--- title: "Privacy Policy" url: https://memocore.ai/memos/6a7174659c4ff7f7f9390394 project: "Memocore Knowledge Base" tags: "privacy-security" updated_at: "2026-10-23T05:40:40.551Z" --- # Privacy Policy Memocore Privacy Policy. Last updated: 23 October 2026. Companion documents: Terms of Service at https://memocore.ai/terms, Data Processing Agreement at https://memocore.ai/dpa. This Privacy Policy explains how アン株式会社 (An Co., Ltd.), corporate number 8010601065441, registered at 新東陽ビル4階49, 東陽二丁目4番39号, 江東区, 東京都 135-0016, Japan ("we", "us", "our") collects, uses, and protects your personal data when you use Memocore (the "Service"). For your own account we are the controller of your personal data; for data your company stores about other people, see section 10. 1. DATA WE COLLECT Account data: your email address and, optionally, a display name. If you sign in with Google, Google shares your email address, name and Google account identifier with us; we use them to sign you in and to fill in your display name. We do not receive your Google password or any other data from your Google account. Content you create: your memos (title, content, and internal retrieval notes), tags, and any files you attach. Team data: company and project names, membership, roles, and invitations you send or accept, including the email addresses of people you invite. Technical data: IP address, user-agent, and timestamps, used for security, authentication sessions, and rate limiting. Billing data: handled by Stripe. We store your plan, subscription status, and a Stripe customer reference. We never store your full card details. Derived data: numeric search embeddings generated from your memo text, so the Service can find memos by meaning. 2. HOW WE USE YOUR DATA To provide the Service: store, index, search, sync, and share your memos and files. To authenticate you and keep your account secure. To enable the AI clients and integrations you authorise to access your data on your behalf. To process subscriptions and payments. To prevent abuse, enforce plan limits, and protect the Service. To send you essential service and transactional email (login codes, invitations, billing notices). We do not sell your personal data, and we do not use your content to train machine-learning models. 3. LEGAL BASES Where the GDPR applies, we process your data to perform our contract with you (providing the Service), to comply with legal obligations (for example tax and accounting), and on the basis of our legitimate interests in securing and improving the Service. Where required, we rely on your consent, which you may withdraw at any time. 4. SERVICE PROVIDERS (SUBPROCESSORS) We share data with a small set of providers who process it only to help us run the Service. Stripe: payment processing and subscriptions. Amazon Web Services (S3), United States (Oregon) region: file storage. MongoDB Atlas, United States (Oregon) region: database hosting. Postmark: transactional email delivery. OpenAI (United States): search embeddings and the in-product assistant. Memo text is sent to OpenAI when a memo is saved or updated, so the Service can build its search embedding, and when the assistant answers a question that draws on your memory. OpenAI processes it to return the result and does not use it to train its models. Three further providers receive data only if you choose to use them yourself. Google: if you sign in with Google, Google confirms your identity and shares your email address, name and Google account identifier with us. Telegram: if you link the Telegram bot, the messages you send it and the memos it returns pass through Telegram's servers. Notion: if you connect Notion, we read the pages you select in order to import them. In addition, any AI client or integration you connect will receive the data you authorise it to access. Those third parties are governed by their own privacy policies. 5. SHARING AND PUBLIC ACCESS Nothing you store is public unless you make it so. There are several ways content leaves your account, and they expose different amounts. A share link on a project memo carries a visibility setting. At "project" or "company" visibility, someone who opens the link without being admitted by that setting sees only the memo's title and preview. At "public" visibility, anyone with the link reads the memo in full, together with its attached files. A published project can be read in full by anyone who has its link, attached files included, without signing in, and anyone with an account may join it as a read-only follower. Followers read the project's memos from the web and from their own AI clients, including memos you add later. A private company project has no link, but its owner and editors may invite people outside the company by email to follow it. Invited followers read the project's memos and attached files in full. Published projects may be listed in our public catalog, which is open to search engines, so their titles and previews can appear in search results, and a published project can be indexed by search engines that come across its link. You can revoke a share link, remove followers from a private project or change a project's access level at any time; access ends immediately for anyone the new setting no longer admits. Attached files never get a permanent public address: whoever is admitted receives them through short-lived signed URLs. 6. THE CHROME EXTENSION The Memocore extension for Chrome saves text from web pages into your projects. It reads a page only when you choose "Save to Memocore" from the right-click menu or click the extension's icon, and only in the tab where you did so. It does not read your other tabs or your browsing history. Along with the text, the extension saves the page's address and title, so you can see where the text came from. What you save becomes an ordinary memo and is handled like the rest of your content (section 1). The extension stores your sign-in tokens locally in your browser. It sends data only to memocore.ai. 7. DATA RETENTION We keep your data for as long as your account is active. Deleting a memo moves it to an archive, where it stays recoverable for 45 days and is then erased permanently, together with its attached files. Deleting a project or your account removes their contents on the same basis. Some records, for example billing records, may be retained where the law requires. Short-lived security records such as authentication sessions and rate-limit counters expire automatically, and unaccepted project invitations expire after 7 days. 8. SECURITY We protect your data with encryption in transit, encryption at rest at our hosting providers, hashed authentication and API-key secrets (we store only hashes, never the raw secrets), scoped access controls, and short-lived signed URLs for private files. No system is perfectly secure, but we work to protect your data and to respond promptly to incidents. 9. YOUR RIGHTS Depending on where you live, you have the right to access, correct, export, and delete your data, and to object to or restrict certain processing. You can exercise the core rights directly. Export: download an archive of your data at any time, including when a subscription is unpaid. Deletion: delete individual memos or your entire account from your settings; account deletion cascades to your private memos, personal projects, and their contents. For any other request, contact us at support@memocore.ai. You also have the right to complain to your local data-protection authority. 10. COMPANY AND TEAM DATA When a company creates a workspace and invites members, the company decides who joins and what the team stores in its shared projects. For personal data the team stores about other people, the company is the controller and we act as its processor, handling that data on its instructions. Those obligations are set out in our Data Processing Agreement at https://memocore.ai/dpa, which applies without a signature; write to support@memocore.ai if your organisation needs a countersigned copy. Requests from individuals about data held in a company's projects are passed to that company. 11. INTERNATIONAL TRANSFERS We are a company based in Japan, and we store your data in the United States, with Amazon Web Services and MongoDB Atlas in the United States (Oregon) region. For users in the European Economic Area, the United Kingdom and Switzerland, transfers to the United States rely on the Standard Contractual Clauses in our providers' data processing agreements. Transfers to OpenAI in the United States rely on OpenAI's own transfer mechanisms in the same way. For users in Japan: your personal data is stored in the United States. The United States has no single comprehensive federal data protection law; personal data there is protected by sector-specific federal laws and by state laws. Our hosting providers are bound by contract to protect the data they process for us, and we apply the security measures described in section 8. 12. COOKIES AND LOCAL STORAGE We use only what is necessary to run the Service, for example storing your authentication tokens so you stay signed in. We do not use advertising or third-party tracking cookies. 13. CHILDREN The Service is not intended for children under 16, or under the age of digital consent in your country. We do not knowingly collect data from children. 14. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. If we make material changes, we will notify you. The "last updated" date above reflects the current version. 15. CONTACT アン株式会社 (An Co., Ltd.) 〒135-0016 東京都江東区東陽二丁目4番39号 新東陽ビル4階49 For privacy questions or requests, contact us at support@memocore.ai.