How does MnemonX protect my data?

MnemonX encrypts your memory wallet with AES-256-GCM on your device before it is sent to the server, and the server stores only ciphertext at rest. Your key is also kept server-side so your wallet can sync across your devices and serve requests you or your connected apps make; decryption happens only on those authorized paths, never as ad hoc or support-initiated access.

Which AI tools does MnemonX work with?

MnemonX works with any AI platform that supports OAuth 2.0 integrations, including ChatGPT, Claude, Gemini, Perplexity, and any custom AI tools via the MnemonX Memory API.

Can I control which AI apps access which data?

Yes. MnemonX supports domain-scoped OAuth permissions — you can grant a specific AI app access to only your Work domain, for example, while keeping your Personal domain private.

Is my data synced across devices?

Yes, on paid plans your encrypted wallet is synced to the cloud so you can access it from any device. The wallet is encrypted before it is stored. Your key is also kept on our servers, locked with a separate master key kept outside the database, so it can sync to your devices and serve the requests you make. This is not end-to-end or zero-knowledge encryption.

MnemonX — Your AI Memory, Everywhere

Covers: GDPR (EU/EEA) · UK GDPR · CCPA/CPRA (California) · LGPD (Brazil, when available) · PDPA (Singapore/Thailand, when available)

1. Overview

MnemonX ("we", "us", "our") operates the MnemonX neural context engine at mnemonx.ai. We are committed to protecting your personal data and being transparent about how we collect, use, store, and transfer it.

This Privacy Policy applies to all users globally. Additional jurisdiction-specific rights and obligations are detailed in dedicated sections below. MnemonX is an interface to third-party AI models: what you send to the AI is passed to the model provider that answers it, as described in Section 13. By using MnemonX you agree to this policy. For questions: [email protected].

2. Data Controller

Controller: MnemonX

Website: mnemonx.ai

Privacy contact: [email protected]

DPO / EU Representative: [email protected]

