Morphee Records of Processing Activities (ROPA)
Status: DRAFT | Living document — update when processing activities change.
Prepared pursuant to GDPR Article 30.
Last updated: 2026-02-21
| Field | Value |
|---|
| Controller name | [Legal entity name] |
| Address | [Registered address] |
| Contact | [privacy@morphee.app] |
| DPO | Sébastien Mathieu (privacy@morphee.app) — Art. 37 formal appointment pending scale assessment |
| EU Representative (if applicable) | [Art. 27 — required if controller outside EU] |
2. Processing Activities
2.1 User Authentication
| Field | Value |
|---|
| Purpose | Account creation, login, session management |
| Lawful basis | Art. 6(1)(b) — Contract performance |
| Data subjects | All registered users |
| Data categories | Email, name, password hash, authentication tokens, SSO provider metadata |
| Recipients | Supabase Auth (processor) — [DPA pending] |
| Transfers | US (if Supabase managed) or none (if self-hosted) |
| Retention | Until account deletion |
| Security measures | Bcrypt password hashing, JWT tokens, rate limiting |
2.2 Conversational AI Chat
| Field | Value |
|---|
| Purpose | AI-powered conversational assistance |
| Lawful basis | Art. 6(1)(a) — Consent (llm_data_sharing) |
| Data subjects | Users who use the chat feature |
| Data categories | Chat messages, conversation metadata, user name, group name |
| Recipients | Anthropic (processor) — [DPA pending] |
| Transfers | United States (Anthropic API) |
| Retention | Until conversation or account deletion |
| Security measures | Consent enforcement, group-based isolation, TLS in transit |
| Field | Value |
|---|
| Purpose | Automatic extraction of facts, preferences, and events from conversations to improve AI context |
| Lawful basis | Art. 6(1)(a) — Consent (memory_extraction) |
| Data subjects | Users who have not opted out of memory extraction |
| Data categories | Extracted facts, preferences, events, embedding vectors, source conversation references |
| Recipients | Anthropic (for extraction LLM call); stored locally in PostgreSQL + Git |
| Transfers | United States (Anthropic API, for extraction call only) |
| Retention | Until memory deletion, source conversation deletion, or account deletion |
| Security measures | User opt-out, consent mechanism, cascade delete, right to rectification |
2.4 Task Management
| Field | Value |
|---|
| Purpose | Creating, tracking, and managing tasks within groups |
| Lawful basis | Art. 6(1)(b) — Contract performance |
| Data subjects | Group members who create or are assigned tasks |
| Data categories | Task title, description, status, assignee, due date |
| Recipients | None external |
| Transfers | None |
| Retention | Until task deletion or account deletion |
| Security measures | Group-based isolation, authentication |
2.5 Space Management
| Field | Value |
|---|
| Purpose | Organizing conversations, tasks, and memories into contexts |
| Lawful basis | Art. 6(1)(b) — Contract performance |
| Data subjects | Group members |
| Data categories | Space name, description, parent-child relationships |
| Recipients | None external |
| Transfers | None |
| Retention | Until space deletion or group deletion |
| Security measures | Group-based isolation |
2.6 Google Calendar Integration
| Field | Value |
|---|
| Purpose | Reading and managing calendar events via AI assistant |
| Lawful basis | Art. 6(1)(a) — Consent (google_calendar) |
| Data subjects | Users who connect Google Calendar |
| Data categories | OAuth tokens, calendar events (title, time, attendees, description) |
| Recipients | Google (processor) — Google DPA applies |
| Transfers | United States (Google APIs) |
| Retention | Tokens until disconnect; event data not persisted (read-through) |
| Security measures | OAuth2, token stored in VaultProvider (not DB), user-initiated only |
2.7 Gmail Integration
| Field | Value |
|---|
| Purpose | Reading and composing emails via AI assistant |
| Lawful basis | Art. 6(1)(a) — Consent (google_gmail) |
| Data subjects | Users who connect Gmail |
| Data categories | OAuth tokens, email metadata (subject, sender, date), email body |
| Recipients | Google (processor) — Google DPA applies |
| Transfers | United States (Google APIs) |
| Retention | Tokens until disconnect; email data not persisted (read-through) |
| Security measures | OAuth2, VaultProvider, user-initiated only, restricted scopes |
2.8 Push Notifications
| Field | Value |
|---|
| Purpose | Delivering real-time notifications to mobile devices |
