Privacy Policy

Information we process

We process:

• account information from Google sign-in, including your Google account identifier, email address, display name, and profile-picture URL;
• memories, notes, tags, files, feedback, and other content you submit;
• data created to provide the service, such as extracted text, file segments, embeddings, search indexes, and knowledge-graph entities and relationships;
• team, invitation, sharing, and permission information;
• MCP connection details, OAuth grants, usage records, and limited technical logs;
• subscription, billing, and transaction metadata from Stripe, but not full payment-card numbers; and
• technical information needed for security and operation, such as authentication events, IP/device information processed by our infrastructure, error diagnostics, aggregate service analytics, and essential browser storage.

How we use information

We use this information to provide, secure, support, and improve MemoryTree; authenticate users; process and retrieve content; operate sharing, teams, and integrations; manage subscriptions; communicate with you; prevent misuse; and comply with law.

Under the GDPR, we generally rely on performance of our contract with you, legitimate interests in operating and securing the service, legal obligations, and consent where we specifically request it.

AI processing

MemoryTree uses automated processing to convert and search content and to create embeddings and knowledge-graph information. Some processing happens within our hosted environment. Relevant memory text, search text, extracted content, or raw PDFs, images, scans, and audio may also be sent through OpenRouter to selected AI model providers, currently including Google Gemini.

We request provider controls intended to prevent training and unnecessary retention, including zero-data-retention routing where configured. MemoryTree does not use private customer content to train its own general-purpose models, but we do not promise universal zero retention by every external provider. Limited authorship information, such as a display name, may accompany content where needed to provide graph features.

Sharing and service providers

We disclose data only as needed:

• to people, teams, and third-party MCP or AI clients you authorise;
• to service providers such as Lovable Cloud and its infrastructure providers, OpenRouter and selected model providers, Google, Stripe, and transactional-email providers;
• where required by law or reasonably necessary to protect rights and security; or
• as part of a business transaction, subject to appropriate protections.

We do not sell personal data or use it for cross-context behavioural advertising.

When you share information or connect an external client, that recipient’s own terms and privacy practices apply. Revoking access stops new retrieval through MemoryTree but cannot recall copies already received or exported.

International transfers

Providers may process data outside Sweden or the European Economic Area. Where required, we use an appropriate legal transfer mechanism, such as an adequacy decision, the EU-U.S. Data Privacy Framework, or the European Commission’s Standard Contractual Clauses.

Retention and deletion

We retain account information and active content while needed to provide the service. Deleted items may first be removed from active use through soft deletion while related indexes and derived records are updated. Limited copies may remain temporarily in backups, security records, or legally required accounting records.

To request account deletion or exercise a privacy right, email esam@etls.studio. We will verify and handle the request without undue delay and within applicable legal deadlines. Cancelling a subscription does not automatically delete the account.

Security

We use reasonable safeguards including private file storage, short-lived authorised file links, server-side access checks, row-level database security, OAuth protections, and restricted privileged credentials. No online service is completely secure, so you should protect your Google account, devices, sessions, and MCP credentials.

Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, object to processing of, or receive a portable copy of your personal data, and to withdraw consent. You may also complain to a data-protection authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY), imy.se.

MemoryTree is not intended for people under 18. We may update this policy and will change the effective date and provide additional notice where required.

Contact

ETLS NORDIC STUDIO AB
Organisation number: 559589-6258
Kristinedalsvägen 53 B, 131 46 Nacka, Sweden
esam@etls.studio