3. What We Collect

Phone number: Required to create an account. Used for SMS-based authentication (OTP login). Stored securely by Supabase Auth.
SMS consent record: Date, time, consent version text, and IP address when you check the consent checkbox at registration. Required by Twilio A2P 10DLC regulations. Never used for advertising.
Encrypted wallet data: Your context wallet is encrypted with AES-256-GCM on your device before storage. Decryption is limited to specific, authorized code paths tied to your own requests — see our DPA for the full scope.
Encryption key: A per-user encryption key, stored in our database only in encrypted form (locked with a separate master key kept outside the database) to enable multi-device sync. Server-side access to decrypt with it is limited to specific, authorized code paths tied to your own requests — see our DPA §9 for the full scope.
Subscription & billing: Your plan level and Stripe customer/subscription IDs to manage billing. We never store card numbers.
AI import text (transient): When you import memory from an AI tool, raw text is sent to an AI API for extraction, then immediately discarded. Not stored by us.
Visit statistics and where you came from: We count visits to our public pages with Cloudflare Web Analytics, which uses no cookies and keeps no personal profile (pages, country, which website sent the visitor). When a NEW account signs in for the first time we also save, once, which link or website brought you (for example a campaign tag or the website address, no page path) and your country, so we can see which channels work. This is shown only to the MnemonX team in our admin panel, is kept until you delete your account, is never sold and is not used for advertising. We use no product-analytics or session-recording tool.
Chats and files in chat: Your messages, the answers, and the files, pictures, videos or songs you attach or ask for are stored in your account’s region so you can open them again. Your messages and attached files are sent to the AI provider that answers (see Section 13). They are kept until you delete them, clear your data or delete your account, and your chats can be exported with their files.
Designs, code projects, plans, schedules and Studio work: The files, versions, run logs and results you create are stored in your account’s region and kept until you delete them, clear your data or delete your account. A live preview is temporary: it is closed automatically when the page stops sending its heartbeat or runs past its time limit.
Twin pages and their documents: If you make a Twin, its written fields, its public look and any documents you add (the text is split into pieces so the assistant can search them) are stored with it. Anyone with the link can ask it questions: each question, whether it was answered and the credits used are recorded in the Twin’s access log together with a one-way hash of the visitor’s connection address (not the address itself), and the question text is sent to the AI provider that answers. Deleting the Twin, clearing your data or deleting your account removes all of it.
Job Hunter (resumes, jobs and applications): If you use Job Hunter, we store what you add or confirm: facts taken from your resume (we read the file you upload and keep the facts, and we also keep your latest uploaded resume file so you can view it, download it, compare it with the resumes made for a job and send it; you can remove the file at any time in Job Hunter), your contact details and search rules, the jobs you add (including the text of the posting), the resumes made for each job, your notes and the log of what happened. This is stored in your regional database, encrypted with your own key like your wallet. It is not end-to-end encrypted: our servers unlock it to show it to you and to run the features you ask for. To read your resume, suggest facts, check a job and write a resume, the relevant text is sent to the AI provider that answers (see AI providers below); only the career and study parts of your wallet are used for suggestions, never health, money or family. Your lowest acceptable salary and your private reasons for leaving a job are never sent to an AI provider and never printed. A resume made in Job Hunter that you mark as sent is kept exactly as sent, and cannot be changed, until you delete it with your account or reset your data, which removes all Job Hunter data. If you send your own uploaded file instead, we log the file name and date, not a locked copy. Our servers never send an application or contact an employer for you. If you switch on “Watch my email”, MnemonX reads new job-alert emails from the inbox you connected (read only) to keep the jobs they list, and you can switch it off at any time. When we read a job link you paste, we fetch that public page from our servers (public addresses only). Each job can have its own Twin page, which answers a recruiter’s questions only from the questions and answers you approved for that job; see Twin pages above.
Job Hunter browser helper (Chrome add-on): The helper is an optional add-on that runs in your own browser. You connect it to your account with a pairing code that you can disconnect at any time, which stops it working. It runs on the job-application sites it lists and on mnemonx.ai. On an application page it reads the form fields in your browser to fill them, and asks MnemonX only for the answers that fit that page (your contact details, the answers you saved, the Twin link and the resume it will upload). It does not send the page’s content to us. When it finishes it tells us how many fields it filled and left for you, and, if the page confirms a submission, that the job was sent; we keep that in the job’s log. It never types your lowest acceptable salary into a form. By default you read the form and press Submit yourself. If you choose “Do it for me and submit” and Settings allows it, the helper can press Submit in your browser when its checks pass; that option stays locked until a number of your earlier applications were prepared without problems.
Published websites: The website, your agreement to the publishing terms and the history of any complaint are deleted when you delete the website, reset your data or delete your account. If a complaint is open, or the website was removed for abuse, we keep these records (and the contact details we used) until the matter is finished, because we need them to investigate, protect other people and handle legal claims (GDPR Art. 6(1)(f) and 17(3)(e)). While that applies you cannot reset your data or delete your account. Once it is finished and we have told you, you can, and we then delete the records. After a confirmed abuse case we keep only one-way fingerprints of your phone number and email so the same person cannot publish again.
Website hosting and visitors: Websites you publish are served through Cloudflare and, for apps that need a server, run on Vercel (in the US or EU region that matches your account). These providers process visitors’ connection data (such as IP address) to deliver pages and protect against attacks. We ourselves keep only a count of requests per website per day, to enforce traffic limits; we do not keep a list of visitors.
Domain name checks in Mox Studio: When a Studio role checks whether a company or product name is free as a web address, we send only the domain names it is checking (for example example.com) to rdap.org, a free public lookup that passes the question on to the domain registry. Nothing about you or your account is sent. The result is shown in that work and kept with it.
Website security checks: To check a website for known security problems we send the names and versions of its packages (not your code, files or personal data) to public package registries (npm, PyPI) and to OSV.dev, a public vulnerability database. We keep the result with the website (when it was checked, how many problems, and the update history) for as long as the website exists.
Keys and connections for your project: API keys and database addresses you save for a project are encrypted (AES-256-GCM), used only to run that project’s preview and published website, never shown again, and deleted when you remove them, delete the project, reset your data or delete your account. They are passed to our hosting provider as the website’s private settings.
Shared projects: You can share a design or a code project with up to 5 people in your Team or organization. They can see and edit that project, and see who else has it open. Other people see you only as the last 4 digits of your phone number (Team) or a masked email with two letters visible (organization). While a shared project is open we keep, for under a minute, where your pointer is and what you have selected, so teammates can avoid editing the same thing; this is deleted when you leave or after 45 seconds. You can remove a person at any time. Studio is never shared.
Mox databases: If you create a Mox database for a project, it is a small Postgres database run for us by Neon (Amazon Web Services, in the US or EU region that matches your account). Your website writes to it and reads from it; we do not read what is in it. We only read its size, to apply the size limit, warn you when it is nearly full and show it to you (and, as a number, to our support team). The address to reach it is stored encrypted as one of your project keys. It is deleted when you delete it, delete the project, reset your data or delete your account. Extra database space is a monthly payment processed by Stripe.
Reports about websites: If you report a website we keep your report, the connection address you sent it from and the email you optionally gave, to investigate and to stop misuse of the form. The website owner is not told who reported them. We keep this with the complaint record described under Published websites.
API access logs: For each API call to your wallet: the time, the endpoint, the app and the OAuth scope used, the connection address (IP) and the name of the calling program, and for a write the area and label that was written. Retained 90 days for security auditing, then deleted.
Data region preference: Which Supabase region (US/EU) stores your wallet — stored in your account tier record on our US database for routing and compliance purposes.
SCIM provisioning data (enterprise employees only): If your employer enables SCIM, your name, email, and role are received from their identity provider (Okta/Azure AD) to manage your org membership automatically. See our DPA §12b.

