GDPR & Data Requests

Your Rights

Under the General Data Protection Regulation (GDPR) and equivalent UK data protection law, you have the following rights:

• Right to be informed — You are reading this page and our Privacy Policy. We tell you what data we collect, why, and with whom we share it.
• Right to access — Request a copy of all personal data we hold about you. Email contact@memoirely.com.
• Right to rectification — Correct inaccurate or incomplete data. You can edit your memories, profile, and AI-generated content inline from the app.
• Right to erasure (right to be forgotten) — Delete your account and all associated data. See instructions below.
• Right to restrict processing — Limit how we process your data. You can opt out of AI training in Settings.
• Right to data portability — Receive your data in JSON format. See export instructions below.
• Right to object — Object to processing based on legitimate interests. You can also withdraw consent for AI processing at any time.
• Rights related to automated decision-making — AI-generated content is assistive; you make the final decisions about what to store and share.

How to Exercise Your Rights

You can exercise most rights directly from your account:

• Export your data: Settings → Privacy & Data → Export Data. You will receive a JSON file containing your memories, journal entries, chat messages, and profile data.
• Delete your account: Settings → Privacy & Data → Delete Account. Type "DELETE" to confirm. All data is permanently removed within 30 days.
• Edit your memories: Open any memory and use the inline edit controls for title, summary, and transcript.
• Edit your profile: Settings → Profile.
• Manage notifications: Settings → Notifications.
• AI training opt-out: Settings → Privacy & Data → toggle AI Training Opt-Out.
• Manage voice clones: Settings → Voice Clone → view, activate, or delete cloned voices.

For any other requests, email us at contact@memoirely.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK or your national DPA in the EU).

Data We Collect

We collect only the data necessary to provide our service. A detailed breakdown is in our Privacy Policy, but the categories are:

• Account information (name, email)
• Audio recordings and machine-generated transcripts
• AI-generated summaries, metadata (people, places, topics, emotions), and journal reflections
• Vector embeddings for semantic search
• Journal entries and streak data
• Chat messages and AI responses
• Login timestamps and IP addresses (for security)
• Usage data (page views, feature interactions)
• Voice samples (only if you choose voice cloning)

We do NOT collect government IDs, financial details (handled by Stripe), precise geolocation, contact lists, or biometric data beyond voice samples you explicitly provide.

Data Processors

We use the following trusted third-party services to operate the platform. Each provider is contractually obligated to protect your data under GDPR-compliant Data Processing Agreements (DPAs) with Standard Contractual Clauses (SCCs) where applicable:

Cross-Border Data Transfers

Your data is stored primarily in the EU (Ireland) via Supabase. However, AI processing and voice synthesis may involve data transfers to the United States and other countries where our service providers operate.

Transfers outside the European Economic Area are governed by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, and/or
• Other transfer mechanisms recognised under UK and EU data protection law.

You may request a copy of the relevant safeguards by contacting us at contact@memoirely.com.

AI Transparency

Memoirely uses AI to enhance your experience, with the following commitments:

• AI is used to generate transcriptions, summaries, metadata, journal reflections, chat responses, and vector embeddings.
• Voice cloning is opt-in only — it never happens without your explicit action.
• AI outputs may be inaccurate. They are assistive tools, not authoritative records. You should review them before relying on them.
• You can opt out of AI training uses of your data in Settings.
• Your content is processed by OpenAI and ElevenLabs solely to deliver the features you choose to use. We have DPAs in place with both providers.

Voice Data Sensitivity

Memoirely stores voice recordings, life stories, family history, and AI-generated insights. We treat this data with particular care:

• Voice recordings are stored in encrypted private storage with time-limited access.
• Voice cloning is strictly opt-in. You control whether your voice is cloned and can delete clones at any time.
• Your memories default to Private. You control visibility per memory.
• We never sell your personal data, recordings, or voice to advertisers or third parties.

Data Retention

• Active accounts: data is kept for as long as your account is active.
• Account deletion: all data is permanently removed within 30 days. Backup copies are purged within 90 days.
• Inactivity: we do not currently auto-delete data due to inactivity. If we introduce such a policy, we will notify you.
• Data minimisation: we only collect data necessary for the features you use.

Consent Management

We ask for your explicit consent in the following areas:

• AI processing: by using the Service, you consent to AI processing for feature delivery. You may opt out of AI training uses in Settings.
• Voice cloning: explicit opt-in is required before we submit voice samples to ElevenLabs.
• Marketing emails: sent only with your explicit consent.
• Cookies: strictly necessary cookies are set automatically. No advertising or tracking cookies are used.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Contact & DPO

Data Protection Officer: contact@memoirely.com

For data subject access requests, privacy inquiries, or complaints, please email us. We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO). In the EU, this is the data protection authority of your member state.