Privacy Policy
This Privacy Policy explains how mnemoIQ ("we", "our", "us") collects, uses, stores, and protects information when you use the mnemoIQ website, web application, desktop application, and Chrome extension (collectively, the "Service").
Waitlist signup and optional photos
Waitlist: We store your email, signup source and time to contact you about access. The public signup count contains no email addresses. If you sign in with Google and explicitly opt in, your Google profile photo may be displayed publicly beside the count. Sharing a photo is optional and you can withdraw it using the footer control. We do not read Gmail messages or retrieve photos merely from email addresses. Contact privacy@mnemoiq.ai to leave the waitlist or request deletion.
Internship applications
Internship recruitment: We collect the application fields you submit, email and GitHub account-control verification results, your typed electronic signature, the agreement version and text, and submission time and IP address. Skills and application statements may be sent to NVIDIA Nemotron for advisory consistency review. AI findings do not verify identity or determine hiring outcomes; a human reviewer makes decisions. Do not include sensitive information in these fields. Request correction, deletion or human review at privacy@mnemoiq.ai and include your application reference. Verification codes expire after 20 minutes; application records and agreements remain in the recruitment system until removed under our retention policy.
1. Information We Collect
Account information: When you register, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.
Integration credentials: When you connect third-party tools, we store Personal Access Tokens (PATs) or API keys encrypted at rest. We use these solely to fetch read-only data on your behalf.
Usage data: We log API requests (endpoint, timestamp, IP address) for security monitoring and rate limiting. We do not log request body content except as needed to detect abuse.
Uploaded documents: Files you upload are processed to extract text for search and AI Q&A. We do not sell or share uploaded content with third parties for advertising.
Chat history: Your AI chat messages are stored to provide session continuity. You can delete your chat history at any time.
Cookies: We use HttpOnly session cookies to maintain your authenticated session. We do not use advertising cookies or third-party tracking cookies.
2. Chrome Extension
If you install the mnemoIQ Chrome extension, the following applies in addition to this policy:
- Tab context: When you open or use the side panel, we access the active browser tab's title and URL so chat answers can reference what you are viewing. We do not read or collect full page HTML through the extension unless you explicitly ask a question that requires page content through the mnemoIQ chat interface.
- Page shortcut: The extension injects a small "Ask mnemoIQ" button on web pages. This content script does not scrape page content, track browsing history, or modify page behavior. It only displays the shortcut and opens the side panel when you click it.
- Side panel: The chat UI loads from
https://mnemoiq.storeinside a sandboxed iframe. Authentication, chat processing, and enterprise integrations occur within the mnemoIQ web application under the same terms as our main Service. - Local storage: The extension may store optional UI preferences (such as shortcut placement) locally using
chrome.storage. This data stays on your device unless you sync Chrome settings across devices. - Permissions: We request
sidePanel,tabs,storage, and host access only to provide the features above. We do not sell browsing data.
3. How We Use Your Information
- To authenticate you and maintain your session securely.
- To fetch and aggregate data from your connected tools in read-only mode.
- To generate AI-powered search results, Q&A responses, and intelligence digests.
- To provide tab-aware assistance in the Chrome extension when you choose to use it.
- To detect and prevent fraud, abuse, bot attacks, and security threats.
- To improve the Service through anonymised usage analytics.
- To send transactional emails (e.g. password reset, security alerts). We do not send marketing emails without your opt-in consent.
4. Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA) or United Kingdom, we process your data under these legal bases:
- Contract performance — processing necessary to provide the Service you requested.
- Legitimate interests — security monitoring, fraud prevention, and service improvement.
- Consent — for optional analytics or marketing communications, where we obtain your explicit consent.
- Legal obligation — where required by applicable law.
5. Data Sharing & Third Parties
We do not sell your personal data. We share data only in these limited circumstances:
- AI inference providers: Queries may be sent to third-party AI models (e.g. Ollama-hosted models, Anam.ai for voice features). Sensitive data is redacted before transmission.
- Infrastructure providers: We use Vercel (hosting) and MongoDB-compatible storage under their data processing agreements.
- Legal requirements: We may disclose information if required by law, regulation, court order, or to protect rights, property, or safety.
6. PII Redaction Before AI Processing
Before user content is sent to AI models, we automatically redact API keys, tokens, passwords, email addresses, SSNs, phone numbers, credit card numbers, and known secret formats. Redacted values are replaced with placeholders and are not transmitted to external AI services.
7. Data Retention
- Sessions: Expire after 7 days of inactivity and are deleted.
- Chat history: Retained for 90 days unless you delete it earlier.
- Integration credentials: Retained until you disconnect the integration or delete your account.
- Security logs: Retained for 30 days.
- Account data: Retained until you request deletion.
8. Your Rights
Depending on your location, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent where processing is consent-based.
To exercise these rights, email privacy@mnemoiq.ai. We will respond within 30 days. EEA/UK residents may also lodge a complaint with their local supervisory authority.
9. CCPA (California Residents)
California residents may request disclosure or deletion of personal information. We do not sell personal information. Contact privacy@mnemoiq.ai.
10. Security
We use HTTPS/TLS, HttpOnly session cookies, PBKDF2-SHA256 password hashing, rate limiting, CSP headers, input validation, and PII redaction before AI processing. Report vulnerabilities to security@mnemoiq.ai.
11. Children's Privacy
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children.
12. International Data Transfers
Your data may be processed in the United States or other countries. For EEA/UK transfers we rely on Standard Contractual Clauses or equivalent safeguards.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent notice in the Service. Continued use after changes constitutes acceptance.
14. Contact Us
For privacy questions or data requests, contact privacy@mnemoiq.ai.