Privacy Policy

Effective date: 2026-06-29 Last updated: 2026-07-02

This Privacy Policy explains how Artem Pecheriukin (NIF Z0774077V) (“Memini”, “we”, “us”) collects, uses, shares, and protects personal data when you use the Memini AI mobile application and related services (the “Service”). Memini is a personal-memory assistant: you save notes, voice, images, and documents, which we turn into searchable “memories” and let you query through an AI chat assistant.

0. Who we are & how to contact us

Data controller: Artem Pecheriukin (NIF Z0774077V), Madrid, Spain. Postal address: see the Legal Notice.
Privacy contact: [email protected] (or [email protected]).
Data Protection Officer: not appointed; the privacy contact above is responsible for data protection queries.

1. Scope

This policy applies to the Memini AI app on iOS and Android and our backend. It does not cover third-party services you connect (e.g. Google Calendar, Notion) or third-party app stores, which have their own policies.

2. Quick summary


What we store	Your account info, the memories/notes/chat you create, voice recordings (converted to text), images you upload (for text extraction), and content you choose to import from connected services.
Why	To provide the memory + AI assistant features you ask for, run your subscription, secure the Service, and communicate with you.
AI processing	Your content is processed by us and by third-party AI providers to generate responses, transcribe voice, read text from images, and organize your memories.
We do not sell your data	We do not sell your personal data and do not use it for cross-context behavioral advertising.
Your control	You can access, export, correct, and delete your data, and delete your account at any time.
Sensitive content	You decide what to put in. Please avoid entering others’ data or highly sensitive details unless you intend to.

3. Personal data we collect

You provide / we generate as you use the Service:

Account data: email address, a display name you choose (it can be a nickname, initials, or any label; we do not require or verify a real name), password (stored only as a salted hash), and, if you sign in with Apple or Google, the email and name those services return. Country code.
Your content (“memories”): notes, journals, and documents you create or upload; their derived text, summaries, and embeddings; and facts/patterns our background processing derives from them.
Chat: the messages you exchange with the AI assistant.
Voice: audio you record for voice capture, which we transcribe to text. See §4 and §13.
Images & files: images you upload (we extract text via OCR) and files you import; stored media.
Imported content (only if you connect an integration): events from your Google Calendar, pages from Notion, and similar. This can include information about other people (e.g. event attendees, collaborators). (Email import is not enabled in this version.)
Subscription data: your plan/tier and subscription status and identifiers from the app stores / our payments processor. We do not receive or store your payment card number.
Usage & device data: feature-usage events, last-active time, app/device push notification token, and IP address and request logs (used for security and rate-limiting).
Diagnostics: crash reports, error events and performance/diagnostic data (device model, OS and app version, and limited technical context) collected via Sentry to keep the app stable.
Product analytics: anonymous, aggregated usage events collected via Aptabase (no cookies, no persistent device identifiers, no cross-app tracking) to understand how features are used.

Purpose	Data	Legal basis (Art. 6)
Provide the memory + AI assistant (store, search, transcribe, OCR, embed, generate answers)	Account, content, voice, images, chat	Performance of a contract (Art. 6(1)(b))
Special-category content you enter (e.g. health, beliefs) processed by AI/sub-processors	Your content/voice	Explicit consent (Art. 9(2)(a)) — see §5
Import content from services you connect	Integration data	Consent (Art. 6(1)(a)); imported third-party data: legitimate interests (Art. 6(1)(f))
Run subscriptions and billing	Subscription data	Contract (Art. 6(1)(b))
Secure the Service, prevent abuse, rate-limit	Usage, IP, logs	Legitimate interests (Art. 6(1)(f))
Send service emails (verification, reset, security notices)	Email	Contract / legitimate interests
Push notifications you opt into	Push token	Consent (Art. 6(1)(a))
App stability & crash diagnostics (Sentry)	Diagnostics / crash data	Legitimate interests (Art. 6(1)(f))
Product analytics (Aptabase — anonymous, privacy-preserving)	Anonymous usage events	Legitimate interests (Art. 6(1)(f)); opt-out in Settings

US users: we process the above to provide and secure the Service you request; see §12 for your rights.

