Memo is an app that records and transcribes meetings and writes notes from them. This policy explains what we collect, who processes it, where it goes and what rights you have. We try to keep it plain.
1. Who is responsible
Oxyloop (“we”), an operator established in the European Union, is the controller of your personal data. Contact us at [email protected]. [Registered address and company number to be added before publishing.]
2. What we collect
- Account data: your email address and, if you use Sign in with Apple or Google, the identifier and name they share with us (Apple may give us a private relay address).
- Meeting content: the audio you record or import, the transcript with speaker labels, the summary, decisions and action items generated from it, the questions you ask Memo about your meetings and the answers, and any speaker names or titles you set.
- Usage and billing data: minutes recorded, subscription status and plan, and technical logs (IP address, device type, app version, error reports) needed to run and secure the service.
- Push token and settings: your notification token and preferences such as language.
Memo shows a recording indicator, but you are responsible for telling the people you record and for following the consent rules where you are. We do not use your meeting content for advertising.
3. Why we use it, and on what legal basis
- To provide the service you asked for: recording, transcription, notes, Ask, search, sharing and export (contract, Art. 6(1)(b) GDPR).
- To bill and manage subscriptions and enforce fair-use limits (contract and legitimate interests).
- To keep the service secure, prevent abuse and fix errors (legitimate interests, Art. 6(1)(f)).
- To comply with legal duties, such as tax records (legal obligation, Art. 6(1)(c)).
4. Who processes your data
We use the following processors, under written data-processing terms:
| Provider | What for | Data | Where |
|---|---|---|---|
| Cloudflare R2 | Storing audio files | Your audio | [Storage region to be confirmed before publishing] |
| AssemblyAI | Speech-to-text and speaker detection | Your audio | EU endpoint (European Union) |
| DeepSeek | Summaries, decisions, action items, Ask answers | Transcript text and your questions (no audio) | Servers in China |
| Apple, Google, RevenueCat | Purchases and subscription status | Purchase receipts, a Memo user ID. We never see your card details. | Provider-dependent |
| Resend | Sending sign-in codes and service emails | Your email address | Provider-dependent |
5. Transfer of transcript text to China
To write summaries, decisions, action items and answers, we send the text of your transcript and your questions to DeepSeek, an AI provider whose servers are located in the People’s Republic of China. China is not covered by an EU adequacy decision, and its legal system may give public authorities access to data in ways that differ from EU law.
We rely on your request for these features and on appropriate safeguards under Chapter V GDPR (such as standard contractual clauses and a transfer impact assessment) [to be confirmed before publishing]. We send only what is needed for the request, never your audio, and we ask the provider not to use it to train models [terms to be verified]. If you do not want your text processed in China, do not use the summary and Ask features; you can still record, transcribe and read the transcript, or delete your data at any time.
6. How long we keep it
We keep your account and meetings until you delete them. You can delete a meeting, all your meeting data, or your whole account from the app (or from our delete-account page if you no longer have it). Deletion removes your meetings, audio, transcripts, notes, share links and exports from our systems right away; backups are purged within 30 days. We keep billing records for as long as the law requires.
7. Sharing links
If you create a share link, anyone who has the link can read that meeting’s summary, decisions, action items and transcript (never the audio). The link is unlisted, is not indexed by search engines and stops working as soon as you stop sharing or delete the meeting.
8. Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. In the app, use Export my data to download a ZIP of your meetings, and Delete account to erase it. You can also write to [email protected]. You may withdraw consent where we rely on it, and you have the right to complain to your local data-protection authority.
9. Security
Data is encrypted in transit and at rest. Access to meeting content is limited to your account; our staff do not read your meetings. No system is perfectly secure, so please tell us if you notice a problem.
10. Children
Memo is not intended for people under 16, and we do not knowingly collect their data.
11. Changes and contact
If we change this policy in a meaningful way we will tell you in the app before it applies. Questions: [email protected].