Privacy Policy

1. Who We Are

Memnar is a product of Mission Relearn, a Dutch sole proprietorship of Annet Kloprogge (KvK 99384949), Jaarbeursplein 6, 3521 AL Utrecht, the Netherlands. Mission Relearn is the data controller for the personal data described in this policy. Memnar B.V., a company being set up by the same owner, will take over as data controller once it is registered; we will email you before that happens and update this page. For any privacy question, or to exercise your rights, email annet@memnar.ai.

2. What We Collect

• Account data: your email address and display name, when you sign up.
• What you upload: the documents (PDF, DOCX, TXT, MD) and voice recordings you provide so Memnar can build your AI-self.
• Your generated AI-self: the set of markdown files Memnar writes from your uploads. These can include passages quoted word for word from your own material.
• Work patterns (only if you connect a tool): if you connect Memnar to an AI coding tool, we distil patterns from those sessions into your files. We store the distilled patterns, not the raw session transcripts.
• Billing data: if you subscribe, a payment identifier and billing details, processed by Stripe. Free accounts have no billing data.
• Connection data: if you connect Memnar to another tool, a connection record with your account ID and an access token, stored encrypted and expiring after 90 days.

3. How We Use Your Data, and Our Legal Basis

• To build your AI-self from what you upload: on the basis of your consent, which we ask for explicitly before your first upload.
• To provide and run the service (your account, storage, export and deletion): on the basis of our contract with you.
• To send transactional email (sign-in links, account notices): on the basis of our contract with you.
• To send product emails (what is new, tips for getting started): on the basis of our legitimate interest in telling you about the service you use. Every product email has an unsubscribe link.
• To run the connector for AI tools you connect: on the basis of our contract with you.
• To write personalised lesson notes in the Memnar Academy, only if you switch this on: on the basis of our contract with you. You can switch it off in Settings.
• To analyse how the product is used: on the basis of our legitimate interest in improving the service; see section 9, including how to object.
• To keep the product secure and working: on the basis of our legitimate interest in a reliable, safe service.

For business contacts and prospecting, see section 11.

Your uploads may contain special-category personal data (for example health information in a document you wrote). We process this only with your explicit consent. Please do not upload other people’s confidential or special-category data without their permission.

4. How Your Documents and Voice Are Processed

Your uploaded documents are read once to build your AI-self, then deleted from our servers. We do not keep copies of your uploads. Voice recordings are sent to Mistral for transcription and Memnar does not store them afterwards. Mistral keeps the data it receives through its API, including recordings and uploaded text, for up to 30 days for abuse monitoring, then deletes it. Your generated AI-self stays in your account until you delete it. Every quote in your files is checked against your own uploads before it is written.

5. Sub-processors

We use a small set of processors. Each processes your data under a data-processing agreement, except where it acts as an independent controller: Stripe for fraud prevention and its own legal duties as a payment provider. Since our 2 July 2026 move, your documents and your AI-self are processed in EU or EEA regions: Mistral AI reads your text and transcribes your voice recordings, and Supabase stores your data in Ireland. Some things can involve the United States: billing through Stripe, the logs of the emails we send through Resend, PostHog’s automatic analysis of usage data, Cloudflare when it runs the connector for an AI tool you connect, and Anthropic for the AI assistance in our business-contact system (section 11). Several processors also have a US parent company. Section 6 explains all of this.

Our AI processors do not use your content to train their models: training is switched off for our Mistral account, PostHog contractually forbids its AI providers from training on our data, and Anthropic’s terms forbid it from training on the business-contact data we send it. An AI tool you connect yourself, such as ChatGPT or Claude, follows its own policy. We do not sell your data, and we do not share your personal data with third parties for marketing.

Our newsletter runs on Substack. If you subscribe on memnar.substack.com, Substack (United States) collects your email address directly, as an independent controller under its own privacy policy. If you type your email address into a newsletter or waitlist form on this site, we open Substack’s signup page with that address filled in, and you confirm the subscription there. Memnar does not pass your account details to Substack.

