Last updated: June 2026 · MnemonX (mnemonx.ai)
GDPR Art. 28 compliant · UK GDPR · Standard Contractual Clauses (2021)
This DPA is incorporated by reference into the MnemonX Terms of Service for all users. For enterprise customers requiring a signed DPA, contact [email protected].
Controller / Customer: The individual or organisation that has agreed to the MnemonX Terms of Service and uses the Service to process personal data.
Processor / MnemonX: MnemonX (mnemonx.ai), which processes personal data on behalf of the Controller pursuant to these Terms.
GDPR: Regulation (EU) 2016/679. UK GDPR: UK GDPR as retained under the Data Protection Act 2018. SCCs: EU Commission Implementing Decision 2021/914 (Standard Contractual Clauses).
MnemonX processes personal data to provide the Service described in the Terms of Service, for the duration of the customer's account. Processing ends on account deletion, after which personal data is deleted within 30 days (except where retention is required by law).
| Category | Data subjects | Purpose |
|---|---|---|
| Identifiers | End users (account holders) | Authentication via phone OTP |
| Encrypted wallet content | End users | Encrypted storage & retrieval — decrypted only to serve the data subject's own authorized requests (see Section 9) |
| Subscription data | End users | Plan management, billing, tier enforcement |
| SMS consent records | End users | A2P 10DLC / TCPA compliance |
| API access logs | End users | Security auditing, OAuth scope enforcement |
| Organisation domains (enterprise) | Employees of enterprise customers | Shared team memory storage |
| Organisation directory (enterprise) | Employees of enterprise customers | Org name, member list, roles, SSO/SCIM/OAuth policy configuration — team administration and identity management |
| SCIM provisioning data (Enterprise) | Employees of Enterprise customers | Email, name, and role, received from the customer's identity provider (Okta/Azure AD) to automatically create, update, and deprovision org membership |
| Invoice billing data | Organisation billing contacts (Team/Enterprise) | Billing email, PO number, invoice payment status — to administer NET-30 invoice billing |
MnemonX processes personal data only on documented instructions from the Controller (these Terms, plus any supplementary instructions from enterprise customers). If required by EU/UK law, MnemonX will notify the Controller before processing contrary to instructions, unless prohibited by law.
Persons authorised to process data are bound by confidentiality obligations. Access is role-limited to personnel who need it to operate the Service.
AES-256-GCM client-side encryption; TLS 1.3 in transit; bcrypt/SHA-256 hashed tokens; 8-hour JWT hard expiry; 5-attempt brute-force lockout; Supabase Row-Level Security on all tables. See /security for full detail.
See Section 8. MnemonX will give 30 days notice before engaging new sub-processors. The Controller may object within that period; failure to object constitutes consent.
MnemonX will assist the Controller in fulfilling data subject rights requests (access, erasure, portability, restriction) to the extent the Controller cannot do so through the Service interface.
MnemonX will provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (Art. 35) and prior consultations with supervisory authorities (Art. 36) where the processing is likely to result in high risk.
Upon termination, at the Controller's choice, MnemonX will delete or return all personal data and delete existing copies within 30 days, unless EU/UK law requires retention.
MnemonX will provide all information necessary to demonstrate compliance with GDPR Art. 28, and allow audits by the Controller or an auditor mandated by the Controller. Reasonable notice required; confidentiality obligations apply to audit findings.
Supabase us-east-1 (Virginia, AWS)
Serves: US, Canada, all others
LiveSupabase eu-central-1 (Frankfurt, AWS)
Serves: EU27, EEA, UK, Israel, Gulf, North Africa
Live · GDPR compliantPipeline regions (coming soon): 🇦🇺 Australia & Pacific · 🇸🇬 Southeast Asia · 🇧🇷 South America. Enterprise customers requiring early access should contact [email protected].
Billing, account, and organisation directory metadata (plan tier, Stripe IDs, organisation name, member list, roles, SSO/SCIM/OAuth policy configuration — not wallet content) is stored on the US database for every customer, regardless of the wallet region chosen for that customer or organisation. Region changes require a support-assisted migration.
EU wallet content and encryption keys stay in Frankfurt (eu-central-1) and are never transferred to the US. The EU personal data that IS transferred to the US is: subscription/billing data, anonymised analytics, and — for EU-based organisations — organisation directory metadata (org name, member list, roles, SSO/SCIM/OAuth policy configuration; never the org's shared wallet content, which stays in the org's chosen region). These transfers are governed by EU Standard Contractual Clauses (Module 2: Controller → Processor) per EU Commission Decision 2021/914. A Transfer Impact Assessment (TIA) is available on request at [email protected].