4. Lawful Basis for Processing (GDPR Art. 6)

For EU/EEA and UK users, every category of personal data we process has an identified lawful basis:

Data	Lawful Basis	Detail
Phone number / OTP	Art. 6(1)(b) — Contract	Necessary to perform the service (authentication)
Encrypted wallet data	Art. 6(1)(b) — Contract	Core service delivery; encrypted at rest, decrypted only to serve your own authorized requests
SMS consent record	Art. 6(1)(c) — Legal obligation	A2P 10DLC / TCPA compliance requirement
Subscription tier	Art. 6(1)(b) — Contract	Necessary to manage your plan and billing
Re-engagement SMS	Art. 6(1)(a) — Consent	Explicit opt-in at registration; withdraw anytime via STOP
Visit statistics and signup source	Art. 6(1)(f) — Legitimate interest	Understanding which channels bring users; aggregate statistics; no profiling, no advertising
API access logs	Art. 6(1)(f) — Legitimate interest	Security auditing; retained 90 days only
Data region preference	Art. 6(1)(b) — Contract	Necessary to route your data to the correct regional DB

5. Data Residency & Storage Locations

Your wallet is stored in your region

When you register, MnemonX detects your location and stores your encrypted wallet in the nearest available data region. Your encrypted wallet and its key are stored only in that region. When you use an AI feature (chat, import, Memory Health, Twin, Studio), the content you send to it is decrypted for that request and passed to the AI provider that answers, which may process it in the United States or elsewhere (see Section 13).

🇺🇸 United States Live

Supabase us-east-1 (Virginia)

Serves: US, Canada, and all others not in EU

🇪🇺 European Union Live · GDPR

Supabase eu-central-1 (Frankfurt)

Serves: EU, EEA, UK, Switzerland, Israel, the Middle East and North Africa

Pipeline regions (coming soon): 🇦🇺 Australia & Pacific · 🇸🇬 Southeast Asia · 🇧🇷 South America. Users in these regions see a "coming soon" page at signup — we will not silently store your data in the wrong region.

Billing data (all regions): Your subscription tier, Stripe IDs, and account metadata are always stored in our US database, regardless of wallet region. Stripe processes payments on their global infrastructure. These records do not contain your wallet content.

6. International Data Transfers

EU → US transfers (GDPR Chapter V)

Your stored EU wallet data stays in Frankfurt (eu-central-1). Your subscription/billing record is kept in the US. In addition, what you send to an AI, voice or video provider (for example a chat message, a file, a recording or a prompt) is passed to that provider, which is usually in the US, and a message sent through Twilio, Stripe, Resend or Vercel is handled by them as described in Section 13. These transfers are covered by EU Standard Contractual Clauses (SCCs, 2021 modules) incorporated in our DPA. A Transfer Impact Assessment (TIA) is available on request.

Sub-processors

When we use third-party services (see the full list in Section 13), we have Data Processing Agreements in place. Twilio's A2P SMS delivery may route messages through US infrastructure for EU phone numbers; this is a delivery-side telecommunications requirement, not a data storage transfer.

🇺🇸

9. California — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

Right to know

Request disclosure of the categories and specific pieces of personal information we have collected, the sources, our business purposes, and the categories of third parties with whom we share it.

Right to delete

Request deletion of personal information we have collected, subject to legal exceptions (e.g. fraud prevention, legal obligation).

Right to correct

Request correction of inaccurate personal information we hold about you.

