Privacy Policy

Introduction

Memoket Inc. ("Memoket", "we", "us", or "our") develops and sells the Memoket Gem, a wearable AI recording device, and provides a companion application (iOS, Android, macOS, Windows, and web) together with related integrations. This Privacy Policy applies to those products, to the related services, and to this website, through which the Memoket Gem is sold (collectively, the "Services").

The Services are designed to capture and process conversations. We recognize that the resulting audio recordings, transcripts, and summaries may contain personal, confidential, and at times sensitive information, and that entrusting such information to a provider requires a high degree of confidence in how that provider will handle it. Memoket regards the protection of this information as a fundamental obligation rather than a compliance formality, and has designed the Services around the principles of data minimization, purpose limitation, and user control.

This Privacy Policy sets out, in respect of the Services: the categories of information we collect; the purposes for which we use it; the circumstances in which it is disclosed and the parties to whom it is disclosed; the technical and organizational measures we apply to protect it; the periods for which it is retained; and the rights and choices available to you, together with the procedure for exercising them. We encourage you to read this Policy in full. Should any provision require clarification, our contact details are set out in Section 18.

1. Scope of this Policy

This Policy applies to the Services identified above. It does not apply to third-party websites, applications, or services accessed through Memoket — for example, a Slack workspace or a Notion account that you elect to connect. Where content is delivered to a destination at your direction, that destination's own privacy policy governs its subsequent handling of that content.

If you use Memoket through your employer or another organization's account, that organization may be the party responsible for certain data. See Section 18.

2. Our privacy commitments

The commitments set out below govern the remainder of this Policy. Where a commitment is subject to a limitation, that limitation is stated alongside it rather than left to be discovered elsewhere in the document.

No sale of personal information. We do not sell your personal information or your conversation content for monetary consideration. Certain laws — California's, for example — treat some cookie-based advertising practices as "sharing" even where no monetary consideration is involved; Section 10 describes the cookies concerned and the controls available to you.

No use of your content for AI training without consent. We will not use your recordings, transcripts, or summaries to train, optimize, or develop our own or any third party's AI models unless we have obtained your explicit, informed consent in advance. As of the date of this Policy, no such feature has been launched. Should we introduce one, this Policy will be updated to describe it before it becomes available to you.

Collection limited to identified purposes. Each category of information described in Section 3 is collected for an identified operational purpose. We do not collect or use mobile advertising identifiers, such as Apple's IDFA or Google's GAID.

Transparency as to service providers. Transcription and summarization require the involvement of specialist providers. The categories of provider, the purpose of each, and the contractual restrictions imposed on them are set out in Section 8.

User control. You may delete a recording, delete your account, withdraw a consent previously given, obtain a copy of your personal information, or request details of the information we hold. The applicable procedures are set out in Section 12.

3. What information we collect

We collect information in three ways: directly from you (when you create an account or make a recording), automatically as you use the Services and the Gem, and from third parties (for example Shopify, or Apple and Google if you choose to sign in with them).

Account information. Your name, email address, password (stored hashed), and account settings. This is required to create an account — without it we cannot provide the Services to you.

Order and payment information. If you buy a Memoket Gem through this website, our e-commerce platform (Shopify) collects your shipping address, billing address, and payment details to process the order. Memoket does not store your full payment card number — Shopify and our payment processor handle that as independent processors.

Conversation content you create. Audio you record or upload through the Memoket app or the Gem, the transcripts generated from that audio, and the AI-generated summaries, insights, and action items derived from it. This category of information is the principal subject of this Policy.

Memoket Gem device information. The Gem's serial number, model, firmware version, and connection logs. On Android, the operating system requires location permission in order to perform the Bluetooth scan that connects to your Gem. We do not use this permission for location tracking or advertising, and your location is not transmitted to our servers.

App and usage information. Your phone or computer's device type, OS version, app version, IP address, and information about how you interact with the Services — used to operate, secure, and improve the product. We do not collect or use mobile advertising identifiers (such as Apple's IDFA or Google's GAID).

Optional third-party integrations. If you connect Slack, Notion, Google Calendar, or a similar service, we access only the scopes you explicitly authorize.

4. How we use your information

We use your information to:

• Transcribe your recordings and generate AI summaries, insights, and action items;
• Operate Gem device pairing, firmware updates, and file transfer;
• Deliver content you choose to send to a connected integration (for example, a Slack channel);
• Create and manage your account, authenticate you, process orders, and provide customer support;
• Maintain, secure, and improve the Services;
• Comply with legal obligations and enforce our terms.

