

We implement industry-standard security measures including:

  • Encryption in transit (TLS 1.2+) for all API and web traffic
  • Encryption at rest for stored data
  • API key authentication for programmatic access
  • Row-level security in our database to prevent cross-user data access

No system is perfectly secure. We cannot guarantee absolute security but will notify affected users promptly in the event of a data breach.

6. Third-Party Services

We use the following third-party services that may process your data:

  • Supabase (database and authentication)
  • Vercel (hosting and deployment)
  • Stripe (payment processing)

Each of these providers maintains their own privacy policies and security practices. We select providers that meet reasonable security and privacy standards.

7. Your Rights

You have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate personal data
  • Deletion: Request deletion of your account and associated data
  • Data portability: Request export of your test data in a machine-readable format

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

8. Cookies

We use essential cookies for authentication and session management. We do not use tracking cookies or third-party advertising cookies. No cookie consent banner is required as our cookies are strictly necessary for the Service to function.

9. Children's Privacy

The Service is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10. International Data Transfers

Our servers and third-party providers may process data outside of Canada, including in the United States. By using the Service, you consent to the transfer of your data to jurisdictions that may have different data protection laws than your home jurisdiction.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to registered users via email. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy-related inquiries or to exercise your data rights:
privacy@pixelfamiliar.ca

Pixel Familiar Inc.
Winnipeg, Manitoba, Canada