Right to opt out of sale / sharing

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. No opt-out is required — we do not engage in these activities.

Right to limit use of sensitive PI

We collect phone numbers (sensitive PI under CPRA). Use is limited strictly to authentication and service delivery. No profiling, no inference.

Right to non-discrimination

We will not deny service, charge a different price, or provide a different quality of service because you exercised your CCPA/CPRA rights.

Exercise your rights: Email [email protected] with subject "CCPA Request". We will verify your identity and respond within 45 days (extendable by 45 days with notice). Authorised agents: provide a signed authorisation letter.

Categories collected (CCPA §1798.100): Identifiers (phone number) · Financial information (Stripe subscription ID, plan tier) · Commercial information (purchase history) · Content you create (chats, files, projects, memory) · Internet activity (security and service logs such as the API access log; we run no product analytics). We do not ask for or collect on our own: geolocation · biometric data · health data · racial/ethnic origin · sexual orientation. Anything of that kind that you choose to write into your wallet, a chat or a file is stored encrypted as your content and handled as described in this policy.

🇧🇷

10. Brazil — LGPD (Lei Geral de Proteção de Dados)

Brazil is a pipeline region — MnemonX will open a South American data residency option when our São Paulo Supabase instance launches. Until then, Brazilian users will see a "coming soon" page and will not be enrolled.

When the BR region launches, data will be processed under LGPD legal bases: execution of contract (Art. 7(V)) for authentication and wallet storage; legitimate interest (Art. 7(IX)) for security logging and fraud prevention; consent (Art. 7(I)) for promotional SMS.

ANPD: The Autoridade Nacional de Proteção de Dados (ANPD) is Brazil's supervisory authority. Complaints: gov.br/anpd.

11. SMS Communications

How you opt in: By creating an account and checking the SMS consent checkbox at registration. Consent to marketing SMS is voluntary; authentication OTPs are required for login.

Message types: Authentication OTPs · Security alerts · Account/subscription notifications · Re-engagement messages (≤1× per 90 days).

Message frequency: Authentication messages: triggered by your actions only. Re-engagement: infrequently, at most once every 90 days.

Opt out: Reply STOP to any SMS, or use Wallet → Account Settings → SMS Notifications → "Opt out". You will still receive authentication OTPs (required for login).

Carrier disclaimer: Message and data rates may apply. MnemonX is not responsible for carrier charges. Not liable for delayed or undelivered messages.

12. Cookies & Local Storage

MnemonX uses strictly necessary browser storage only. No third-party tracking or advertising cookies are set:

Authentication session: Supabase auth token in localStorage — strictly necessary for login.
Encrypted wallet cache: Local copy of your encrypted wallet for smooth offline-capable performance.
mnx_region: Your resolved data region (e.g. "eu") stored in localStorage. Not a cookie — no ePrivacy consent required.
Cookie notice flag: Single localStorage flag recording that you acknowledged this notice.
Signup source (this tab only): While you browse before signing in, your browser remembers in sessionStorage (gone when you close the tab) which link or website sent you. It is sent once to our own server when a new account first signs in. Not shared with anyone.

13. Sub-processors & Third Parties

Supabase: Database & auth hosting. US wallet data: us-east-1 (AWS Virginia). EU wallet data: eu-central-1 (AWS Frankfurt). DPA: supabase.com/privacy

Stripe: Payment processing. PCI DSS Level 1. We never see card details. stripe.com/privacy

Twilio: SMS delivery. Bound by our DPA. US-based; A2P 10DLC compliant. twilio.com/legal/privacy

Resend: Transactional email (billing receipts, digests). resend.com/privacy

Cloudflare: Cookieless visit statistics for our public pages (no personal profile), network protection, and serving the websites you publish. cloudflare.com/privacypolicy

Upstash: Short-lived request counters used for rate limiting (keyed by network address), so one visitor cannot flood the service. upstash.com/trust/privacy.pdf

Vercel: Web application hosting. Server access logs (IP, timestamp). vercel.com/legal/privacy-policy

Neon: Hosts the Mox databases you choose to create (a small Postgres database per project). Stores only what your own website saves in it. neon.tech/privacy-policy

ElevenLabs: Voice features: the audio you record for voice typing, meetings and live voice, and the text we turn into speech, are sent to ElevenLabs to be transcribed or spoken. elevenlabs.io/privacy

