This document has not been reviewed by a lawyer and does not apply to anyone yet. Items marked (under legal review) are still being decided with our lawyer.
How Tiercube handles personal data, under GDPR, UK GDPR, CCPA/CPRA and KVKK.
Last updated: DRAFT
1. Summary
- Tiercube is a business tool. We hold the account details of the people who use it, and we store your company’s catalog, orders and plans on your company’s behalf.
- The application uses two essential cookies and no analytics, advertising or tracking tools. See the cookie policy.
- We do not sell personal information, and we do not use your data to train AI models. The Service uses one AI provider (OpenAI) only to read order documents and match order lines to your catalog, as described in section 4 and on the subprocessors page. (under legal review)
- Some data (freight carriers and quotes) is kept only in your browser today, not on our servers.
- Contact: hello@themorfose.com.
2. Who is responsible for your data
Morfose USA Inc., 3920 Tollhouse Drive, Naples, FL 34114, United States (“Tiercube”, “we”) provides the Tiercube service. Our role depends on the data:
| Data | Our role | Who to contact |
|---|---|---|
| Account data about the people who use Tiercube, sign-in and security records, website visits, business contact details | Controller (KVKK: veri sorumlusu) | Us, at hello@themorfose.com |
| Customer Data: the catalog, orders, customer names on orders, plans, warehouse addresses and carrier contacts a company puts into Tiercube | Processor for our customer (KVKK: veri işleyen). The customer company is the controller. | The company that uses Tiercube. We will pass on requests we receive and help them respond. |
Our processing of Customer Data is governed by our data processing agreement with the customer.
(under legal review) · (under legal review)
3. What we collect
Stored on our servers
| Category | What exactly | Where it comes from |
|---|---|---|
| User account | Email address; name (optional); Google account ID if you sign in with Google; company memberships and roles; date of last sign-in; whether you are Tiercube staff | You, your company admin who invited you, or Google (email, name and account ID only, when you choose Google sign-in) |
| Company | Company name, country, measurement system, language, time zone, address, default pallet rules, warehouse addresses | Your company’s owners and admins |
| Invitations | Invitee email, role, who invited them, a hashed invitation token, expiry (7 days) and acceptance date | Your company’s owners and admins |
| Catalog | Product codes and names, case dimensions and weights, units per case, orientation, stackability, fragility and top-load limits | Your company (typed in or imported from CSV) |
| Saved plans | Order reference, customer name if you enter one, order lines, plan settings, the calculated plan, pallet count, height and weight, status, and which user created it | Your company’s planners |
| Sign-in security | For one-time sign-in links: the email address the link was sent to and a hash of the link (never the link itself). For Google sign-in: temporary, hashed state values. For both: a salted IP digest (the first 16 characters of a SHA-256 hash of your IP address with a secret salt) used for rate limiting. We do not store IP addresses. | Your browser |
| Sessions | A hash of your session cookie value, your user ID, the active company, and creation, last-use and expiry times. We do not store your IP address or browser details with your session. | Created when you sign in |
| Audit log | Who did what and when in a workspace (for example: invited a user, changed a role, saved a plan, changed settings), with before/after values for changes, the salted IP digest and a request ID | Generated by the Service |
| Usage and cost records | Pallets counted per order and month; database rows read and written per plan save; plan and quota changes made by Tiercube staff | Generated by the Service |
| Error logs | Request ID, route and a short error description. Request bodies are not logged. | Generated by the Service |
Kept only in your browser
These are stored in your browser’s local storage and are not sent to our servers today: the freight carrier list (names, email addresses, service areas), the quotes you record, default shipping origin and sender details, vehicle planner settings, planner settings, any catalog you use without signing in, and your language and theme preference. The full list is in the cookie policy.
Order PDFs you open in the planner are read in your browser. The file is not uploaded; only the order lines you save as part of a plan reach our servers.
Our website
The marketing website sets no cookies and runs no analytics. The demo request form is connected (changed on 28 September 2026; this page previously said it was not, which was wrong). When you submit it we collect the name, work email, company and message you enter, store them in our database and email them to ourselves so that we can reply. Nothing else on the website sends anything.
Your browser loads everything — pages, fonts, and the two open-source libraries the planner uses (a 3D viewer and a PDF reader) — from our own domains. It does not connect to any third-party server while you use the website or the planner, so no other company receives your IP address or browser details through us. (Changed on 28 September 2026: fonts previously came from Google Fonts and the two libraries from the jsDelivr CDN; both are now served by us.) (under legal review)
4. What we don’t do
- No analytics, advertising, session-recording or social-media tracking scripts on the website or in the application. (We checked every page of the site and the application for such scripts on the date of this draft.)
- No sale or “sharing” of personal information for cross-context behavioural advertising.
- No AI processing beyond two planner features, both using OpenAI (listed on the subprocessors page): reading an order document our built-in reader cannot parse, only when you click “Read with AI”; and matching order lines that have no product code to your catalog by product name, automatically when such a document is uploaded. Only the document text, or the product names plus a short list of your catalog product codes and names, is sent. Matches you confirm are stored with your company’s data so the next order matches without AI. (under legal review)
- No storage of payment card numbers. Payments will be handled by a payment processor when billing launches.