The purposes listed above are exhaustive as of the date of this Policy. Should we adopt a materially different purpose, this Policy will be updated accordingly; see Section 17.

If you are in the EEA, the UK, or Switzerland, the legal bases we rely on for this processing are set out in Section 14.

5. AI processing

Memoket uses AI to transcribe your recordings and to generate summaries, insights, and action items. The nature and location of that processing are described below.

Speech-to-text and summarization. We share your recordings and transcripts with third-party speech-to-text and AI/LLM providers solely to perform the transcription or summarization you asked for. The categories of providers are listed in Section 8, and each is bound by a data processing agreement limiting their use of your data to providing that service to us.

On-device noise reduction. Some audio is processed by a noise-reduction model that runs entirely on your own device — for this step, no audio is sent to our servers or to any third party.

No training on your content without your consent. We will never use your recordings, transcripts, or summaries to train, optimize, or develop our own or any third party's AI models unless we have obtained your explicit, informed consent in advance. As of the date of this Policy, we have not launched any such feature; if we do, this Policy will be updated to describe it before it is available to you.

Where processing happens. AI processing occurs primarily in the United States.

Accuracy. AI-generated transcripts and summaries can occasionally be inaccurate or incomplete. Please review anything important before relying on it.

No automated decisions about you. Our AI features are assistive — they summarize and organize content you create. We do not use AI to make automated decisions about you that produce legal or similarly significant effects without human involvement.

6. Recording other people

The Gem and the application permit the recording of in-person conversations and meetings, and may therefore capture the voices of individuals who are not Memoket users.

While a recording is in progress, the Gem displays a visible red LED, so that persons nearby are able to observe that recording is taking place. This is a deliberate element of the product's design.

A status indicator is not, however, a substitute for consent. You are responsible for complying with the laws of your jurisdiction before recording other people, including obtaining any consent those laws require. A status LED may not, by itself, satisfy affirmative-consent requirements in certain jurisdictions — for example, two-party-consent states in the United States.

Independently of any legal requirement, we recommend that you inform participants when a recording is taking place.

7. How we store and protect your information

Storage. Audio recordings, transcripts, summaries, and account data are stored on Amazon Web Services (AWS) infrastructure in the United States.

Encryption in transit. TLS 1.2+ for all connections between the app and our servers.

Encryption at rest. AES-256 encryption for stored recordings and database content.

On-device storage. Session credentials and cached data are stored locally on your device — on iOS and Android in your device's Keychain or Keystore, and on macOS and Windows in the app's local storage. This data stays on your device and is never transmitted to us except as part of an authenticated request you initiate.

Organizational and technical measures. We maintain appropriate technical and organizational measures designed to protect your information against unauthorized access, use, alteration, or disclosure. These measures are reviewed and updated periodically.

No method of transmission or storage is entirely secure. We apply industry-standard safeguards, but we do not represent that security can be absolute. If you hold a password, you are responsible for maintaining its confidentiality and for restricting access to your devices and account; it should not be shared with any other person.

Further information regarding our security practices is available at our Trust Center: https://trust.memoket.ai.

8. Service providers

Certain specialist providers process data on our behalf in order to deliver the Services. We share data with them only to the extent necessary for that purpose, and only for the purpose listed:

We have signed data processing agreements with each of these providers, limiting their use of your data to providing services to us. They are not permitted to use your conversation content for their own purposes.

9. How we disclose information

Beyond the service providers above, we may disclose your information:

• When you ask us to. For example, posting a summary to a Slack channel you connected.
• Within our corporate group, to operate the Services.
• In a business transaction, such as a merger or acquisition.
• To comply with the law — applicable law, legal process, or to protect our rights and the rights of others.

The circumstances listed above are exhaustive. We do not disclose your conversation content for advertising purposes, and we do not sell it.

10. Cookies and similar technologies

On our website. Our website, including checkout (powered by Shopify), uses cookies and similar technologies for essential functionality — keeping items in your cart, remembering your login — and may use analytics or marketing cookies to understand how visitors use the site. Where required by law, a consent banner lets you accept or reject non-essential cookies before they are set. You can also manage cookies through your browser settings.

We honor the Global Privacy Control (GPC) signal, where your browser sends one, as a valid opt-out request under applicable law. As is the case with most companies, we do not currently respond to browser "Do Not Track" signals, as no common industry standard for their interpretation has been adopted.

