Privacy Policy

1. Who we are

DocuMemory (the “Service”) is operated by Black Light Logic LLC (“Company”, “we”, “us”, or “our”). This Privacy Policy explains what information we collect when you use the DocuMemory website, dashboard, API, and Model Context Protocol (MCP) endpoint, how we use and share it, and the choices you have. Capitalized terms not defined here, such as “User Data”, have the meaning given in our Terms of Service.

2. Information we collect

• Account information: your email address, an optional display name, and your password. We store passwords only as a one-way bcrypt hash, never in readable form. If you belong to an organization, we also store your membership and role, and the email addresses of people invited to it.
• User Data: the content you submit or connect, such as chat transcripts, prompts, documents, memories, projects, tags, and uploaded files.
• Integration credentials: the access tokens you create and the apps you connect (for example Claude or ChatGPT). We store tokens only as one-way cryptographic hashes, together with which workspace each one acts in and when it was last used.
• Billing information: payments are handled by Stripe. We receive and store your Stripe customer and subscription identifiers, plan, subscription status, and the dates your access is paid through. We do not receive or store full card numbers.
• Usage and technical information: how many AI-assisted actions you have used, timestamps such as when a token was last used, and request counters used to prevent abuse (stored as keyed one-way hashes rather than your email address). Our hosting provider records standard request logs, such as IP address, browser user agent, page or endpoint requested, and time, for security and operations.
• Cookies and local storage: we use only cookies that are strictly necessary for the Service: one that keeps you signed in (for up to 30 days) and one that remembers which workspace you are using. Your light or dark theme preference is stored in your browser's local storage. We do not use advertising or third-party analytics cookies.

3. How we use information

• To provide the Service: storing, organizing, searching, summarizing, and synchronizing your User Data.
• To authenticate you, keep your account and workspaces secure, and enforce rate limits.
• To process payments and manage subscriptions.
• To send transactional email, such as password reset links.
• To respond to your requests, troubleshoot problems, and maintain and improve the Service.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, we do not use User Data for advertising, and we do not use User Data to train AI models.

4. AI processing

Some features send content to third-party AI providers for processing. When you capture a conversation, use “Enhance with AI”, or save a memory, the relevant text is sent to Anthropic (or to OpenAI, if the Service is configured to use it) to generate the structured document. To power semantic search, document text and your search queries are sent to OpenAI to create embeddings. These providers process the content through their business API services. Under their API terms, content sent this way is not used to train their models by default, and we have not opted in to any such use. They may retain it for a limited period for abuse and safety monitoring, as described in their own terms.

5. How we share information

• Service providers: we share information with providers that run the Service on our behalf, under contracts that limit their use of it: Vercel (hosting), Neon (database), Stripe (payments), Resend (email delivery), and Anthropic and OpenAI (AI processing, described above).
• Your organization: if you join an organization, content you create in its workspace is part of that organization's shared repository. Its owners and admins, and members with access to the relevant projects, can see that content, and owners and admins can see members' names, email addresses, and roles.
• Apps you connect: when you connect a tool such as Claude, ChatGPT, or Cursor with an access token or by approving it, that tool can read and write content in the workspace you choose. Its handling of that content is governed by its provider's own privacy policy. You can disconnect apps and revoke tokens at any time in Settings.
• Legal and safety: we may disclose information if required by law or legal process, or when reasonably necessary to protect the rights, property, or safety of our users, the public, or the Company.
• Business transfers: if the Company is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

6. Data retention

• We keep your account information and User Data for as long as your account is active.
• When you delete your account in Settings, it is disabled immediately and can be restored for 30 days. After that, your account, personal workspace, documents, files, and tokens are permanently deleted. Content you created in an organization's workspace stays with that organization, with your name removed from it.
• A deleted organization can be restored for 30 days, after which its content is permanently deleted.
• Short-lived records expire on their own: password reset links after one hour, app sign-in codes after five minutes, and abuse-prevention counters after their time window.
• Deleted data may remain in database backups until those backups expire under our provider's retention schedule. Stripe retains payment records as required by law.

7. Security

We protect information with encryption in transit (TLS), one-way hashing of passwords and access tokens, workspace and project access controls, and rate limiting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

8. Your rights and choices

• Access and export: you can view your User Data in the dashboard and retrieve it through the API at any time.
• Correction: you can edit your documents and account details, or ask us to correct information we hold about you.
• Deletion: you can delete documents and files, or your whole account, from the dashboard and Settings.
• Connected apps and subscriptions: you can revoke tokens, disconnect apps, and cancel your subscription renewal in Settings.

Depending on where you live, including the European Economic Area, the United Kingdom, and California, you may have additional rights to access, correct, delete, or receive a portable copy of your personal information, and to object to or restrict certain processing. To make a request, contact us at support@documemory.dev. We will respond within the time required by applicable law, and we will not discriminate against you for exercising these rights. If you are in the EEA or UK, you may also lodge a complaint with your local data protection authority.

Where the law requires a legal basis for processing, we rely on performing our contract with you (to provide the Service), our legitimate interests (such as keeping the Service secure and improving it), compliance with legal obligations, and your consent where we ask for it.

9. International transfers

The Service is hosted in the United States. If you use it from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above, and for material changes we will take reasonable steps to notify you, such as by email or a notice in the Service.

12. Contact us

For questions about this Privacy Policy or our handling of your information, contact Black Light Logic LLC at support@documemory.dev.