Covered by UK International Data Transfer Agreements (IDTAs) and/or the UK Addendum to EU SCCs. Contact [email protected] for copies.
MnemonX contractually guarantees that EU users' encrypted wallet content and encryption keys will not be transferred outside the EU/EEA region without explicit consent, except as required by EU/UK law (in which case we notify the Controller unless prohibited). This guarantee does not extend to billing, account, or organisation directory metadata (see Section 5), which is processed in the US for every customer under the SCCs described in Section 6.1 — this scope limitation is intentional and disclosed here, on /security, /enterprise, and /pricing.
Upon becoming aware of a personal data breach, MnemonX will: (a) notify the Controller without undue delay and within 72 hours of becoming aware (GDPR Art. 33); (b) include at minimum: nature of the breach, categories and approximate number of data subjects/records affected, likely consequences, measures taken or proposed. The Controller is responsible for notifying its supervisory authority and, where required, affected data subjects.
Breach notification contact: [email protected]. Note: because all wallet data is AES-256-GCM client-side encrypted, a breach of the database does not constitute a breach of intelligible personal data — the encrypted blobs are unreadable to any party including MnemonX.
MnemonX uses the following approved sub-processors. All are bound by Data Processing Agreements:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database & auth hosting (US: us-east-1; EU: eu-central-1) | US / EU |
| Stripe | Payment processing | US (global infrastructure) |
| Twilio | SMS delivery (OTP + notifications) | US (A2P 10DLC) |
| Resend | Transactional email | US |
| PostHog | Anonymous product analytics | US (or EU Cloud) |
| Vercel | Application hosting & edge functions | US / global edge |
| OpenAI / Anthropic / Google | AI import extraction (transient only) | US |
AES-256-GCM client-side encryption — server stores ciphertext at rest. Encryption keys are per-user and also stored server-side (to enable multi-device sync). Server-side decryption is limited to specific, authorized code paths tied to the requesting user's own session, apps/API keys they've explicitly connected, or their own data export — never ad hoc or support-initiated access.
TLS 1.3 enforced on all endpoints. HSTS headers applied.
SMS OTP (Twilio) + optional passkeys (WebAuthn/FIDO2 — Face ID, Touch ID). No password-based auth.
Row-Level Security (RLS) on all Supabase tables. Role-based access for admin functions. IP allowlist for admin dashboard.
8-hour JWT hard expiry. 12-minute idle timeout. Automatic signOut on expiry.
Admin dashboard: 5 failed login attempts → 15-minute lockout (dedicated attempt-tracking table). Main application: authentication is rate-limited by our auth provider (SMS OTP / passkeys); general API abuse across all endpoints is separately rate-limited per-IP (Upstash Redis distributed limiting when configured, in-memory otherwise).
Dependencies monitored via npm audit. Security-relevant updates applied promptly.
All API calls to user wallets logged (endpoint, scope, timestamp). Admin actions logged. Retained 90 days.
No name, email address, or location data collected except as voluntarily provided. Phone number used solely for authentication.
Per-domain cryptographic key isolation via HKDF, ensuring compromise of one domain's key does not affect others.
MnemonX provides the following mechanisms for data subjects to exercise their rights directly, without requiring Controller intervention:
Enterprise customers requiring a signed, countersigned DPA with custom SCC annexes, jurisdiction-specific addenda, or DPIA documentation should contact:
We can provide: signed PDF DPA · SCC Module 2 annex · TIA documentation · Sub-processor list with DPA links · DPIA template assistance · UK IDTA addendum
For Enterprise organisations that enable SCIM, your identity provider (Okta or Azure AD) pushes employee name, email, and role to MnemonX to automatically create, update, and deactivate org membership. Deactivating a user via SCIM also revokes that individual\'s own personal third-party app connections — never other members\' connections. This data flow is controlled entirely by your organisation\'s admin via a bearer token you generate and can rotate or revoke at any time from your org\'s Security tab; MnemonX does not initiate this sync.
DPO / EU Representative: [email protected]
Privacy: [email protected]
Legal / DPA: [email protected]
Security & breach: [email protected]
MnemonX · mnemonx.ai · Privacy Policy · Terms of Service