Last updated: October 2026 · MnemonX (mnemonx.ai)
GDPR Art. 28 compliant · UK GDPR · Standard Contractual Clauses (2021)
This DPA is incorporated by reference into the MnemonX Terms of Service for all users. For enterprise customers requiring a signed DPA, contact [email protected].
Controller / Customer: The individual or organisation that has agreed to the MnemonX Terms of Service and uses the Service to process personal data.
Processor / MnemonX: MnemonX (mnemonx.ai), which processes personal data on behalf of the Controller pursuant to these Terms.
GDPR: Regulation (EU) 2016/679. UK GDPR: UK GDPR as retained under the Data Protection Act 2018. SCCs: EU Commission Implementing Decision 2021/914 (Standard Contractual Clauses).
MnemonX processes personal data to provide the Service described in the Terms of Service, for the duration of the customer's account. Processing ends on account deletion, after which personal data is deleted within 30 days (except where retention is required by law).
| Category | Data subjects | Purpose |
|---|---|---|
| Identifiers | End users (account holders) | Authentication via phone OTP |
| Encrypted wallet content | End users | Encrypted storage & retrieval — decrypted only to serve the data subject's own authorized requests (see Section 9) |
| Chats, files, designs, code projects, plans, schedules, Twin pages and Job Hunter resumes | End users, and people whose data the user puts in them; visitors who ask a Twin a question | Providing the AI chat, Studio, Twin and Job Hunter features. Job Hunter data is stored encrypted with the user’s key, and is not end-to-end encrypted. What the user sends to an AI feature is passed to the AI provider that answers (see Sections 6 and 8) |
| Subscription data | End users | Plan management, billing, tier enforcement |
| SMS consent records | End users | A2P 10DLC / TCPA compliance |
| API access logs | End users | Security auditing, OAuth scope enforcement |
| Organisation domains (enterprise) | Employees of enterprise customers | Shared team memory storage |
| Organisation directory (enterprise) | Employees of enterprise customers | Org name, member list, roles, SSO/SCIM/OAuth policy configuration — team administration and identity management |
| SCIM provisioning data (Enterprise) | Employees of Enterprise customers | Email, name, and role, received from the customer's identity provider (Okta/Azure AD) to automatically create, update, and deprovision org membership |
| Invoice billing data | Organisation billing contacts (Team/Enterprise) | Billing email, PO number, invoice payment status — to administer NET-30 invoice billing |
MnemonX processes personal data only on documented instructions from the Controller (these Terms, plus any supplementary instructions from enterprise customers). If required by EU/UK law, MnemonX will notify the Controller before processing contrary to instructions, unless prohibited by law.
Persons authorised to process data are bound by confidentiality obligations. Access is role-limited to personnel who need it to operate the Service.
AES-256-GCM encryption on the user's device before storage (the per-user key is also held server-side, encrypted with a master key kept outside the database; see Section 9); TLS 1.3 in transit; bcrypt/SHA-256 hashed tokens; automatic sign-out after 1 hour of inactivity; 5-attempt brute-force lockout on the staff dashboard; Supabase Row-Level Security on all tables. See /security for full detail.
See Section 8. MnemonX will give 30 days notice before engaging new sub-processors. The Controller may object within that period; failure to object constitutes consent.
MnemonX will assist the Controller in fulfilling data subject rights requests (access, erasure, portability, restriction) to the extent the Controller cannot do so through the Service interface.
MnemonX will provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (Art. 35) and prior consultations with supervisory authorities (Art. 36) where the processing is likely to result in high risk.
Upon termination, at the Controller's choice, MnemonX will delete or return all personal data and delete existing copies within 30 days, unless EU/UK law requires retention.
MnemonX will provide all information necessary to demonstrate compliance with GDPR Art. 28, and allow audits by the Controller or an auditor mandated by the Controller. Reasonable notice required; confidentiality obligations apply to audit findings.
Supabase us-east-1 (Virginia, AWS)
Serves: US, Canada, all others
LiveSupabase eu-central-1 (Frankfurt, AWS)
Serves: EU27, EEA, UK, Switzerland, Israel, Middle East, North Africa
Live · GDPR compliantPipeline regions (coming soon): 🇦🇺 Australia & Pacific · 🇸🇬 Southeast Asia · 🇧🇷 South America. Enterprise customers requiring early access should contact [email protected].
Billing, account, and organisation directory metadata (plan tier, Stripe IDs, organisation name, member list, roles, SSO/SCIM/OAuth policy configuration — not wallet content) is stored on the US database for every customer, regardless of the wallet region chosen for that customer or organisation. Region changes require a support-assisted migration.
Stored EU wallet content and encryption keys stay in Frankfurt (eu-central-1) and are not stored in the US. The EU personal data that IS transferred to the US is: content the user chooses to send to an AI, voice or video provider (see Section 8), which is decrypted for that request and handled by that provider under its own terms; subscription/billing data, anonymised analytics, and — for EU-based organisations — organisation directory metadata (org name, member list, roles, SSO/SCIM/OAuth policy configuration; never the org's shared wallet content, which stays in the org's chosen region). These transfers are governed by EU Standard Contractual Clauses (Module 2: Controller → Processor) per EU Commission Decision 2021/914. A Transfer Impact Assessment (TIA) is available on request at [email protected].
