Privacy Policy

The data controller for the personal data processed through the memctl platform is:

We collect and process the following categories of personal data:

Account information. When you sign up via GitHub OAuth, we receive your GitHub username, display name, email address, and profile avatar URL.

User-generated content. Memories, project data, configurations, and other content you create or upload through the Service.

Billing information. If you subscribe to a paid plan, Stripe (our payment processor) collects and processes your payment details. We receive your subscription status, plan type, and billing history but do not store your full payment card details.

Usage data. We collect technical data necessary for operating the Service, including API request logs, feature usage metrics, error reports, and IP addresses.

Communications. If you contact us via email, we retain the content of those communications.

We process your personal data under the following lawful bases as defined by the UK General Data Protection Regulation (UK GDPR):

• Contract performance (Article 6(1)(b)). Processing necessary to provide you with the Service, manage your account, and fulfil our contractual obligations under the Terms of Service.
• Legitimate interests (Article 6(1)(f)). Processing necessary for our legitimate interests, including improving the Service, ensuring security, preventing fraud, and communicating service-related updates. We balance these interests against your rights and freedoms.
• Legal obligation (Article 6(1)(c)). Processing necessary to comply with legal obligations, such as tax and accounting requirements.

We use your personal data to:

• Provide, operate, and maintain the Service.
• Authenticate your identity and manage your account.
• Process payments and manage subscriptions.
• Send you service-related communications (e.g., account notifications, security alerts, billing updates).
• Monitor and improve the performance, security, and reliability of the Service.
• Investigate and prevent fraudulent or unauthorised activity.
• Comply with applicable legal obligations.

We do not sell your personal data. We do not use your data for automated decision-making or profiling that produces legal effects.

We share personal data with the following categories of third-party processors, each of which processes data on our behalf under appropriate data processing agreements:

We retain your personal data for as long as necessary to:

• Account data. Retained for the duration of your account. Deleted within 30 days of account closure.
• User-generated content. Retained for the duration of your account. Deleted within 30 days of account closure or upon your request.
• Billing records. Retained for 7 years after the end of the financial year in which the transaction occurred, as required by UK tax legislation.
• Usage logs. Retained for up to 90 days for operational and security purposes, then anonymised or deleted.
• Communications. Retained for up to 2 years, or longer where necessary for legal purposes.

Your data may be processed in countries outside the United Kingdom. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Transfers to countries that the UK Secretary of State has determined provide an adequate level of data protection.
• Standard contractual clauses approved by the UK Information Commissioner’s Office (ICO).
• Other lawful transfer mechanisms as permitted under UK GDPR.

Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:

• Right of access. Request a copy of the personal data we hold about you.
• Right to rectification. Request correction of inaccurate or incomplete personal data.
• Right to erasure. Request deletion of your personal data, subject to legal retention requirements.
• Right to restriction. Request that we restrict processing of your personal data in certain circumstances.
• Right to data portability. Receive your personal data in a structured, commonly used, machine-readable format.
• Right to object. Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent. Where processing is based on consent, withdraw that consent at any time (without affecting the lawfulness of processing before withdrawal).

To exercise any of your rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by up to two additional months, and we will inform you if this is necessary.

We may ask you to verify your identity before processing your request. There is no fee for exercising your rights, unless your request is manifestly unfounded or excessive.

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data promptly.

If you believe we have inadvertently collected data from a child under 16, please contact us at [email protected].

We use only essential cookies that are strictly necessary for the operation of the Service. Specifically, we use a single session cookie for authentication purposes. This cookie:

• Is required for the Service to function (maintains your logged-in session).
• Is classified as a “strictly necessary” cookie under the Privacy and Electronic Communications Regulations 2003 (PECR).
• Does not require consent under PECR.
• Is not used for tracking, analytics, or advertising.

We do not use any third-party tracking cookies, analytics cookies, or advertising cookies. No cookie consent banner is required because we only use strictly necessary cookies.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the “Last updated” date. For significant changes that affect how we process your personal data, we will provide additional notice (such as an email notification).

We encourage you to review this Privacy Policy periodically.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Right to complain. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):