OpenAI / Anthropic / Google (chat): The messages and files you send in chat, the pictures you ask for, and small helper tasks (chat titles, summaries, memory notes, skill suggestions) are sent to the model provider you chose or that we use for the task. Audio and video files you add to chat are transcribed by OpenAI. We do not use your content to train any model. Each provider handles what it receives under its own API terms and privacy policy, which control whether and how long it keeps it and whether it may use it, and we cannot guarantee what a provider does; see each provider’s own policy.

xAI (Grok) and Perplexity (chat): When you choose Grok or Perplexity, or Mox picks one for a task, your message and any files you attach to it are sent to that provider to answer (Perplexity also searches the web with your question). We do not use your content to train any model. What the provider does with it is governed by its own API terms and privacy policy, which we do not control and cannot guarantee.

Runway and Kling (video): Your video prompt and any picture or clip you add are sent to the provider that makes the video: Runway (including the Seedance model it hosts, made by ByteDance in China, which is used only when you choose it yourself and agree to a warning first) or Kling. The finished clip comes back to your account. See each provider’s own policy.

OpenAI / Anthropic / Google: AI import processing (raw text sent, processed, discarded, not stored) and Memory Health analysis (wallet content sent to generate completeness scoring, gap suggestions, and duplicate/conflict detection — see below for detail). We do not use it to train any model. The providers handle it under their own API terms and privacy policies, which control retention and any use of it by them and which we cannot guarantee; please read them.

AI-powered analysis features

When you run Memory Health analysis (completeness scoring, gap suggestions, duplicate and conflict detection), your active wallet content is sent to our AI provider to generate that analysis, then discarded — we do not retain a copy of what was sent beyond the analysis result itself, which is stored in your own account the same as any other wallet data. This is separate from — and in addition to — the AI import processing described above. We do not use either feature to train any model; what a provider does with what it receives is governed by its own API terms and privacy policy, which we do not control and cannot guarantee.

13A. Alexa (an Amazon service you choose to use)

MnemonX offers an optional Alexa skill, "Mox". Alexa, Echo devices and the Alexa app are made and operated by Amazon, not by MnemonX. By linking your MnemonX account to Alexa you choose to use an Amazon service, which is governed by Amazon's Alexa Terms of Use and privacy notice. Amazon is an independent controller of the data it collects through Alexa, and you are responsible for deciding to use it.

What Amazon keeps. When you speak to Alexa, Amazon records and keeps your voice request, a text transcript, and the response Alexa gives, including what Mox says back. Amazon uses these to run and improve its services, as described in its privacy notice. Facts from your wallet that Mox reads aloud therefore also become part of your Alexa history at Amazon. MnemonX cannot see, export or delete that history, and deleting your MnemonX data or account does not delete it. You can review and delete it at amazon.com/alexaprivacysettings.

What MnemonX does. The skill mainly reads. When you ask a question, Alexa sends MnemonX the question as text and your sign-in token; MnemonX looks it up in the wallet areas you allowed on the consent screen and returns a short spoken answer to Amazon. If you also allow writing on the consent screen, you can ask Mox to save a short note ("remember that …"): Mox reads it back and, only after you say yes, adds it as one new entry in Personal → "Notes added by voice". It never changes or deletes anything else, refuses to save passwords, card or ID numbers, and keeps each note in your version history. The words of a saved note are stored in your wallet (they are your data, encrypted like the rest). We do not receive your voice recording, and MnemonX does not store your questions or the answers.

Private areas and voice code. Health, money, legal and relationship areas, and details such as medical, income, insurance or licence information, are read aloud only after you say a 4-digit voice code that you choose when linking (or later at mnemonx.ai/alexa). We store only a salted, scrambled form of it, never the code, and it is never shown on a screen. After three wrong codes in a row the skill locks for private areas until you link your account again. Details such as passport, national ID, social security, bank account and card numbers and passwords are never read aloud, even with the code. Without a code, private areas stay silent.

Your choices. Use "Disconnect Alexa" at mnemonx.ai/alexa to revoke Alexa's access at once (it also deletes your voice code), or remove it under Connected Apps; change the areas it can read or write in the Alexa app by linking again; change or remove the voice code at mnemonx.ai/alexa. If you only disable the skill inside the Alexa app, Amazon may not tell us right away, so use Disconnect Alexa if you want to be certain access is cut off. Only use Alexa for facts you are comfortable having spoken in the room where your device is, and remember that others who can speak to the device may be able to hear or ask for them.

