GDPR and data processing

For the account you hold with us — your name, your email address, your usage figures — we are the controller, and we decide the purposes described in the privacy policy.

For the memory content you send, you are the controller and we are the processor. You decide what is stored and why; we act on your instructions and on nothing else. If the content is about your own users, their requests come to you and we help you answer them.

What we hold, in full

To perform our contract with you.

Account data, so that we can give you the service you signed up for.

Your instructions as controller.

Memory content, handled under the agreement between us and for no purpose of our own.

Legitimate interests.

Keeping the service secure and available, applying quotas, and keeping the audit record described below. We have weighed that record against your interest in being forgotten, which is why what identifies you is stripped out of it rather than simply kept.

Legal obligation.

Where we are required to keep or hand over something, and cannot decline.

Access (Article 15).

We will tell you what is held for your account, and produce a copy of a workspace's data on request.

Correction (Article 16).

A stored memory can be edited through the API, and the correction takes effect the next time it is asked for.

Deletion (Article 17).

A memory can be deleted, and a whole workspace can be deleted, which removes everything in it outright.

Restriction (Article 18).

A workspace can be suspended. It stays intact and stops being usable, which is the closest thing we have to freezing the processing.

Portability (Article 20).

An export of everything held for a workspace is produced on request, in a form a machine can read. Read the section below before you plan around it.

Objection and complaint (Articles 21 and 77).

You can object to the processing, and you can complain to your local supervisory authority. We would rather you told us first, but that is your choice and not a condition.

Write to us through the contact form, naming the workspace, from an address we already hold for the account. We will produce an export of everything held for it within one month of the request — the period the regulation allows. If it is going to take longer, we will tell you inside that month, and why.

Because a workspace has a space of its own, an export reads that one space and cannot pick up a neighbour's entry by accident. It is the same property that makes the separation claim on the security page true.

A self-service export is planned. This page will change when it exists, and not before.

Deleting a memory stops it coming back straight away, and the original conversation behind it stays until you delete the workspace — it is what lets a fact be read out afresh or moved onto a better model. Routine clean-up marks what is out of date rather than destroying it, for the same reason.

Deleting a workspace is the operation that destroys. It removes everything in it outright, and it cannot be undone.

Backups taken before a deletion still hold the data until they expire: daily copies after 6 days, weekly after 27, monthly after 89, and the nightly portable copy after 30. Nothing is restored from a backup in order to bring deleted data back.

A record of what was done to an account — created, keys issued, suspended, deleted — is kept even after a deletion. An audit trail that can delete the record of its own deletion is not an audit trail.

What identifies you is stripped out of those records during the deletion itself: the workspace name, its internal identifiers, and any free text written when the action was taken. What remains is an event and a timestamp, which is not personal data about whoever the workspace belonged to.

The same point, in the privacy policy

Memory content is stored in the European Union. The other companies involved — our sub-processors, in the regulation's term — are our cloud host and its managed database service, and, where we pull facts out using a model you have not supplied your own key for, a model provider, for as long as the request takes.

A current list, with the part each one plays, is available through the contact form. Where a transfer outside the EEA is involved, it is covered by the European Commission's standard contractual clauses.

We will tell you before adding a company that touches memory content, so that you have the chance to object before it happens.

Article 32 expects these to be stated, so here they are with the mechanism named. Each customer's data is held in a dedicated PostgreSQL schema. Every query runs inside a transaction that issues SET LOCAL search_path for that one schema — never a session-level SET, which under transaction pooling would outlive the transaction and follow the connection to a different customer. Schema names come from our internal registry and are never built from a request. Erasure under Article 17 is DROP SCHEMA against that one schema: the tables cease to exist, and it is irreversible. Retention sweeps mark rows rather than deleting them. In the same transaction as the erasure, identifying detail is stripped from the audit records, which are retained rather than deleted. Data is encrypted in transit with TLS, and provider credentials at rest with AES-256-GCM.

We will sign a data processing agreement covering the handling described here, including the terms above about other companies. Request one through the contact form.

If personal data you entrusted to us is exposed, we tell you without undue delay and with enough detail for you to meet your own obligation: what happened, which workspaces are affected, what we have done, and what we recommend you do. We would rather tell you about something that turns out to be minor than sit on it while we make up our minds.

Requests under any of the rights above go through the contact form. Name the workspace, say which right you are using, and write from an address we already hold for the account — we will ask for more identification only where we genuinely cannot tell who you are.

Contact us