Covered by UK International Data Transfer Agreements (IDTAs) and/or the UK Addendum to EU SCCs. Contact [email protected] for copies.
MnemonX contractually guarantees that EU users' encrypted wallet content and encryption keys will not be stored outside the EU/EEA region without explicit consent, except as required by EU/UK law, and except content the user sends to an AI, voice or video provider by using a feature that does so (in which case we notify the Controller unless prohibited). This guarantee does not extend to billing, account, or organisation directory metadata (see Section 5), which is processed in the US for every customer under the SCCs described in Section 6.1 — this scope limitation is intentional and disclosed here, on /security, /enterprise, and /pricing.
Upon becoming aware of a personal data breach, MnemonX will: (a) notify the Controller without undue delay and within 72 hours of becoming aware (GDPR Art. 33); (b) include at minimum: nature of the breach, categories and approximate number of data subjects/records affected, likely consequences, measures taken or proposed. The Controller is responsible for notifying its supervisory authority and, where required, affected data subjects.
Breach notification contact: [email protected]. Note: wallet data is stored AES-256-GCM encrypted, but each user's key is stored in the same regional system so that MnemonX can serve the user's own requests. We therefore do not assume that encryption alone makes a database incident harmless, and we assess every incident on its facts, including whether keys were affected, before deciding who must be notified.
MnemonX uses the following sub-processors. Each is bound by data-processing terms, either an agreement with us or the standard terms it offers to business or API customers:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database & auth hosting (US: us-east-1; EU: eu-central-1) | US / EU |
| Stripe | Payment processing | US (global infrastructure) |
| Twilio | SMS delivery (OTP + notifications) | US (A2P 10DLC) |
| Resend | Transactional email | US |
| Cloudflare | Cookieless visit statistics and network protection | Global network |
| Vercel | Application hosting & edge functions | US / global edge |
| OpenAI / Anthropic / Google | AI features you use: chat (messages and files you send), image generation, helper tasks, audio and video transcription (OpenAI), AI import extraction and Memory Health analysis | US |
| ElevenLabs | Voice typing, meetings and live voice (audio sent for transcription; text sent for speech) | US |
| xAI / Perplexity | Chat answers when the user (or Mox for a task) uses Grok or Perplexity: the message and any attached files | US |
| Runway / Kling | Video generation: the prompt and any picture or clip the user adds (Runway also hosts the Seedance model, used only after the user’s explicit agreement) | Provider-operated; see provider policy |
| Neon | Mox databases a user creates for a published website (one small Postgres database per project) | Provider-operated; see provider policy |
| Upstash | Request counters for rate limiting (keyed by network address, kept briefly) | Global |
AES-256-GCM client-side encryption — server stores ciphertext at rest. Encryption keys are per-user and also held server-side (to enable multi-device sync), stored in the database only in encrypted form, locked with a separate master key kept outside the database. Our servers can unlock them to serve the requests described below; this is not zero-knowledge or end-to-end encryption. Server-side decryption is limited to specific, authorized code paths tied to the requesting user's own session, apps/API keys they've explicitly connected, or their own data export — never ad hoc or support-initiated access.
TLS 1.3 enforced on all endpoints. HSTS headers applied.
SMS OTP (Twilio) + optional passkeys (WebAuthn/FIDO2 — Face ID, Touch ID). No password-based auth.
Row-Level Security (RLS) on all Supabase tables. Role-based access for admin functions. IP allowlist for admin dashboard.
Automatic sign-out after 1 hour without activity (a warning shows first). Short-lived access tokens are renewed while you are signed in. Staff admin dashboard sessions last 8 hours at most.
Admin dashboard: 5 failed login attempts → 15-minute lockout (dedicated attempt-tracking table). Main application: authentication is rate-limited by our auth provider (SMS OTP / passkeys); general API abuse across all endpoints is separately rate-limited per-IP (Upstash Redis distributed limiting when configured, in-memory otherwise).
Dependencies monitored via npm audit. Security-relevant updates applied promptly.
All API calls to user wallets logged (endpoint, scope, timestamp). Admin actions logged. Retained 90 days.
No name, email address, or location data collected except as voluntarily provided. Phone number used solely for authentication.
Per-domain cryptographic key isolation via HKDF, ensuring compromise of one domain's key does not affect others.
MnemonX provides the following mechanisms for data subjects to exercise their rights directly, without requiring Controller intervention:
Enterprise customers requiring a signed, countersigned DPA with custom SCC annexes, jurisdiction-specific addenda, or DPIA documentation should contact:
We can provide: signed PDF DPA · SCC Module 2 annex · TIA documentation · Sub-processor list with DPA links · DPIA template assistance · UK IDTA addendum
For Enterprise organisations that enable SCIM, your identity provider (Okta or Azure AD) pushes employee name, email, and role to MnemonX to automatically create, update, and deactivate org membership. Deactivating a user via SCIM also revokes that individual's own personal third-party app connections — never other members\' connections. This data flow is controlled entirely by your organisation\'s admin via a bearer token you generate and can rotate or revoke at any time from your org\'s Security tab; MnemonX does not initiate this sync.
DPO / EU Representative: [email protected]
Privacy: [email protected]
Legal / DPA: [email protected]
Security & breach: [email protected]
MnemonX · mnemonx.ai · Privacy Policy · Terms of Service