Privacy Policy

2. Data we process

Public tools without an account (calculators) process answers in the browser and do not store them. The interactive demo uses a fixed dataset and does not accept personal files.

3. Purposes and legal bases

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Oral exam practice and speech recognition

In oral exam practice the default mode is “accurate”: your answer is recorded (up to 3 minutes), sent to our server and transcribed by the transcription provider. The same mode is always used on iPhone and iPad, when the browser does not support speech recognition or when the browser microphone fails. Alternatively you can choose the browser’s “live” recognition, which does not go through our server but through the browser’s own speech service (for example Google for Chrome, Apple for Safari).

The transcription route does not store the audio file. The transcript is sent to the AI provider to evaluate your answer; in your account we only store per-topic scores and, for wrong answers, a short note on what was missing, not the full transcript. We do not analyse tone, emotions or biometric features of your voice and we do not create voiceprints.

5. AI and model training

• What we send: AI providers receive only the content needed for the feature you asked for (source text, prompts, images, oral answer audio), without your email.
• Training: we use the providers’ paid or professional API tiers. Where a provider lets us opt out of using content to train its models, we opt out; Memoniq does not use your materials to train its own models.
• Free endpoints: some features use models offered for free through OpenRouter. In particular the default narration voice for podcasts and lessons (Fish Audio S2.1 Pro, free version) receives the text to be read aloud. Under their providers’ terms, free endpoints may retain or log inputs. For this reason the text sent to these endpoints is the generated study text, not your original files.
• Local models: with LM Studio, Ollama or local voices (Kokoro, Piper) that you configure, processing stays on your device.
• Model changes: we may change provider or model for quality, cost, security or availability. The current list is on the AI transparency page.

Health data and third-party data

Memoniq is designed for notes, lecture transcripts and study materials. Do not upload identifiable patient data (names, initials with dates, record numbers, images showing patient details) or other people’s personal data without a legal basis: these are special categories of data (Art. 9 GDPR) that the service is not designed to process. Anonymise clinical cases and examples before uploading. If we notice that publicly shared content contains such data, we may disable its link.

6. Providers (processors) and transfers

We use the following providers as processors (Art. 28 GDPR), each only for its own function. Content is sent only when needed for the requested feature.

Transfers outside the European Economic Area. Some providers process data in the US or other countries. Transfers rely on the EU-US Data Privacy Framework adequacy decision for certified providers or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). You can ask for details on the safeguards at the contact above.

7. Lists, newsletter and emails

Feedback, surveys and testimonials. They are optional and based on consent. A testimonial is published only after your explicit approval and you can ask for its removal at any time.

Creator applications. If you apply through the /creator form we process your email, platform, public profile and message only to reply and to manage the collaboration, on the basis of the consent you give in the form (Art. 6(1)(a)), withdrawable at any time. If a collaboration starts, we link a code to your profile to attribute the clicks and sign-ups that come from your link: clicks are counted in aggregate form, without IP addresses or data about the people who click.

8. How long we keep data

9. Cookies, local storage and analytics

We only use strictly necessary cookies and storage: sign-in session (Supabase), language, theme, preferences, onboarding state, optional key cache, notebook settings and local progress. We do not use advertising, profiling or third-party marketing cookies, so we do not ask for cookie consent: the banner you see is informational and lets you turn off anonymous statistics.

Vercel Web Analytics measures visits and performance in aggregate form without cookies and without identifying individual visitors. We also record some in-app actions (opening features, submitting quizzes, saved reviews) with account ID, date and screen type, without study text or URLs, for aggregated reports. You can turn statistics off in Settings > Privacy. We do not sell personal data and do not use it for behavioural advertising.

The Android app is the same full-screen web application and uses the same technical storage; it only adds a technical cookie that identifies the platform. On a shared device use separate profiles or clear site data after logging out.

10. Security measures

• Row Level Security on every table: each user only sees their own data; server-side ownership checks on files and materials.
• Personal API keys encrypted with AES-256-GCM; server secrets never exposed to the browser.
• Encrypted TLS/HTTPS connections with HSTS; files on Cloudflare R2 and the database encrypted at rest by the providers.
• CSP and security headers, rate limits, plan limits, input validation, SSRF protection for external URLs.
• Administrative access limited to the controller; internal reports without emails or study content.

11. Data breaches

If a personal data breach occurs, we assess it without delay and, if it poses a risk to your rights, we notify the Italian Data Protection Authority (Garante) within 72 hours of becoming aware of it (Art. 33 GDPR). If the risk is high we inform you directly, by email or with an in-app notice (Art. 34). Every breach is recorded in an internal register.

12. Your rights

Under Articles 15-22 GDPR you can request access, rectification, erasure, restriction, data portability, object to processing based on legitimate interest and withdraw consent at any time.

• Self-service: in Settings > Account you can export your data and delete your account.
• By email: write to infomemoniq@gmail.com from your account address. We reply within one month (extendable by two more months for complex requests, with notice).
• Complaint: you can lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the authority of the EU country where you live or work.

Users outside the EU

Where local law applies, we recognise equivalent rights as required. For California users: we do not sell or share personal data for behavioural advertising; you can request access and deletion.

How to delete your account and data

This applies to the website and the Android app. After signing in: Account > Delete account > Delete my account. Deletion is immediate and erases your account, notebooks, uploaded sources, generated materials, chat history and categories. If you cannot sign in, write from your account email to infomemoniq@gmail.com: we complete the deletion within one month (Art. 12 GDPR). Only data we are legally required to keep (accounting records, also at Stripe) and backup copies, which expire within 30 days, remain.

13. Automated decisions

Memoniq does not make decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR). Quiz scores, oral practice evaluations and mastery indicators are practice estimates: they are not official grades and are not shared with universities or third parties.

14. Minimum age

You must be at least 16 to use Memoniq, in every country; we ask you to confirm this at sign-up. This is the age set by GDPR Art. 8 and the highest threshold chosen by EU member states (Italy uses 14, Art. 2-quinquies of the Italian Privacy Code, Legislative Decree 196/2003): we apply one rule that is valid everywhere. If you are between 16 and 18, purchases require the involvement of a parent or guardian. If we find that an account belongs to someone under 16 we delete it; parents and guardians can write to us to request this.

Payments and refunds

Satisfaction guarantee: within 14 days of your first payment you can request a full refund of the subscription or Session Pass directly from Settings, without contacting anyone. The refund covers the first payment (not later renewals) and returns the account to the Free plan. Statutory withdrawal rights and legal guarantees remain unaffected.

Refund terms and contact