6. International Transfers

We keep your documents, your voice recordings, your AI-self and your account in EU or EEA regions: Supabase in Ireland, Mistral AI in France. We removed the previous US AI processors for your documents and your AI-self at the 2 July 2026 cutover. Some data does reach the United States: your email address and name in the logs of our email provider, your Memnar content in transit when you use the connector, and the other cases below.

US companies. Supabase, Resend and Cloudflare are US companies, and Stripe and PostHog have US parent companies. Running in an EU region does not take them outside US law, which can in exceptional cases require a US company to hand over data it holds, wherever it stores it (for example under the US CLOUD Act). Mistral AI is a French company. It runs on cloud infrastructure in Europe, partly from US cloud companies, so the same point about US law applies there. We use its European endpoint.

Transfers to the United States, and the safeguard for each: Billing: if you subscribe, Stripe processes your payment details, which can involve US processing under standard contractual clauses. Email: Resend sends our emails from Ireland but keeps its logs (your email address, your name and the emails we send you) in the United States, under the EU-US Data Privacy Framework and standard contractual clauses. Connector: when a connected AI tool calls Memnar, Cloudflare runs the connector in the data centre nearest to that tool’s servers, which can be in the United States. Your Memnar content passes through without being stored; the connection record sits in Cloudflare’s storage network, which is not limited to the EU. Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply on top of that. If you connect an AI tool such as ChatGPT, its provider receives your Memnar content as an independent controller under its own privacy policy, not as our processor.

Business contacts: for the AI assistance in our business-contact system (section 11), data is processed in the United States. Our contract is with Anthropic Ireland Limited; the transfer is covered by the European Commission standard contractual clauses in Anthropic’s Data Processing Addendum. This applies only to business contacts, never to your uploads or your AI-self.

Analysis of usage data: PostHog stores usage data in Germany, and since 4 September 2026 it also analyses that data automatically to suggest product improvements. That analysis runs on AI providers in the United States: OpenAI, Google, Anthropic and Microsoft (Microsoft also processes in Germany). PostHog participates in the EU-US Data Privacy Framework, and standard contractual clauses apply on top of that. PostHog contractually forbids these providers from using our data to train or fine-tune their models. Nothing you upload and nothing from your AI-self is in that material: see section 9 for exactly what it contains.

Our agreements with Supabase, Resend and Cloudflare include the EU standard contractual clauses for any access to your data from outside the EU. For a copy of the safeguards for any transfer, email annet@memnar.ai.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Export your data in a portable format
• Object to processing
• Restrict processing while a question about your data is being resolved
• Withdraw consent at any time

You can export or delete everything yourself, anytime, in Settings. To exercise any other right, email annet@memnar.ai. We respond within one month.

8. Data Retention

• Uploaded documents: deleted by Memnar after your AI-self is generated; text sent to Mistral is kept there for up to 30 days, then deleted.
• Voice recordings: not stored by Memnar after transcription; Mistral keeps them for up to 30 days for abuse monitoring, then deletes them.
• AI-self and work patterns: kept until you delete them or close your account.
• Account data: kept while your account is active.
• Connection records: the access token expires after 90 days at the latest. Disconnecting a tool marks its record as revoked.
• Payment records: if you subscribe, retained for 7 years as required by Dutch tax law.
• Backups: held on our providers’ normal cycle (roughly 7 to 30 days). Deleted accounts are not restored from backup.

9. Cookies

On this site we use functional cookies only, for sign-in and session management. We do not use tracking or advertising cookies. Our analytics (PostHog, hosted in the EU) runs cookieless here: nothing is stored on your device, and we never send it your email address or any content you upload.

Inside the app (app.memnar.ai) PostHog also records masked session replays and error reports, so we can see where the product breaks or confuses people. Masked means every piece of text and every input field is hidden in your browser before the recording is sent, and we never record the contents of network requests. A replay shows the shape of the page and where you clicked; it does not show what you wrote, uploaded, or what your AI-self says. The screens that show your AI-self, your patterns and your uploaded file names are left out of recordings entirely. PostHog analyses this material automatically to propose product fixes. That analysis is about the product, not about you: it makes no decisions about any individual person.