| Lawful basis | Art. 6(1)(a) — Consent (push_notifications) |
| Data subjects | Users who enable push notifications |
| Data categories | Device token (opaque), notification title and body |
| Recipients | Apple APNs (iOS), Google FCM (Android) |
| Transfers | United States (Apple, Google) |
| Retention | Tokens cleaned up after 90 days of inactivity |
| Security measures | Consent mechanism, stale token cleanup, TLS |
2.9 Group & Member Management
| Field | Value |
|---|
| Purpose | Creating groups, inviting members, managing roles |
| Lawful basis | Art. 6(1)(b) — Contract performance; Art. 6(1)(f) — Legitimate interest (invites) |
| Data subjects | Group members and invited persons |
| Data categories | Group name, member roles, invite emails, invite status |
| Recipients | None external |
| Transfers | None |
| Retention | Member data until removal/deletion; expired invites cleaned up automatically |
| Security measures | Group-based isolation, invite expiry (7 days), automated cleanup |
2.10 Scheduling (Cron)
| Field | Value |
|---|
| Purpose | Running scheduled tasks and reminders |
| Lawful basis | Art. 6(1)(b) — Contract performance |
| Data subjects | Users who create schedules |
| Data categories | Schedule name, description, cron expression, next run time |
| Recipients | None external |
| Transfers | None |
| Retention | Until schedule deletion or account deletion |
| Security measures | Group-based isolation |
2.11 Notification System
| Field | Value |
|---|
| Purpose | In-app notification delivery |
| Lawful basis | Art. 6(1)(b) — Contract performance |
| Data subjects | All users |
| Data categories | Notification title, body, read status, timestamps |
| Recipients | None external (in-app only; push handled separately in 2.8) |
| Transfers | None |
| Retention | Until account deletion [retention policy pending] |
| Security measures | User-level filtering, group-based isolation |
2.12 Multi-Group Membership (migration 021)
| Field | Value |
|---|
| Purpose | Enabling users to belong to multiple groups (family + work team, teacher + parent, etc.) with per-group roles and access control |
| Lawful basis | Art. 6(1)(b) — Contract performance |
| Data subjects | All registered users |
| Data categories | group_id (reference), user_id (reference), role (owner/admin/member/child), joined_at (timestamp) |
| Recipients | None external |
| Transfers | None |
| Retention | Until user leaves the group (CASCADE on group_members) or deletes account (CASCADE on users) |
| Security measures | Group-based isolation, role-checked authorization, cascade deletion |
Added 2026-02-20: covers group_members table introduced in migration 021.
2.13 Biometric Face Enrollment (V1.3)
| Field | Value |
|---|
| Purpose | Child identity verification via face recognition |
| Lawful basis | Art. 9(2)(a) — Explicit consent (biometric_face_enrollment); parent grants consent on behalf of child |
| Data subjects | Children in family/classroom groups |
| Data categories | 128-dimensional face embedding (MobileFaceNet model), enrollment timestamp, method verification status |
| Recipients | None — biometric templates stored exclusively in local device vault (Keychain/OS vault) |
| Transfers | None — data never leaves the device |
| Retention | Until authentication method deleted, child account deleted, or application uninstalled |
| Security measures | OS-level vault (hardware-backed on iOS), explicit consent enforcement, cascade deletion on child removal, event-driven vault cleanup |
Added 2026-02-21: covers face biometric enrollment (V1.3 multimodal identity).
2.14 Biometric Voice Enrollment (V1.3)
| Field | Value |
|---|
| Purpose | Child identity verification via voice recognition |
| Lawful basis | Art. 9(2)(a) — Explicit consent (biometric_voice_enrollment); parent grants consent on behalf of child |
| Data subjects | Children in family/classroom groups |
| Data categories | 192-dimensional voice embedding (d-vector CNN model), enrollment timestamp, method verification status |
| Recipients | None — biometric templates stored exclusively in local device vault |
| Transfers | None — data never leaves the device |
| Retention | Until authentication method deleted, child account deleted, or application uninstalled |
| Security measures | OS-level vault, explicit consent enforcement, cascade deletion, event-driven vault cleanup |
Added 2026-02-21: covers voice biometric enrollment (V1.3 multimodal identity).
