Privacy Policy

1. Who we are and what this covers

Mnemo LLC ("Mnemo", "we") provides vector watermarking, provenance and verification services to businesses and developers through our website, API, SDK and agent protocol (the "Services"). This policy explains how we handle personal data. The Services are intended for business use and are not directed to children.

2. Two roles

• Customer Content: Mnemo as processor or service provider. When personal data is contained in content our customers or their systems submit (inputs, vectors, metadata, and the provenance and lineage records generated from them), we process it on the customer's behalf and on its documented instructions under our Terms of Service and Data Processing Addendum (https://www.trymnemo.com/dpa). The customer decides why that data is processed. If you are an individual whose personal data a customer submitted, please contact that customer. We will forward requests we receive to the customer where we can identify it.
• Operational Data: Mnemo as independent controller or business. For data we need to run our business (accounts and authentication, billing and payment records, records of acceptance of our Terms, fraud and abuse prevention, security, operational telemetry and reliability, support, and legal compliance), we decide the purposes and means and are responsible under this policy.

We do not act as a joint controller with our customers.

3. What we collect

4. Records of acceptance of our Terms

We keep a record that shows which version of our Terms of Service applied to an account or a payment:

• Accounts: the Terms version and the date and time of acceptance at account creation and at checkout.
• Accountless machine payments: the Terms version identified in the payment challenge, the date and time, the payment transaction identifier and the paying wallet address, which are already part of our payment records.

These records are kept with our payment and legal records, for as long as reasonably necessary to evidence the agreement, resolve disputes and meet legal obligations.

5. How we use it

To provide, operate and secure the Services; authenticate users; bill and record payments; keep evidence of the agreement; prevent fraud, abuse and sanctions violations; maintain reliability and fix problems; provide support; comply with law; measure and analyze use of our website and Services, including attribution, funnels and product performance; and improve the Services through limited operational use of aggregated or Operational Data that does not conflict with customer instructions.

6. What we do not do

• We do not sell Customer Content or personal data, and we do not share personal data for cross-context behavioral advertising.
• We do not use Customer Content for targeted advertising.
• We do not use Customer Content to train generalized AI or machine-learning models without the customer's explicit authorization.
• We do not send Customer Content to third parties other than the infrastructure providers listed below, which process it to host and run the Services.
• Our analytics implementation is designed not to send passwords, API keys, authorization credentials, request or response bodies, payment credentials, wallet secrets or Customer Content to analytics providers.
• Customer Content is logically separated by tenant and is returned only to the tenant that submitted it.

7. Who we share it with (subprocessors)

Infrastructure and payment providers that process data for us (current list and changes: https://www.trymnemo.com/subprocessors):

• Railway: hosting, database and cache;
• Supabase: authentication;
• Stripe: subscription billing, and recording of x402 payments;
• Coinbase (CDP x402 facilitator): verifies and settles x402 payment authorizations;
• Base network RPC provider and the Base blockchain: public payment settlement;
• Vercel: website hosting and website analytics;
• PostHog: website and product analytics, attribution and usage measurement (PostHog US Cloud); receives pseudonymous user and account identifiers and analytics metadata, not Customer Content. Session replay is not enabled;
• HubSpot: customer relationship management (email, account identifier, plan and signup time; no Customer Content).

We may also disclose data to comply with law, to protect rights and security, or in a business transfer.

8. Retention and deletion

We retain Customer Content only for as long as reasonably necessary to provide the Services, according to the lifecycle that applies to the account or namespace:

• Accountless namespaces last 24 hours by default (at most 72 hours) and are then purged automatically, deleting their Customer Content, unless promoted to an account.
• Free trials last at most 30 days and end earlier if the trial allowance is used up. If the account does not move to a paid plan, its Customer Content is deleted after the trial ends, following a 7-day grace period.
• Paid accounts: Customer Content is kept while the paid relationship is active and needed to provide the Services.
• Terminated or expired paid accounts: Customer Content is deleted after a 30-day grace period.
• Account deletion or a valid deletion request: Customer Content is deleted from active systems.
• Records kept separately: billing, payment and settlement records (including, for accountless machine payments settled on a blockchain, the paying wallet address, transaction hash and amount), Terms acceptance records, and security and fraud records. They are kept as long as reasonably necessary for accounting, tax, payment evidence, security, disputes, enforcement and legal obligations. They do not include the underlying Customer Content. Blockchain transactions are public and cannot be erased by Mnemo.
• Logs. Short-lived operational and website logs are retained according to the retention periods configured with our hosting providers, for security, troubleshooting and operation of the Services. Logs are separate from Customer Content and its retention lifecycle above.
• Usage telemetry. Per-account usage counters (monthly request counts and volumes) are kept for up to 13 months for billing and usage reporting. Usage events recorded in Mnemo's internal telemetry store are deleted after 90 days.
• Analytics. Mnemo uses analytics and infrastructure providers, including PostHog and Vercel, to understand use of our website and Services, measure product performance, diagnose issues and improve Mnemo. Depending on the provider and data type, retention periods vary. PostHog currently retains product analytics events and associated metadata for up to one year on its free plan and up to seven years on its paid plans; session replay recordings, which Mnemo does not currently enable, for up to 30 days on its free plan and up to 90 days on its pay-as-you-go plan (longer on some higher plans); and logs for 14 days by default. Data past the applicable period may be permanently deleted by PostHog. These are the provider's retention periods, not a commitment that Mnemo keeps the data for that long: Mnemo may configure, delete or otherwise manage this data earlier using the provider's capabilities, subject to applicable legal requirements. PostHog uses the IP address to derive approximate location, and Mnemo configures PostHog not to store the IP address with analytics events. Where other logs or telemetry are collected, retention may differ by service and configuration.
• Backups. Deleted data may remain in backups until those backups expire. Operator-created backups containing Customer Content are kept for no more than 30 days, unless a specific legal, security or incident-preservation need requires otherwise. Scheduled provider backups follow the provider's rotation (daily backups up to 6 days, weekly backups up to 27 days).

When data is no longer needed, we delete or anonymize it where reasonably practicable.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete or port your personal data, or to object to or restrict processing. Contact privacy@trymnemo.com. We will respond as required by applicable law. For Customer Content, we will assist the relevant customer. Blockchain payment records cannot be erased from the public chain.

10. Security

We maintain administrative, technical and organizational safeguards designed to protect personal data, including encryption in transit (TLS), hashed API credentials and logical tenant separation. No method of transmission or storage is completely secure. Report security issues to security@trymnemo.com.

11. International transfers

We process data in the United States. Mnemo is not certified under the EU-U.S. Data Privacy Framework. For Customer Content that is personal data subject to EEA, UK or Swiss data protection law and requires a restricted-transfer mechanism, the applicable mechanism (EU Standard Contractual Clauses Module Two or Three, or the UK International Data Transfer Addendum, as applicable) must be completed before the customer uses the Services for that transfer; customers contact legal@trymnemo.com and Mnemo collects the required legal-entity details and completes it (https://www.trymnemo.com/dpa). Accountless access (accountless machine payments) must not be used to submit personal data subject to EEA, UK or Swiss data protection law.

12. Children

The Services are for businesses and are not directed to children under 16. We do not knowingly collect their personal data.

13. Changes and contact

We will post changes here with a new version and effective date, and give notice of material changes. Privacy: privacy@trymnemo.com. Security: security@trymnemo.com. Legal: legal@trymnemo.com. Mnemo LLC.