Privacy notice

Botz Limited is the controller of the personal data described in this notice. In this notice, “morph,” “we,” and “us” mean Botz Limited.

For any privacy question or request, email info@morph.inc or write to us at 5 Merchant Square, London, England, W2 1AY.

You can contact us through the form on our homepage or by email. When you send the form, your message is emailed to the team inbox for the topic you pick: partnerships, investors, press and events, or general inquiries. Our host, Vercel, runs the form, and Twilio SendGrid, an email delivery service, delivers the message to us. We then email you a confirmation at the address you give, with a copy of your message unless it contains a link, so you have a record and can reply to add anything. If our spam check marks your message, we still receive it but don’t send you a confirmation. You can also email partnerships@morph.inc, investors@morph.inc, press@morph.inc, or info@morph.inc directly.

• What we receive: your name, email address, organization (if you add it), the topic you pick, your message, and anything else you include if you email us.
• Why: to reply to you, confirm we’ve received your message, and manage our relationship with you, for example about a partnership, an investment, a press request, or an event. We also check each form message for signs of spam before it’s sent.
• Legal basis: legitimate interests. Our interests are replying to people who contact us, managing our partnership, investor, press, and event relationships, and keeping our form free of spam and misuse.
• How long we keep it: as long as we need it to reply to you and manage our relationship. We delete it within 2 years of our last contact with you. Twilio SendGrid, which delivers form messages to us and confirmations to you, keeps each message only until it’s delivered (up to 72 hours) and may keep a random sample of messages for up to 7 days to prevent fraud and fix problems. It keeps delivery records, including the subject line, which contains your name, for about 37 days, and some delivery records in pseudonymized form for up to a year for security.

You don’t have to give us any personal data, but we can’t reply without your contact details.

Our website is hosted by Vercel Inc. To deliver pages to you and protect the site, Vercel processes technical data about each request, such as your IP address, the approximate location derived from it (city and country), your browser and device details (user agent), technical details of your connection, and the page or file requested. If you send our contact form, Vercel and Kasada also process the browser and device details described under “Cookies and tracking.”

• Why: to deliver the website and keep it secure, including checking that the contact form is sent by a person rather than an automated program, and limiting how often it can be sent from one connection.
• Legal basis: legitimate interests. Our interests are running a reliable website and protecting it from attacks and misuse (network and information security).
• How long we keep it: the request logs we can see in Vercel are kept for up to 30 days. Vercel keeps the data it uses for its own purposes under its own privacy notice (see “Who handles your data”).

Our pages don’t set cookies or store anything in your browser, except for two security checks run by our host, Vercel.

First, to block attacks and automated traffic, Vercel’s firewall may sometimes ask your browser to pass a check before it shows a page. If you pass it, Vercel creates a session in your browser that’s valid for 1 hour.

Second, when you send our contact form, Vercel checks that it comes from a person rather than an automated program. This check is called BotID, and Kasada, a bot protection company, runs part of it for Vercel. Nothing is checked until you press “Send message.” Then scripts from Vercel and Kasada, served through our own site, look at technical details of your browser and device, such as your screen, graphics card, processor and memory, fonts, audio and media settings, connected cameras and microphones, battery, network connection, browser permissions, language, and time zone. The check doesn’t ask you for any permission. The scripts send these details, with your IP address, to Vercel and Kasada. During the check, your browser may also contact other services Kasada uses, such as Cloudflare (cloudflare.com), which then see your IP address and browser details. Vercel checks the result before your message is sent.

The check stores two cookies, KP_UIDz and KP_UIDz-ssn, which expire after 24 hours, and a few items in your browser’s local storage, which stay until you clear your browser’s data. Until the cookies expire, your browser sends them back to our site with each request, and the request logs we can see in Vercel include a security identifier from the check. These are strictly necessary to protect the form you’re sending, so we don’t ask for your consent to them. You can delete the cookies and stored items in your browser settings at any time.

We don’t receive the details the check collects, only its result. If the check stops your message by mistake, you can email us at info@morph.inc instead.

Apart from these checks, our pages load nothing from other websites: no external fonts, scripts, or embeds. Text, images, and videos all come from our own site.

