Privacy Policy

Memocore Privacy Policy. Last updated: 4 August 2026. Current text, written to match how the product actually behaves. Companion documents: Terms of Service at https://memocore.ai/terms, Data Processing Agreement at https://memocore.ai/dpa. One open point: we have no EU representative under GDPR Article 27, and the Service is offered to users in any country — either appoint one or accept the exposure; this policy does not claim to have one. This Privacy Policy explains how アン株式会社 (An Co., Ltd.), corporate number 8010601065441, registered at 新東陽ビル4階49, 東陽二丁目4番39号, 江東区, 東京都 135-0016, Japan ("we", "us", "our") collects, uses, and protects your personal data when you use Memocore (the "Service"). For your own account we are the controller of your personal data; for data your company stores about other people, see section 9. 1. DATA WE COLLECT Account data: your email address and, optionally, a display name. Content you create: your memos (title, content, and internal retrieval notes), tags, and any files you attach. Team data: company and project names, membership, roles, and invitations you send or accept. Technical data: IP address, user-agent, and timestamps, used for security, authentication sessions, and rate limiting. Billing data: handled by Stripe. We store your plan, subscription status, and a Stripe customer reference. We never store your full card details. Derived data: numeric search embeddings generated from your memo text, so the Service can find memos by meaning. 2. HOW WE USE YOUR DATA To provide the Service: store, index, search, sync, and share your memos and files. To authenticate you and keep your account secure. To enable the AI clients and integrations you authorise to access your data on your behalf. To process subscriptions and payments. To prevent abuse, enforce plan limits, and protect the Service. To send you essential service and transactional email (login codes, invitations, billing notices). We do not sell your personal data, and we do not use your content to train machine-learning models. 3. LEGAL BASES Where the GDPR applies, we process your data to perform our contract with you (providing the Service), to comply with legal obligations (for example tax and accounting), and on the basis of our legitimate interests in securing and improving the Service. Where required, we rely on your consent, which you may withdraw at any time. 4. SERVICE PROVIDERS (SUBPROCESSORS) We share data with a small set of providers who process it only to help us run the Service. Stripe: payment processing and subscriptions. Amazon Web Services (S3), Tokyo region: file storage. MongoDB Atlas, Tokyo region: database hosting. Postmark: transactional email delivery. OpenAI (United States): search embeddings and the in-product assistant. Memo text is sent to OpenAI when a memo is saved or updated, so the Service can build its search embedding, and when the assistant answers a question that draws on your memory. OpenAI processes it to return the result and does not use it to train its models. Two further providers receive data only if you switch that integration on yourself. Telegram: if you link the Telegram bot, the messages you send it and the memos it returns pass through Telegram's servers. Notion: if you connect Notion, we read the pages you select in order to import them. In addition, any AI client or integration you connect will receive the data you authorise it to access. Those third parties are governed by their own privacy policies. 5. SHARING AND PUBLIC ACCESS Nothing you store is public unless you make it so. There are three ways content leaves your account, and they expose different amounts. A share link on a project memo carries a visibility setting. At "project" or "company" visibility, someone who opens the link without being a member sees only the memo's title and preview. At "public" visibility, anyone with the link reads the memo in full. A published project can be opened by anyone who has its link, and they may join it as a read-only follower. Followers read the project's memos in full, from the web and from their own AI clients, including memos you add later. Published projects may be listed in our public catalog, which is open to search engines, so their titles and previews can appear in search results. You can revoke a share link or make a project private at any time; access ends immediately and followers are removed. Files attached to a memo are never served through a public link: they are delivered only to project members, through short-lived signed URLs. 6. DATA RETENTION We keep your data for as long as your account is active. Deleting a memo moves it to an archive, where it stays recoverable for 45 days and is then erased permanently, together with its attached files. Deleting a project or your account removes their contents on the same basis. Some records, for example billing records, may be retained where the law requires. Short-lived security records such as authentication sessions and rate-limit counters expire automatically. 7. SECURITY We protect your data with encryption in transit, encryption at rest at our hosting providers, hashed authentication and API-key secrets (we store only hashes, never the raw secrets), scoped access controls, and short-lived signed URLs for private files. No system is perfectly secure, but we work to protect your data and to respond promptly to incidents. 8. YOUR RIGHTS Depending on where you live, you have the right to access, correct, export, and delete your data, and to object to or restrict certain processing. You can exercise the core rights directly. Export: download an archive of your data at any time, including when a subscription is unpaid. Deletion: delete individual memos or your entire account from your settings; account deletion cascades to your private memos, personal projects, and their contents. For any other request, contact us at [email protected]. You also have the right to complain to your local data-protection authority. 9. COMPANY AND TEAM DATA When a company creates a workspace and invites members, the company decides who joins and what the team stores in its shared projects. For personal data the team stores about other people, the company is the controller and we act as its processor, handling that data on its instructions. Those obligations are set out in our Data Processing Agreement at https://memocore.ai/dpa, which applies without a signature; write to [email protected] if your organisation needs a countersigned copy. Requests from individuals about data held in a company's projects are passed to that company. 10. INTERNATIONAL TRANSFERS We store your data in Japan. For users in the European Economic Area and the United Kingdom, Japan is recognised as providing an adequate level of data protection, so no additional transfer safeguards are required for storage with us. Transfers to providers outside Japan, in particular to OpenAI in the United States, rely on those providers' own transfer mechanisms, such as Standard Contractual Clauses in their data processing agreements. 11. COOKIES AND LOCAL STORAGE We use only what is necessary to run the Service, for example storing your authentication tokens so you stay signed in. We do not use advertising or third-party tracking cookies. 12. CHILDREN The Service is not intended for children under 16, or under the age of digital consent in your country. We do not knowingly collect data from children. 13. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. If we make material changes, we will notify you. The "last updated" date above reflects the current version. 14. CONTACT アン株式会社 (An Co., Ltd.) 〒135-0016 東京都江東区東陽二丁目4番39号 新東陽ビル4階49 For privacy questions or requests, contact us at [email protected].