5. Sensitive / special-category data

Because Memini is a free-text and voice product, the content you save may contain special-category data under GDPR Art. 9 (e.g. health, religious or political beliefs, sexual orientation, ethnicity). Memini cannot pre-filter this content. Where you choose to enter such content, we process it— including transmitting it to our AI sub-processors—on the basis of your explicit consent, which we ask for in the app. You can withdraw consent by deleting the content or your account; withdrawal does not affect prior processing. Please avoid entering other people’s sensitive data without a lawful reason.

6. AI and automated processing

We use AI to generate chat responses, transcribe voice, extract text from images, organize your memories, and—through a background “memory processing” cycle—derive summaries, facts, and patterns from your content to improve recall. You are interacting with an AI system, which can produce inaccurate or incomplete output. We do not use this processing to make decisions that produce legal or similarly significant effects about you under GDPR Art. 22. For Memini-managed inference (chat, transcription, OCR, and memory processing performed on our infrastructure), we and our AI sub-processors do not use your content to train generalized/foundational AI models. If you bring your own API key (BYOK — see §7), the provider processes your data under your own account and terms — review that provider’s policy for its training practices. See §7 for who processes your data and the BYOK distinction.

Managed sub-processors. We share personal data with service providers (“sub-processors”) that process it on our instructions to run the Service, under contracts (DPAs) that require confidentiality, security, and no use of your data to train their own foundational models. Our current sub-processors are listed at meminiai.com/sub-processors. Categories include:

AI / model providers (chat generation, speech-to-text, image text-extraction, embeddings): chat and embeddings via directly contracted inference providers; speech-to-text and image text-extraction via an AI gateway with provider routing restricted to vetted hosts (managed inference only);
Cloud hosting and storage (application, databases, media object storage);
Subscription management;
Push notifications;
Transactional email;
Error & crash monitoring (Sentry);
Privacy-preserving product analytics (Aptabase);
Identity sign-in (Apple/Google) and services you connect (Google Calendar, Notion).

Bring-your-own-key (BYOK). If you choose to supply your own API key and connect directly to a third-party AI provider (OpenAI, Anthropic, Groq, or Google), your data is sent to that provider under your account and your contract with them — not under our sub-processor agreements. No DPA covers BYOK traffic. The providers available for BYOK are not Memini sub-processors for that traffic; they are listed separately on our Sub-Processors page.

We may also disclose data to comply with law, enforce our terms, or protect rights and safety, and in a merger/acquisition (with notice). We do not sell your personal data and do not share it for cross-context behavioral advertising.

Data from Google services (Calendar). If you connect Google Calendar, Memini requests read-only access (calendar.readonly) and uses it only to import events from your primary calendar (title, time, location, attendee names) into your personal memory so you can recall them. We do not write to your calendar. Detected personal identifiers are masked before storage, and OAuth tokens are encrypted at rest. We do not sell this data, do not use it for advertising, and do not use it to train generalized or non-personalized AI or machine-learning models. Content imported from Google Calendar is never sent to, or processed by, the OpenRouter API; when you ask Memini a question, relevant imported calendar content is processed only by our directly contracted AI providers, solely to generate your answer, under terms that prohibit using your content to train their models. You can disconnect at any time, and deleting your account erases imported data. Memini’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. International data transfers

We and some sub-processors are located outside your country, including in the United States. Where we transfer personal data out of the EEA/UK/Switzerland, we rely on appropriate safeguards: the EU-US / UK / Swiss Data Privacy Framework where the recipient is certified, and/or the European Commission’s Standard Contractual Clauses (and the UK IDTA/Addendum) together with a transfer impact assessment.

For Memini-managed AI inference, your content is processed by AI sub-processors bound by no-training terms: your content is never used to train their models. Our chat inference provider is additionally bound by zero-data-retention terms: each request is processed only to generate your response and is not retained afterward. Our embeddings and failover provider (OpenAI) does not use API content for training and retains requests at most temporarily for abuse monitoring (up to 30 days) before deletion. Speech-to-text and image text-extraction run through an AI gateway that sends a no-retention instruction on every request it routes. These terms are enforced both technically and contractually (our agreements with these providers). Such processing may occur in the United States or other countries; any transfer of personal data is covered by the safeguards described above. If you bring your own API key (BYOK), your data is sent to the provider you select under your own account, and we do not control where that provider processes your data or how long it retains it; review your provider’s terms. Contact us for a copy of the relevant safeguards for managed processing.

