Data processing agreement
Processing data for your organisation
When a company uses MemoryHQ, the company decides what goes in and we process it on its behalf. This agreement sets out that relationship. It applies automatically to every workspace and forms part of the terms of service.
Last updated 19 October 2026
1. Roles and scope
You, the customer, are the controller under the GDPR and the organisation under Singapore’s PDPA for the personal data in your workspaces. MemoryHQ (“we”) is the processor, or data intermediary. For your own account details we are the controller, as described in the privacy policy.
2. What is processed
- Subject matter and purpose. Storing, indexing and searching your content, generating answers with sources, and extracting and maintaining memories for your workspace and its members.
- Duration. As long as you have a workspace with us, plus the deletion period in section 10.
- Types of data. Whatever is in the documents and connected apps you bring in, the names and email addresses of workspace members, questions asked, and the memories derived from all of this.
- Data subjects. Your staff and contractors, and anyone mentioned in your content.
3. Instructions
We process personal data only on your documented instructions: the terms of service, this agreement, and the way you and your members use the product. If we believe an instruction breaks data protection law we tell you before acting on it.
4. Confidentiality
Everyone who works on MemoryHQ is bound by confidentiality. Access to production systems is limited to the people who need it to run the service, and customer content is not copied into logs.
5. Security measures
- All traffic is encrypted in transit with TLS; all stored data is encrypted at rest.
- Every database query and every vector search is scoped to one workspace. Workspaces cannot see each other.
- Within a workspace, access to collections, answers, memory and the API follows the teams and roles you set.
- API keys are stored only as SHA-256 hashes and are rate limited. Keys are scoped to one workspace and to read or write.
- Connected apps are reached with OAuth tokens that you grant and can revoke at any time.
- Deleting a document, memory, workspace or account removes the data from storage and from the search index. Backups expire within 30 days.
6. Subprocessors
We use these kinds of providers to run the service. Each is bound by a contract with data protection terms at least as strict as this agreement. Customers who need the provider names for their own records can ask at privacy@keronlabs.com, and we send the current list.
| Provider type | What for | Where |
|---|---|---|
| Cloud infrastructure | Hosting, database, file storage, search index, embeddings and audio transcription | Singapore (primary database); global edge network |
| AI model provider | Generating written answers and extracting memories. Not used for training; retained up to 30 days for abuse monitoring | United States |
| Google LLC | Sign in with Google, if you choose it | United States |
| Dodo Payments, Inc. | Payments for paid plans, as merchant of record | United States and India |
Apps you connect (Notion, Linear, Atlassian, GitHub or any MCP server) are sources you authorise, not our subprocessors: data flows from them to us on your instruction. Before adding a subprocessor or changing a provider we update this page and email workspace owners at least 30 days in advance. If you object, you may end the agreement by deleting your workspace.
7. Requests from individuals
Members can export and delete their own data from account settings. If someone sends you a request about data we hold, we help you answer it within ten business days. If a request about your workspace reaches us directly, we pass it to you.
8. Personal data breaches
If a breach affects personal data in your workspace, we tell you without undue delay and at the latest within 72 hours of becoming aware of it, with what we know at the time, and keep you informed as we learn more.
9. International transfers
Our primary database is in Singapore and some processing happens in the United States, as shown above. For data from the EU, the EEA or the UK, the European Commission’s standard contractual clauses (processor module) and the UK addendum are incorporated into this agreement by reference. For data from Singapore, this agreement provides the comparable protection the PDPA requires for transfers.
10. Return and deletion
You can export data at any time and delete a workspace from its settings. Otherwise, we delete your workspaces within 30 days of the end of the agreement. Backups expire within a further 30 days.
11. Audits
Once a year on written request we provide the information needed to show we meet this agreement. Where a regulator requires it, or after a breach, you may audit us further at your own cost and with reasonable notice.
12. Liability and signing
Liability under this agreement follows the terms of service. This agreement applies without a signature. If your organisation needs a countersigned copy, email privacy@keronlabs.com and we will send one.