2.15 Visual Analysis (V1.3)
| Field | Value |
|---|
| Purpose | AI-assisted image analysis, video frame analysis, handwriting transcription, diagram interpretation |
| Lawful basis | Art. 6(1)(a) — Consent (video_analysis) |
| Data subjects | Users who share images or video in chat |
| Data categories | Image data (base64), video frames (up to 10 per video, extracted at 5s intervals) |
| Recipients | Anthropic (processor) — [DPA pending] |
| Transfers | United States (Anthropic API) |
| Retention | Not retained — transient processing only, discarded after AI response |
| Security measures | Consent enforcement (separate from text chat), TLS in transit, group-based isolation |
Added 2026-02-21: covers visual analysis integration (V1.3 multimodal interaction).
2.16 Screen Capture (V1.3, Desktop Only)
| Field | Value |
|---|
| Purpose | AI-assisted analysis of desktop screen content |
| Lawful basis | Art. 6(1)(a) — Consent (screen_capture) |
| Data subjects | Desktop app users who use screen capture |
| Data categories | Screenshot image (base64 PNG) |
| Recipients | Anthropic (processor) — [DPA pending] |
| Transfers | United States (Anthropic API) |
| Retention | Not retained — transient processing only |
| Security measures | Consent enforcement, desktop-only (not available on mobile/web), TLS in transit |
Added 2026-02-21: covers screen capture feature (V1.3, desktop only).
3. Categories of Data Subjects
| Category | Description | Special Protections |
|---|
| Adult users | Parents, teachers, managers, employees, contractors | Standard GDPR |
| Children (under 16) | Students in classroom groups, children in family groups | Art. 8 — parental consent required |
| Invited persons | Email addresses of people invited to join a group | Art. 14 — must be informed |
4. International Transfers Summary
| Recipient | Country | Mechanism | DPA Status |
|---|
| Anthropic | US | DPF (self-certified) + SCCs (under review) | Under Review |
| Supabase | US / EU | DPF (self-certified) + SCCs / EU hosting (under review) | Under Review |
| Google | US | DPF + SCCs | In place (standard) |
| Apple | US | DPF | In place (developer agreement) |
See Transfer Impact Assessment for detailed analysis.
5. Technical and Organizational Security Measures (Art. 30(1)(g))
| Measure | Status |
|---|
| Authentication (JWT, bcrypt) | Implemented |
| Group-based data isolation | Implemented |
| VaultProvider for credentials | Implemented |
| TLS in transit | Implemented |
| Rate limiting | Implemented |
| PII removed from logs | Implemented |
| Consent management | Implemented |
| Data subject rights (access, erasure, portability, rectification) | Implemented |
| Encryption at rest | Planned |
| Security monitoring | Planned |
| Breach response plan | Drafted |
6. Retention Schedule
| Data Category | Retention Period | Deletion Mechanism |
|---|
| User accounts | Until user deletes account | POST /api/auth/delete-account (cascade) |
| Conversations | Until user deletes conversation or account | Manual or cascade |
| AI memories | Until memory/conversation/account deletion | Cascade from conversation or manual forget |
| Tasks & schedules | Until deletion or account deletion | Manual or cascade |
| Notifications | [Policy pending — recommend 90 days] | [Cleanup job pending] |
| Push tokens | 90 days after last use | Automated cleanup |
| Group invites | Deleted after expiry (7 days) | Automated cleanup |
| OAuth tokens | Until disconnect or account deletion | Manual disconnect or cascade |
| Biometric templates | Until method/child/account deletion | Manual or cascade + vault cleanup |
| Visual/screen capture data | Not retained (transient) | Discarded after AI processing |
| Consent audit records | 6 years (statute of limitations) | Anonymized on account deletion |
7. Review Log
| Date | Reviewer | Changes |
|---|
| 2026-02-13 | Initial draft | Created ROPA covering all 11 processing activities |
| 2026-02-20 | Sébastien Mathieu | Added 2.12: multi-group membership processing (migration 021, group_members table) |
| 2026-02-21 | Claude Code | Added 2.13-2.16: biometric face/voice enrollment, visual analysis, screen capture (V1.3 multimodal). Updated retention schedule with biometric templates and consent audit records. |
This ROPA was drafted on 2026-02-13 and must be maintained as a living document per Art. 30.