We don’t use analytics or tracking technologies. If that changes, we’ll update this notice first.

• Vercel Inc. hosts our website. When it processes request data for us, it acts as our processor under its data processing addendum, at our direction.
• Vercel is also a separate controller for some of this data, such as IP addresses and the location derived from them, and for usage data its services generate. It uses that data for its own purposes, including operating, improving, and supporting its services. Vercel’s privacy notice covers that use: https://vercel.com/legal/privacy-notice
• Kasada runs part of the BotID check on our contact form for Vercel, as one of Vercel’s subprocessors (listed at https://vercel.com/legal/sub-processors). Vercel says the check streams data to a global machine learning system that improves protection for all customers, so Vercel and Kasada may also use the details it collects for that. Kasada keeps and uses that data under its own privacy policy: https://www.kasada.io/privacy-policy
• During the BotID check, your browser may also contact other services Kasada uses, such as Cloudflare. They receive your IP address and browser details directly, under their own privacy policies. Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/
• Twilio SendGrid delivers the messages you send through our contact form, and the confirmations we send you. It acts as our processor under Twilio’s data processing addendum, at our direction. Twilio is also a separate controller for some of this data, such as delivery records and, where needed, message content, which it uses for security, to prevent abuse, to meet its legal obligations, and to improve its services. Twilio’s privacy notice covers that use: https://www.twilio.com/en-us/legal/privacy
• Microsoft provides our email service (Microsoft 365), so the emails you send us, including messages from the contact form, are stored with Microsoft.

Vercel’s main processing facilities are in the United States, and data may also be processed in other countries where Vercel or its subprocessors operate. For transfers to Vercel, we rely on these safeguards:

• Vercel Inc. is certified under the UK Extension to the EU-U.S. Data Privacy Framework (the “UK-US data bridge”). UK law treats transfers to US companies certified under it as adequately protected.
• Vercel’s data processing addendum also includes the EU standard contractual clauses, together with UK transfer terms (the UK IDTA).

You can read the addendum at https://vercel.com/legal/dpa, or email info@morph.inc for a copy of these safeguards.

Vercel’s subprocessor list names Kasada, for fraud prevention, as processing data in the United States, and Vercel’s addendum covers its subprocessors. Kasada’s own use of the data, and any other services its script contacts, such as Cloudflare (based in the United States), are covered by their own privacy policies (see “Who handles your data”).

Twilio SendGrid processes data mainly in the United States. For transfers to Twilio, we rely on Twilio Inc.’s certification under the UK Extension to the EU-U.S. Data Privacy Framework, and on the EU standard contractual clauses with UK transfer terms in Twilio’s data processing addendum. You can read the addendum at https://www.twilio.com/en-us/legal/data-protection-addendum.

Microsoft stores our email in the UK.

Our footer links to our LinkedIn page, and our press page links to the websites of organizations and people named in our announcements. Other sites, including LinkedIn, have their own privacy policies.

You can ask us to:

• give you a copy of the personal data we hold about you
• correct inaccurate data
• delete your data
• restrict how we use your data

You can also object to how we use your data (see the next section).

To use any of these rights, email info@morph.inc. The right to data portability doesn’t apply here, because we rely on legitimate interests, not consent or a contract.

The automated checks on our contact form, BotID and our host’s firewall, stop a message if they decide it comes from an automated program or if too many are sent from one connection; you can then email us instead. Our spam check may also mark a message for our team, but it still reaches us. We don’t make any other automated decisions about you.

You can object at any time to our use of your personal data based on legitimate interests, on grounds relating to your particular situation. To object, email info@morph.inc.

We’ll then stop, unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or we need the data to establish, exercise, or defend legal claims.

If you’re unhappy with how we’ve handled your personal data, you can complain to us at info@morph.inc. We’ll acknowledge your complaint within 30 days.

You also have the right to complain to the UK’s data protection regulator, the Information Commission (ICO): https://ico.org.uk/make-a-complaint or 0303 123 1113.

Effective 2 October 2026

Last updated 5 October 2026

If we change this notice, we’ll post the new version on this page and update the date above.