In the app this runs on our legitimate interest in improving a service you rely on, which means you can object at any time and we stop. Switch Usage analytics off in your app Settings and nothing is recorded at all, or email us and we do it for you. You never have to give a reason. Replays and error reports are kept 30 days, then deleted.

10. Automated Decision-Making

Memnar does not make automated decisions that produce legal or similarly significant effects about you. Building your AI-self is a tool you direct, not a profiling decision made about you. In our business-contact system, AI summarises notes, sorts contacts and drafts emails. A person decides and sends (section 11).

11. Business Contacts and Prospecting

This section is about people we know, or would like to know, professionally: contacts at organisations, people we met at events, and people at companies we may approach about Memnar. It is not about users of the app; sections 2 to 10 cover them. Mission Relearn (section 1) is the controller.

What we keep. Your name, job title, the organisation you work for, your business email address, public profile links such as LinkedIn, and our own notes, tasks and follow-up status. When we email each other, we store the sender, the recipients, the date and the first 120 characters of the subject line. We do not store the content of those emails in our contact system. Before a first message to a company we have not been in touch with, we also keep a link to the public page where we found the address, and a screenshot of that page, as proof of the source.

Where it comes from.

• From you: you emailed us, gave us your details, booked a call or became a customer.
• From events where we met, such as Web Summit.
• From your LinkedIn connection with Annet Kloprogge, as listed in her own LinkedIn data export.
• From public sources: the website of your organisation, your public LinkedIn profile, or a business register.
• From Explee, a prospecting service we used in October 2026. We no longer send email through it; replies to those emails still reach us through it.

Why, and on what basis. We use these details to keep track of business relationships, to follow up on conversations, and to tell organisations about Memnar when we think it can help them. Our legal basis is our legitimate interest in running and growing our business (Article 6(1)(f) GDPR). We weighed that interest against yours and wrote the assessment down; you can ask us for it. In short: we keep work details only, we do not look for private information, and you can stop us at any moment.

How we email.

• Annet writes and sends every email herself, one at a time, from annet@memnar.ai. There are no automated sequences and no shared or rotating mailboxes.
• A first email to someone we have not been in touch with goes only to companies with legal personality (in the Netherlands a BV or NV), and only to an address the company itself published for such messages. We do not guess email addresses.
• Every email says who we are. A first email also says where we found your address.
• Every email contains a link that takes you off our list with one click.

AI assistance. To save time, we use Claude, an AI model made by Anthropic, inside our contact system. It summarises our notes about a contact, sorts contacts by sector and role, and writes a first draft of an email. Claude receives your name, job title, organisation, our notes and the subject lines of our emails. We remove email addresses and phone numbers before anything goes to Claude. Annet reads and edits every draft before she sends it, and AI makes no decision about you on its own (see section 10). Anthropic’s terms forbid it from using this data to train its models, and it deletes the data within 30 days, unless its safety systems flag it or the law requires it to keep it longer. If you prefer that we do not use AI on your details, tell us: we mark your record and it is no longer sent to Claude.

Who processes it for us.

• Supabase: our database, EU region (Ireland).
• Cloudflare: runs our contact system; data passes through its global network.
• Anthropic: the AI assistance described above, on servers in the United States.
• Proton: our mailbox, in Switzerland.
• Resend: sends Annet a daily reminder of her own follow-up tasks, which can include your name.
• Explee: see above.

We do not sell your details and we do not share them with other companies for their own marketing. For the transfer to the United States, see section 6.

How long we keep it.

• No reply to a first email: we delete your details 6 months after our last message.
• We have been in touch: 2 years after our last contact.
• Customers: for the duration of the contract plus 2 years. Invoices stay for 7 years, because tax law requires it.
• Unsent email drafts: deleted after at most 30 days.
• If you opt out, we keep your email address and the date on a do-not-contact list for as long as we approach businesses. Without that list we cannot make sure we never email you again.

Your right to object. You can object to this use of your details at any time, without giving a reason, and we will stop. This includes the sorting of contacts by sector and role. Use the link in any of our emails, or write to annet@memnar.ai. Your other rights (access, correction, deletion) are in section 7. We respond within one month.

12. Supervisory Authority

If you believe we handle your data incorrectly, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.