13B. Community Skills

Community Skills are optional. If you do nothing, none of your skills are shared.

If you share a skill. A copy of its text (name, description, category, when it is used and the instructions) is sent to our central database and may be seen by our reviewers and, after approval, by other paying users. Other users do not see your name, phone number or account details. Do not put personal data, secrets or anything private in a skill you share. The central database is not in your regional data store, so a shared skill is stored outside your chosen region. Lessons you taught a skill and your chats are never shared with it.

If you install or use a community skill. We record that you installed it, and the first time you use it in a chat we record that use (your account id, the skill and the date) so the author can receive credit and so we can check for abuse. We do not send the author your chat, your name or any account detail; the author is only told how many people installed the skill.

Why. To run the library, pay credit to authors, prevent abuse and keep the library safe (contract and our legitimate interest). We keep these records while the skill and your account exist and for up to 7 years as financial and audit records where credit was paid.

Your choices. You can withdraw a shared skill or delete an installed one at any time. Deleting your account removes your shared skills from the library and deletes your installs and use records, except the record that credit was paid, which we keep as an accounting record. Contact [email protected] for any request.

14. Data Retention

Account data: Retained while your account is active. Permanently deleted within 30 days of account deletion.
Encrypted wallet: Deleted immediately and irreversibly upon account deletion from the regional DB.
SMS consent record: Kept while your account exists and deleted with it when you delete your account.
Deleted-account log: When an account is deleted we keep a short log (email address if you gave one, plan, the reason if you gave one, and the date) for one year, then delete it.
Community skill records: Shared skills while shared; installs and uses while the skill and your account exist. A record that credit was paid is kept up to 7 years.
Billing records: Stripe retains per their policy. We keep the credit ledger (amounts, dates and plan or purchase labels) for up to 7 years (financial record-keeping law). When you delete your account, the free-text details of what you used are erased from it.
API access logs: 90 days for security auditing, then deleted.
Error reports: When something breaks we keep a short technical note (what failed and where). E-mail addresses, phone numbers and tokens are removed from it before it is stored. Deleted after 30 days.
Signup source: Where your account came from (link or site, country). Kept with your account and deleted when you delete it. Cloudflare’s cookieless visit statistics are aggregate and are kept by Cloudflare under its own policy.

15. Your Rights — All Jurisdictions

→Access — request a copy of all personal data we hold.
→Deletion — delete your account and all wallet data (app setting or email us).
→Correction / update — edit wallet content directly in the app.
→Data portability — wallet as .txt / .md / .json, chats from the chat export, designs and code projects from their pages, account records via GET /api/v1/user/export; anything else on request.
→Opt out of SMS — reply STOP, or in-app toggle.
→Object to analytics — we use no tracking cookies and no advertising trackers; email [email protected] to object to the signup-source record.
→Restrict processing — email [email protected].
→Withdraw consent — for any consent-based processing, withdraw at any time without affecting past processing.

All requests: [email protected]. We respond within 30 days (GDPR/UK GDPR), 45 days (CCPA/CPRA), or as required by applicable law.

16. Security

Wallet data: AES-256-GCM encryption on your device before it is sent; your key is also stored on our servers so your wallet can sync and so we can serve requests you or your connected apps make (see the Security page for the limits on this). Transit: TLS 1.3. Auth: SMS OTP + optional passkeys (Face ID / Touch ID), with login attempts rate-limited by our authentication provider. Our admin dashboard additionally enforces a specific 5-failed-attempt / 15-minute lockout for staff access. Sessions: you are signed out automatically after 1 hour without activity (a warning shows first); the staff admin dashboard session lasts 8 hours at most. See our Security page for full technical details.

17. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33). If the breach is likely to result in a high risk, we will also notify affected users directly without undue delay (GDPR Art. 34).

18. Children's Privacy

MnemonX is not directed to children under 13 (or the age of digital consent in your jurisdiction, whichever is higher). We do not knowingly collect data from children. Contact [email protected] if you believe a child has provided data.

19. Changes to This Policy

We update the "Last updated" date when changes are made. For material changes (SMS, data sharing, new regions), we will notify you via the Service. Continued use constitutes acceptance.

20. Contact & DPO

Privacy & data subject requests: [email protected]

DPO / EU Representative: [email protected]

SMS opt-out support: [email protected]

Security vulnerabilities: [email protected]

Data Processing Agreement (enterprise): View DPA

MnemonX · mnemonx.ai

Privacy Policy