1. Introduction

This policy explains how MemoAir collects, uses, discloses and protects information when you use our AI-powered platform and website.

2. Roles of the parties

As controller: MemoAir handles account creation, billing, website analytics, security logs and support.
As processor or service provider: MemoAir processes Customer Content uploaded by an Organization, acting on that Organization’s behalf.

3. Information we collect

Account data: name, business email, role, organization name, and a password hash or authentication provider ID.
Billing data: billing address, GST or VAT details and payment status. We do not store full card numbers; payment processors handle them.
Usage and technical data: feature usage events, interaction logs, IP address and device or browser information.
Customer Content: files, text, metadata and connector content such as Drive files, emails and calendar events, depending on the features and scopes you enable.
AI inputs and outputs: prompts, retrieved snippets, related metadata and generated outputs.
Support data: tickets, chat logs, call recordings (if any) and attachments.
Sensitive data: please do not submit sensitive data (for example health, biometric, password or financial account data) unless necessary and authorized. Customers are responsible for the categories of data they upload.

4. Legal bases for processing

Contract necessity: to provide the Services.
Legitimate interests: security, improvement and reliability.
Consent: marketing and non-essential cookies, where required.
Legal obligations: tax, compliance, lawful requests and audits.

5. How we use information

To provide search, retrieval, workflow and AI response features.
To authenticate users and manage subscriptions and billing.
To monitor performance, prevent abuse and improve the Services.
To provide support and respond to legal or compliance requests.

6. Cookies and similar technologies

Essential cookies support authentication, sessions, security and core functionality. Blocking them may affect the platform.
Analytics cookies help us understand usage and performance.
You can manage cookies in your browser settings and, where available, in product controls.
The Services do not currently respond differently to “Do Not Track” signals.

7. Information sharing and subprocessors

We do not sell personal information.
We share data only as needed to provide the Services, meet legal obligations and support workflows you authorize.
Recipients include providers of hosting, authentication, payments and billing, email and notifications, analytics and observability, and AI models, vector databases and infrastructure.
A subprocessor list is available on request. Enterprise customers may receive advance notice of material changes where agreed in contract.

8. International data transfers

Data may be processed outside your jurisdiction. Where required, we rely on mechanisms such as Standard Contractual Clauses and other lawful safeguards.

9. Security safeguards

Encryption in transit (TLS).
Access controls and least privilege.
System monitoring and security logging.
Backups and recovery procedures.
Incident response processes.

No method of transmission over the internet or electronic storage is completely secure.

10. Data retention

We keep personal data and Customer Content only as long as needed for service delivery, security, legal compliance and legitimate business purposes.
Organization administrators may configure or request retention and deletion where available.
Data may remain in backups for a limited time after deletion, according to backup cycles.

11. Breach notification

If we confirm a breach affecting Customer or User data, we will notify affected customers, users and authorities within the timelines required by law. Our target for initial notification is 7 to 15 business days, where feasible.

12. Your privacy rights and India DPDP grievances

Right to access information about processing.
Right to correct inaccurate data.
Right to erasure, subject to legal and contractual limits.
Right to withdraw consent where processing is based on consent.

Users in India may raise grievances using the contact details below. Our target for an initial response is 7 to 15 business days, within legally prescribed timelines.

13. Children’s privacy

MemoAir is a business product and is not intended for children. We do not knowingly collect data from minors and will take reasonable steps to delete it if we find it.

14. AI training and product improvement

Customer Content is not used by default to train foundation models, and we use provider controls to restrict training where supported.
Prompts, retrieved snippets, outputs and related metadata are sent to AI model providers to generate responses.
Limited operational logs may be processed to keep the Services secure and reliable.
Enterprise customers may request reduced diagnostic retention or stricter handling where supported.

15. Changes to this policy

We may update this policy. We will communicate material changes through product notices, account channels or an updated date on this page.

16. Contact

For privacy requests, complaints or DPDP grievances, contact the Grievance Officer (MemoAir Privacy Team) at support@memoair.space, Bengaluru, Karnataka, India.

Privacy Policy