How we handle your data

Who we are

MemoryHQ (“we”) runs the service at memoryhq.keronlabs.com. For your account details and how you use the service we are the data controller. For the content your team puts into a workspace we act on the instructions of the workspace owner, as a processor under the GDPR and a data intermediary under Singapore’s Personal Data Protection Act (PDPA). Our data protection officer can be reached at privacy@keronlabs.com.

What we collect

• Account. Your name and email address, and your profile picture if you sign in with Google. Signing in by email sends a one-time code to that address.
• Content. The files you upload, the pages synced from apps you connect (Notion, Linear, Jira, Confluence, GitHub or any MCP server), the questions you ask, and the memories MemoryHQ extracts from all of this.
• Connected apps. The access tokens that let us read from an app you connect. They are stored in our database, which is encrypted at rest, and removed when you disconnect the app.
• Usage and security. The IP address and browser of each sign-in session, when API keys were last used, and short-lived request logs kept by our hosting provider.
• Billing. If you upgrade, payment is taken by Dodo Payments. We receive your plan, the subscription status and a customer id. We never see card numbers.

Why we use it

We use your data to run MemoryHQ and for nothing else. There is no advertising, no sale of data and no profiling for marketing.

• To provide the service you signed up for: storing, indexing and searching your content, answering questions and building memory. Legal basis under the GDPR: performance of a contract.
• To keep the service secure and working: session records, rate limits, error logs. Legal basis: our legitimate interest in running a reliable service.
• To bill paid plans and keep the records tax law requires. Legal basis: contract and legal obligation.
• To send you emails about your account, such as sign-in codes and invitations. Legal basis: contract.

Connecting an app is your choice, and you can withdraw it at any time by disconnecting the app in settings.

How AI is involved

Search embeddings and audio transcription run on our cloud provider’s infrastructure. Written answers and memory extraction use a third-party AI model provider under terms that forbid training on your data and limit retention to 30 days for abuse monitoring. We do not train any model on your content, and we do not let anyone else do so.

Who else processes it

We use a small number of providers to run the service. The types of provider, what they do and where they operate are listed on the subprocessors page. Other members of your workspace see content according to the teams and roles the workspace sets. Beyond that, we disclose data only when the law requires it.

Where it is stored

Our primary database runs in Singapore. Files and the search index live on our cloud provider’s network, and answer generation happens in the United States. When personal data leaves the EU, the EEA or the UK we rely on the European Commission’s standard contractual clauses and the UK addendum. When it leaves Singapore we make sure, by contract, that it gets protection comparable to the PDPA.

How long we keep it

• Content stays as long as your account or workspace exists. Deleting a document or a memory removes it from storage and the search index straight away.
• Deleting a workspace or your account removes everything in it straight away. Database backups expire within 30 days.
• Billing records are kept for as long as tax law requires.
• Sign-in sessions expire on their own and are removed when you sign out or delete your account.

Your rights

Under the GDPR and the PDPA you can ask to see the personal data we hold about you, correct it, have it deleted, receive a copy in a portable format, restrict or object to how we use it, and withdraw consent you have given. You can also complain to your supervisory authority, or in Singapore to the Personal Data Protection Commission.

Most of this you can do yourself. In the app, open Account under Settings to download everything we hold about you as JSON or to delete your account. The Memory page shows what MemoryHQ remembers about you and lets you forget any of it. For anything else, email privacy@keronlabs.com and we will respond within 30 days.

Cookies

We use one cookie, to keep you signed in. Your light or dark theme preference is stored in your browser. There are no analytics, advertising or tracking cookies, which is why you do not see a cookie banner.

Children

MemoryHQ is a tool for work and is not meant for anyone under 16. If you believe a child has created an account, email us and we will delete it.

Security

All traffic is encrypted in transit and all stored data is encrypted at rest. API keys are stored only as hashes. Every query is scoped to one workspace, and access within a workspace follows its teams and roles. Access to production systems is limited to the people who run the service.

If a breach affects your personal data we will tell you without undue delay, and notify the authorities within the deadlines that apply: 72 hours under the GDPR, and three calendar days after we have assessed the breach as notifiable under the PDPA.

Changes

When this policy changes we update the date at the top. If a change affects you in a meaningful way we email workspace owners first.

Contact

Questions, requests and complaints: privacy@keronlabs.com.