5. Why we use it and our legal bases
This section covers data for which we are the controller. For Customer Data, we act only on our customer’s instructions under the DPA.
| Purpose | GDPR / UK GDPR | KVKK (Art. 5) |
|---|---|---|
| Create and run your account, sign you in, manage roles and invitations | Contract (Art. 6(1)(b)) | Necessary for a contract (5(2)(c)) |
| Count pallets, enforce quotas, bill the customer | Contract (6(1)(b)); legal obligation for tax records (6(1)(c)) | Contract (5(2)(c)); legal obligation (5(2)(ç)) |
| Security: rate limiting, fraud and abuse prevention, audit log, incident investigation | Legitimate interests (6(1)(f)): keeping the Service and customers’ data safe | Legitimate interest (5(2)(f)); establishing and defending rights (5(2)(e)) |
| Measure the running cost of the Service and improve it, using counts rather than content | Legitimate interests (6(1)(f)) | Legitimate interest (5(2)(f)) |
| Send service emails (sign-in links, invitations, welcome, trial and quota warnings, deletion and billing notices) | Contract (6(1)(b)) | Contract (5(2)(c)) |
| Respond to demo requests and business enquiries | Legitimate interests (6(1)(f)) or steps before a contract (6(1)(b)) | Contract (5(2)(c)); legitimate interest (5(2)(f)) |
| Comply with law and respond to lawful requests | Legal obligation (6(1)(c)) | Legal obligation (5(2)(ç)) |
We do not send marketing email without the consent that applicable law requires. Where KVKK requires explicit consent (açık rıza) and no other legal basis applies, we will ask for it separately, in a form that is specific and freely given, and you can withdraw it at any time.
6. How long we keep it
| Data | Kept for |
|---|---|
| One-time sign-in links | Valid 15 minutes, single use. Deleted by our daily clean-up once they have been expired for more than 24 hours. |
| Google sign-in state | Valid 10 minutes. Deleted by the daily clean-up once expired for more than 24 hours. |
| Sessions | A session lasts up to 30 days from last renewal, ends after 7 days without use, and never lasts more than 90 days from sign-in. Signing out ends it immediately. Ended sessions are deleted by the daily clean-up within about 24 hours. |
| Invitations | Valid 7 days. Kept with the company workspace as a record of who was invited, until the workspace is deleted. Pending invitations are cancelled as soon as an owner requests deletion of the workspace. When a user deletes their account, the email address on invitations they accepted is replaced with a placeholder. |
| Customer Data (catalog, plans, addresses, settings) | For as long as the company uses Tiercube. After an owner requests deletion: a 30-day read-only waiting period in which an owner can cancel and owners and admins can export, then deletion from the live database by a daily job that works in batches and can take more than one day for a large workspace. A company whose only member deletes their account is deleted without a waiting period. |
| User account | Until you delete it (Settings). You cannot delete it while you are the only owner of a company that has other members. Deleting your account removes your memberships, sessions and pending sign-in links; replaces your email address, on your account and on invitations you accepted, with a placeholder derived from your internal user ID (not from your email address); and erases your name, Google account link, staff role and last sign-in date. The internal user ID remains, so records you created stay linked to an ID that no longer resolves to you. If you sign up again with the same email address, you get a new, unconnected account. |
| Database recovery history | Our database provider keeps point-in-time recovery history for up to 30 days, so deleted data leaves it within 30 days. |
| Audit log and pallet usage records | Audit log entries are never deleted, because they are security evidence. When a company is deleted, the IP digests and before/after values in its audit entries are removed. When a user deletes their account, the IP digests are removed from the entries recording their actions, and they are identified only by an internal ID that no longer resolves to a name or email. Individual pallet usage records (which include order numbers) are deleted with the company; per-month totals are kept, without order numbers. Records of quota adjustments made by Tiercube staff, the record of warning emails sent (type, date, delivery status and number of recipients, without email addresses) and counts of database rows used per plan save are also kept; they contain no plan or catalog content. They are kept for seven years. |
| Error logs | Kept by our hosting provider for its standard log retention period, currently up to seven days. |
| Billing records | As required by tax law seven years, once billing launches. |
| Data in your browser | Until you clear it or your browser’s storage is cleared. We cannot see or delete it. |
7. Who we share it with
- Service providers (subprocessors) who host the Service or deliver emails for us, under contracts that limit their use of the data. The current and planned list is on the subprocessors page.
- Your own company: owners and admins of a workspace can see its members, their roles, invitations and the workspace audit log.
- Tiercube staff with a platform role can see account-level information for support and billing: company name, plan, quota and usage, members with their email addresses and roles, and the audit log. Our admin tools do not show the contents of your plans, catalog, addresses or customer names, and they hide the before/after details of your own users’ changes. All staff changes to plans and quotas are written to the audit log.
- Authorities when the law requires it, and to protect rights and safety.
- A buyer or successor if our business is sold or merged, under the same protections.
