Privacy
Controller
Srino Systems e.U., Severin Gal, Oberlaaer Straße 210/12, 1100 Wien, Austria, [email protected]
What we process
Your account (name, e-mail, login), your team, its members and invites, the memories, rules and spaces you or your tools create, your devices and their connections, your plan and payment status. Technical: IP address and browser data, kept briefly for operation and security.
Data from your tools
On every prompt and tool call, the hooks of Claude Code, Codex or Cursor send the text, commands, file paths, content of written files, for Claude Code also tool output, the folder and the git branch and remote to mastermem, so we can find matching memories and rules. We keep a selection of it encrypted for 7 days to dry run new rules, then delete it.
Why
To run mastermem (contract, Art. 6(1)(b) GDPR), for accounting and tax (legal duty, (c)) and to protect the service from abuse (legitimate interest, (f)).
Who else is involved
OVH SAS (France): our servers, all in the EU. Cloudflare, Inc. (USA): routes the website's traffic and blocks attacks, covered by the EU-US Data Privacy Framework. Brevo (Sendinblue SAS, France): sends our e-mails. Hetzner Online GmbH (Germany): stores our encrypted backups in the EU. Stripe and Link (Stripe Payments Europe, Ireland): sell the subscription as merchant of record and process payment, tax and invoices as their own controller (stripe.com/privacy). We run our login (Ory Kratos) ourselves. If you log in with Google or GitHub, we get your name and e-mail from them. Your content goes to no AI provider; what your tool does with it is governed by your contract with its provider.
How
Memory text and versions and data from your tools are stored encrypted, with a key per team. Titles, the search index, rules, names and attached files are not encrypted per team; details at mastermem.com/security. We never see card numbers. We do not sell data or use it for ads.
How long
As long as your account runs. After a cancellation you can read and export for 30 days, then we delete everything. Database dumps are deleted after 14 days, off site backups after 12 months at most. Invoices are kept for 7 years.
Cookies
Only cookies for the login, the language and the theme. No tracking.
Your rights
Access, correction, deletion, restriction, portability (export as zip) and objection. Write to [email protected]. You can complain to the Austrian data protection authority (dsb.gv.at).
Last updated
27 October 2026