9. Data retention

Account & content: retained while your account is active.
Account deletion: when you request deletion, we mark the account for deletion and permanently erase it after a 7-day grace period (you can cancel within that window). Erasure covers your memories, chats, vault data, uploaded media, integration credentials, and subscription records.
Voice audio: your dictation is sent to our speech-to-text provider only to produce a text transcript and is not stored afterwards; we keep only the resulting text as your note. We never create or store voiceprints.
Security logs / tokens: short-lived (e.g. reset codes ~10 minutes; refresh sessions ~30 days).
Backups: residual copies in encrypted backups are overwritten on our standard backup cycle.

10. How we protect your data

Encryption in transit (TLS) to all services.
A dedicated, encrypted PII vault: structured identifiers we detect (e.g. emails, phone numbers, payment-card numbers, IBANs) are encrypted with AES-256-GCM using per-user keys that are derived on demand and never written to disk or our database, so one user’s data cannot be decrypted with another’s key.
Strict per-user data isolation at the database layer (row-level security).
Hashed passwords, device-bound session tokens, and replay protection.

No method of transmission or storage is 100% secure, but we work to protect your data and will notify you and regulators of a breach where required (within 72 hours to the lead supervisory authority).

11. Your rights (EEA / UK / Switzerland)

You have the right to access, rectify, erase, restrict, and object to processing, to data portability, and to withdraw consent. To exercise them:

In-app: in the app’s settings (export your data; delete your account), or
Web: meminiai.com/delete-account (request account deletion without signing in), or
Email: [email protected].

We respond within one month. You may also lodge a complaint with your supervisory authority (and with our lead authority, Agencia Española de Protección de Datos (AEPD)).

12. Your rights (United States — California and other states)

We do not sell your personal information and do not share it for cross-context behavioral advertising. Depending on your state (e.g. California, Colorado, Connecticut, Virginia, and others), you may have the right to: know/access, delete, correct, obtain a portable copy, and opt out of targeted advertising, sale, or certain profiling; and to not be discriminated against for exercising rights. Sensitive personal information (which can appear in your content/voice) is used only to provide the Service.

Submit a request: in-app Settings, meminiai.com/delete-account, or [email protected]; authorized agents may submit on your behalf with proof of authorization. We verify requests via your account.
Global Privacy Control: because we do not sell your personal information or share it for cross-context behavioral advertising, there is no such activity for an opt-out preference signal (GPC) to apply to. If that ever changes, we will honor recognized signals as required.
Categories collected/disclosed: identifiers, account info, your content (which may include sensitive categories), commercial/subscription info, usage/internet activity, and approximate location inferred from IP — disclosed to the sub-processor categories in §7 for those purposes.

13. Consumer health data (Washington, Nevada, Connecticut)

If you enter or our features infer health-related information, that may be “consumer health data” under laws such as the Washington My Health My Data Act. We collect and process such data only to provide the Service you request and with your consent, do not sell it, and share it only with the sub-processors in §7 to deliver the Service. You can withdraw consent and delete this data as in §11.

Voice & biometrics: we send your dictation to a speech-to-text provider only to produce a transcript, and we do not store the audio afterwards. We do not create, use, or store voiceprints or other biometric identifiers. (Relevant to laws such as the Illinois BIPA.)

14. Children

Memini is not directed to children. You must be at least 18 years old to use the Service. We do not knowingly collect data from children below that age; if you believe a child has provided us data, contact [email protected] and we will delete it.

15. Cookies & local storage

The mobile app uses on-device storage to keep you signed in and remember preferences. We do not use advertising cookies or cross-app tracking. We use Sentry to collect crash and error diagnostics on the basis of our legitimate interest in keeping the app stable and secure. For product analytics we use Aptabase, a privacy-preserving, cookieless tool that collects only anonymous, aggregated usage data with no persistent device identifiers; neither tool tracks you, and you can opt out of analytics in Settings.

16. Changes to this policy

We will update this policy as the Service evolves and notify you of material changes in-app or by email before they take effect. The “Last updated” date shows the current version.

17. Contact

Questions or complaints: [email protected] / [email protected]. EU/UK residents may also contact our representatives in §0.