8. International transfers
Tiercube is operated from the United States, and our providers process data in the United States and in other countries where they operate. Our hosting provider serves the Service from a global network; our database is located in Eastern North America (ENAM).
- From the EU/EEA, UK and Switzerland: we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum and Swiss amendments), and on a provider’s certification under the EU-U.S. Data Privacy Framework where available. (under legal review)
- From Türkiye: transfers abroad follow Article 9 of KVKK: an adequacy decision, appropriate safeguards such as the standard contract published by the Personal Data Protection Authority (which is notified to the Authority within five business days of signature), or, for occasional transfers where no other basis applies, your explicit consent. (under legal review)
You can ask us for a copy of the safeguards we use at hello@themorfose.com.
9. How we protect it
These are measures in the Service today:
- Separation between companies. Every table that holds company data carries a company ID, all database access goes through one data layer that takes the company from your session (never from the request), and automated tests check that each company’s data is unreachable from another company’s account.
- Hashed secrets. Sign-in links, session cookies and invitation tokens are random values; only their SHA-256 hashes are stored.
- Short-lived sign-in. Sign-in links expire in 15 minutes and work once; opening one requires a confirmation click, so email security scanners cannot use it up. Google sign-in uses PKCE, a one-time state value tied to the browser that started it, and verified email addresses only.
- Session limits. Sessions end after 7 days of inactivity and at most 90 days after sign-in; you can sign out of every device at once.
- Hardened cookies and requests. Cookies are
__Host-prefixed,HttpOnly,SecureandSameSite=Lax. Every request that changes data must come from our own site, and any data it carries must be sent as JSON. - Rate limits on sign-in: 5 link requests per minute per network address, 3 per 15 minutes per email address, and 10 Google sign-in starts per minute per network address.
- No raw IP addresses stored: only a salted digest, with the salt kept as a server secret.
- Append-only audit log that the database refuses to edit or delete.
- Browser protections on the application: a Content Security Policy, HTTPS enforced with HSTS, framing blocked, no referrer sent, and third-party libraries pinned to exact versions with integrity checks.
- Secrets (such as Google sign-in credentials) are stored as encrypted platform secrets, not in our code.
No system is perfectly secure. If we learn of a personal data breach affecting you, we will notify you and the authorities as the law requires.
10. Your rights
Depending on where you are, you may have the right to:
- access your personal data and get a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to processing based on legitimate interests;
- data portability: receive your data in a machine-readable format;
- withdraw consent where we rely on it, without affecting earlier processing;
- complain to a data protection authority, such as the authority where you live or work in the EU/EEA, the UK Information Commissioner’s Office, or Türkiye’s Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
Some of this you can do yourself in the Service: owners and admins can download the company’s data from Settings (a JSON file, and the catalog as a CSV file), and any user can delete their own account from Settings (see section 6 for what happens). To use these rights otherwise, email hello@themorfose.com. We will confirm your identity (usually by replying from the email address on your account) and respond within one month under GDPR/UK GDPR, 30 days under KVKK and 45 days under the CCPA, extendable where the law allows. If your request is about Customer Data (for example, your name on a customer’s order), we will pass it to the company that controls that data and help it respond.
11. Türkiye (KVKK)
This section is our information notice (aydınlatma metni) under Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”). The data controller is Morfose USA Inc.; our contact in Türkiye is (under legal review). Sections 3 to 8 above describe the data we process, how it is collected, our purposes and legal bases, and to whom and where it is transferred.
Under Article 11 of KVKK you may ask us whether we process your data; request information about it; learn the purpose of processing and whether data is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; ask for correction of incomplete or inaccurate data; ask for deletion or destruction under Article 7; ask that correction or deletion be notified to those to whom the data was transferred; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
You can apply in writing to 3920 Tollhouse Drive, Naples, FL 34114, United States, or by email to hello@themorfose.com from the address registered with us, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. We respond free of charge within 30 days.
Data Controllers’ Registry (VERBIS): (under legal review)
Explicit consent: where KVKK requires explicit consent (for example, for a transfer abroad that has no other legal basis), we will request it separately and will not make it a condition of using the Service unless the law allows.
12. California (CCPA/CPRA)
For personal information in Customer Data, we act as a “service provider” to our customer. For the account and business contact data we control, in the last 12 months we collected the categories in section 3: identifiers (name, email address, account IDs, salted IP digest), commercial information (plan and usage), and internet activity limited to security and audit records. We collected them for the business purposes in section 5 and disclosed them only to the service providers in section 7.
We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use sensitive personal information for purposes that require a right to limit. California residents may exercise the rights to know, delete and correct, may use an authorised agent, and will not be discriminated against for doing so. Contact hello@themorfose.com.
13. Children
Tiercube is a service for businesses and is not directed to children. We do not knowingly collect data from anyone under 16.
14. Changes to this policy
We will post changes here and update the date at the top. For material changes, we will notify account owners by email or in the Service before they take effect.
15. Contact
Morfose USA Inc.
3920 Tollhouse Drive, Naples, FL 34114, United States
Privacy: hello@themorfose.com