In the apps. The Memoket mobile and desktop apps do not use browser cookies, but do use comparable technologies — SDKs for crash reporting, product analytics, and push notifications, described in Section 8 — along with the device-local storage described in Section 7. You can control push notifications and OS-level permissions (such as Bluetooth and microphone) in your device settings; revoking a permission may limit functionality.

11. Data retention and deletion

We retain your data for as long as needed to provide the Services, maintain your account, comply with legal obligations, resolve disputes, and enforce our agreements.

Controls available to you within the application:

• Deletion of an individual recording, at any time.
• Deletion of your account, at any time — within the application, or by contacting us at hello@memoket.ai.

Effect of deletion. Deletion extends to the material derived from a recording, and not only to the recording itself. We remove the associated personal information — the audio, its transcript, and the summaries, insights, and action items generated from it, together with the contribution that content has made to your cross-conversation memory — from our production systems within 30 days. Deleted content ceases to inform the results the Services generate for you.

Two exceptions apply: where we are legally required to retain certain information for a longer period, and where deletion from encrypted backup copies is not immediately practicable. Backup copies are purged on a routine schedule and are not used for any purpose other than disaster recovery.

Limitation regarding connected integrations. Where you have previously transmitted a summary or other content to a connected integration — for example, by posting to a Slack channel — deletion from Memoket does not delete the copy already delivered to that destination. Such copies are subject to the retention and deletion policies of the platform concerned.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing; and, where processing is based on consent, to withdraw that consent at any time. Withdrawal of consent does not affect processing already carried out while that consent was in place.

Marketing communications. If you receive marketing emails from us, you may unsubscribe using the link contained in any such email, or by contacting us. We will continue to send non-promotional messages, such as security alerts, receipts, and service updates.

Submitting a request. Requests may be submitted to hello@memoket.ai. We may be required to verify your identity, or your authorized agent's authority to act on your behalf, before responding. We aim to respond within 30 days.

Grounds for refusal or limitation. We may decline or limit a request where we are unable to verify it; where fulfilling it would infringe the rights of another person (for example, another individual's voice in a shared recording); where a legal exception applies; or where the request is excessive or manifestly unfounded, in which case a reasonable fee may be charged where permitted by law. Where a request is declined, we will explain the basis for that decision unless prohibited from doing so.

13. Additional disclosures — United States residents

If you are a California resident, you also have the right to:

• opt out of the sale or sharing of your personal information;
• limit the use of sensitive personal information;
• designate an authorized agent to submit a request on your behalf.

To exercise these rights, contact us at hello@memoket.ai, or — for cookie-based sharing specifically — use the cookie controls described in Section 10. We honor the Global Privacy Control signal as a valid opt-out.

We will not discriminate against you for exercising any of these rights.

Residents of other US states with comprehensive privacy laws have comparable rights; the same contact address and process applies.

14. Additional disclosures — EEA, UK, and Switzerland

Legal bases. Where GDPR-family law applies, we rely on:

• Performance of a contract — providing the Services you signed up for;
• Our legitimate interests — securing and improving the Services and preventing fraud, balanced against your rights and never overriding them;
• Legal obligation — responding to lawful requests;
• Your consent — for non-essential cookies (see Section 10) and for any future AI-training use of your content (see Section 5).

You can withdraw consent at any time — see Section 12.

Complaints. You have the right to lodge a complaint with your local data protection supervisory authority. We would welcome the opportunity to address your concern directly in the first instance, although you are under no obligation to contact us before exercising this right.

15. International transfers

We may transfer, store, and process your information in the United States and other countries. Where required, we rely on recognized transfer mechanisms — such as the European Commission's Standard Contractual Clauses — for transfers from the EEA or the UK.

16. Children

The Services are not intended for children under the age of majority in your jurisdiction, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us at hello@memoket.ai and we will delete it.

17. Changes to this Policy

We may update this Privacy Policy from time to time. Where we do so, we will post the revised policy and update the "Last updated" date set out at the top of this document. As noted in Section 5, should we introduce a feature that would use your content to train AI models, it will be described in this Policy before it becomes available to you, and will require your explicit consent.

18. How to contact us

For the purposes of applicable data protection laws, Memoket Inc. is the data controller of your personal information.

If you use Memoket through your employer or another organization's account, that organization may instead be the controller of certain data — for example, recordings made using their subscription. See our Data Processing Addendum, or contact your organization directly, with questions about how they handle that data.

We have not been required to appoint a Data Protection Officer. Any privacy-related question or request may be directed to the email address above.