Privacy Policy
Last updated: October 27, 2026
This Privacy Policy explains what personal data mem4dev collects, why, who receives it and what rights you have. The controller of your personal data is Barría Miranda Inversiones Ltda (trade name: mem4dev), Walker Martínez 668, Of. 701, Chile ("mem4dev", "we"). Privacy contact: support@mem4dev.com.
1. Data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email, name, password (stored only as a one-way hash), language and time zone preferences; if you sign in with Google, the identifier and email Google provides. | Create and secure your account, sign you in, send transactional emails (sign-in links, account notices). | Contract |
| Your content: journal entries, tags, attachments you upload, scopes and the people you share them with. | Provide the Service: store, search and show your journal, and answer your questions about it. | Contract |
| Content derived from your entries: embeddings (numeric representations) used for semantic search, and tags suggested by AI. | Semantic search and tagging. | Contract |
| Authorizations: API keys (stored hashed) and the access you grant to external AI assistants through OAuth, with their scope and permission level. | Let assistants and tools you choose use your journal, and let you revoke that access. | Contract and your consent |
| Billing data: plan, subscription status, amounts, dates, and the customer and transaction identifiers issued by Paddle. We do not receive or store your card or bank details. | Manage your subscription, apply plan limits, send billing notices, keep accounting records. | Contract and legal obligation |
| Usage and security data: a record of API and MCP calls (time, action, account), rate-limit and usage counters, one-way hashes of the IP address and browser used for a "remember me" session, and standard web-server and CDN logs, which include IP addresses. | Operate and protect the Service, prevent abuse, enforce plan limits, diagnose errors. | Legitimate interests and contract |
| Product usage events: which actions you take (for example signing in, creating an entry, connecting an assistant or changing plan), with the date, the channel (web, API or MCP) and the scope involved, and labels we derive from them (for example how active you are or which features you have used). They never include the content of your entries, your name, your email or your IP address. | Understand how the product is used, improve it, give support and detect problems. | Legitimate interests |
| Support messages: what you send us by email. | Answer you. | Legitimate interests |
We do not sell personal data, we do not use it for advertising, and we do not use your content to train AI models.
2. Who receives your data
We share data only with providers that help us run the Service, under agreements that restrict their use of it:
- Amazon Web Services (United States, region us-east-1): hosting, database, file storage for attachments, content delivery, email sending and secret management.
- OpenAI: the text of the entries and questions needed to generate embeddings, tags and answers. We use OpenAI's API; under OpenAI's API terms, data sent through the API is not used to train its models by default.
- Qdrant: hosts the vector search index built from your entries.
- Google: sign-in with Google.
- Paddle.com ("Paddle"): our Merchant of Record. Paddle processes your payment, billing and tax data as an independent controller under its own privacy notice, and shares with us the data we need to manage your subscription.
- External AI assistants you authorize (for example Claude, Cursor, VS Code): they receive what you allow them to read from the scopes you selected, under their own terms.
- People you share a scope with: they can see that scope's content according to their role.
- Professional advisers and authorities, only when required by law or to protect our rights.
3. International transfers
Our providers operate mainly in the United States, so your data is processed outside the country where you live, including outside Chile and the European Economic Area and the United Kingdom. Where the law requires it, transfers are protected by the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses or an adequacy decision.
4. How long we keep it
- Account and content: while your account is active. When you delete your account it is deactivated for 30 days (you can cancel by signing in); after that all your content, attachments and search indexes are permanently deleted.
- Billing records: kept for as long as tax and accounting law requires, even after account deletion.
- Request logs and security data: a limited period needed to operate and secure the Service.
- Product usage events: 24 months, after which they are deleted automatically. The labels derived from them last as long as your account is active.
- Support emails: as long as needed to handle your request and the follow-up.
5. Security
Journal entry text and names are encrypted at rest (AES-256-GCM), traffic uses HTTPS, attachments are private and are only reachable through short-lived signed links, passwords are stored hashed, and every account and every scope is isolated so that one user's data is not accessible to another. Secrets are kept in a managed secret store, not in code. No system is perfectly secure; if a breach affects your data we will notify you as required by law.
6. Cookies and local storage
We use the cookies and browser storage that are strictly necessary: a session cookie to keep you signed in, an optional "remember me" cookie (up to 30 days), a language preference cookie, a cookie that remembers your cookie choice, and a local-storage entry that remembers your light or dark theme. Analytics and marketing cookies, set through Google Tag Manager, are used only if you accept them, and you can change or withdraw that choice at any time from "Cookie settings" at the bottom of every page. Paddle may set its own cookies on its checkout page. The full list is in our Cookie Policy.
7. Your rights
Depending on where you live (including under Chilean data-protection law, the GDPR and the UK GDPR), you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You can delete your account and content yourself from the "My account" page and export your scopes from the application. For anything else, write to support@mem4dev.com; we answer within one month. You can also lodge a complaint with your data-protection authority.
8. Children
The Service is for people aged 18 or over. We do not knowingly collect data from minors; if you believe a minor has registered, contact us and we will delete the account.
9. Changes
We may update this policy. We will notify registered users of material changes by email or in the application, and the date at the top shows the latest version.
10. Contact
Barría Miranda Inversiones Ltda (trade name: mem4dev), Walker Martínez 668, Of. 701, Chile. Email: support@mem4dev.com.