The Privacy
Policy.
Memoora is built on a foundation of radical privacy. We believe your memories are your own, and our technology should serve as a vault, not a window.
Data Controller
The data controller for your personal data is Memoora, operated by its development team. You can contact us at hello@memoora.app for any privacy-related queries. Data processing is governed by Regulation (EU) 2016/679 (GDPR) and applicable Spanish data protection law (LOPDGDD). Memoora acts as data controller for your account and memory data, and as data processor for personal data of third parties (family members, friends) that you introduce into the platform.
Data We Collect
We collect only what is strictly necessary to provide the service: (1) Account: name, email address, and encrypted password (never stored in plain text). (2) Profile: optional profile photo. (3) Content: texts, photos, audio, videos and documents you add as memories; these may contain data about third parties. (4) AI interactions: text or audio fragments sent to OpenAI to generate responses, voice synthesis or transcriptions. (5) Payments: billing data managed entirely by Stripe; Memoora never stores card data. (6) Technical: session tokens and activity logs required for security. (7) Preferences: your marketing communications consent status.
Purposes and Legal Basis
We process your data for: account management and authentication (Art. 6.1.b GDPR — contract); memory storage and retrieval (Art. 6.1.b); AI processing, TTS and STT (Art. 6.1.b); welcome email and transactional notifications (Art. 6.1.b); payment processing and tax obligations (Art. 6.1.b and 6.1.c); marketing communications only with your consent (Art. 6.1.a — withdrawable at any time); aggregated and anonymous web analytics via Vercel Analytics (Art. 6.1.f — legitimate interest, no individual users identifiable); social media advertising via Meta Pixel only with your explicit consent (Art. 6.1.a).
Providers and International Transfers
We share data only with the providers necessary to deliver the service: Supabase, Inc. (Ireland/EU) — database and file storage, within the EU. OpenAI, Inc. (USA) — AI processing; transfer covered by Standard Contractual Clauses (SCCs); OpenAI does not train its models on API data. Vercel, Inc. (USA) — hosting infrastructure; SCCs applicable. Stripe Payments Europe Ltd. (Ireland) — payments, within the EU. Resend, Inc. (USA) — email delivery; SCCs applicable. We do not sell, rent or share your data with third parties for commercial purposes.
Data Retention and Your Rights
We retain your data for as long as your account is active and for legally required periods (up to 5 years for tax obligations). Upon account closure, we delete your personal data and files within 90 days, except where required by law. As a data subject you have the right to: access, rectification, erasure ('right to be forgotten'), objection, portability, and restriction of processing. Email hello@memoora.app to exercise any right (we respond within 30 days). You may lodge a complaint with the Spanish Data Protection Authority at www.aepd.es.
Special Data, Third Parties and Minors
Special categories: Your memories may contain health information, religious or political beliefs, or biometric data (photos with faces). Memoora treats this exclusively as user-provided content, without additional analysis. Third-party data: By uploading content about family members or others, you take responsibility for having a lawful basis under GDPR; Memoora acts as data processor for such content. Images: stored without any biometric processing. Minors: the service is exclusively for users aged 18 and over. Digital legacy: in the event of the account holder’s death, data remains available for 3 years from last activity. Cookies: essential (no consent needed) and Meta Pixel (with consent).
Your Control, Your Narrative
Privacy is not a legal footnote — it is the foundation of Memoora. If you have any questions about how we handle your data, write to us at hello@memoora.app. We are here to answer clearly and without jargon.
