Last updated: 2026-08-09
The controller responsible for data processing on this website is:
JC Software GmbH
Oskar-Winter-Straße 9
30161 Hannover, Germany
Email: [email protected]
Data Protection Officer (DPO): We have not appointed a DPO because the requirements of Art. 37(1) GDPR do not apply to us: we are not a public authority, our core activities do not require large-scale regular and systematic monitoring of data subjects, and we do not process special categories of data (Art. 9) on a large scale. Under § 38 BDSG, we also do not meet the German statutory threshold — we do not employ 20 or more persons continuously engaged in automated personal data processing. For any data protection inquiries, contact [email protected].
MemPalace Cloud is a hosted service built on the open-source MemPalace memory engine by Milla Jovovich & Ben Sigman. The engine is MIT-licensed; the hosted service (MemPalace Cloud) is proprietary. We are not officially affiliated with the upstream project. For full legal details, see our Imprint.
Data provision requirement (Art. 13(2)(e) GDPR): Providing account data (email, authentication identifiers) is a contractual requirement — without this data we cannot create your account or operate the service. Memory content is entirely optional; what you store there is up to you and your AI tools. Not providing usage data is not possible because it is generated automatically during service use (security logs, rate limiting counters).
All data is stored on servers located in Nuremberg, Germany, operated by Hetzner Online GmbH. We do not transfer personal data outside the EU unless you explicitly ask us to (e.g. to use a specific third-party integration). For US-based processors (Sentry, Cloudflare), we rely on EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs).
Under GDPR Article 6(1), we process your data based on:
You may withdraw consent at any time by emailing [email protected] with the subject "Withdraw Consent". We process withdrawal requests immediately (within one business day). Withdrawal stops future processing but does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR). Already-stored memories remain until you delete them or your account — withdrawal of consent does not automatically erase data processed under a different lawful basis (e.g. contract performance).
Your memories are never deleted while your account is active. That's the core promise of the product. Archived memories (outside your plan's search window) are retained but not searched — you can upgrade to restore full search coverage.
When you delete your account via Settings, all personal data (memories, inbox items, settings) is erased immediately. If you request deletion via email, we process the request without undue delay and in any event within one month of receipt, as required by Art. 12(3) GDPR. Exception: billing records (invoices, payment history, tax documents) are retained for 10 years after the end of the contract year, as required by German tax law (AO § 147, HGB § 257). Anonymized aggregated statistics may be retained for operational purposes.
Feedback submissions are retained for 12 months and then automatically deleted.
Under GDPR you have the right to:
To exercise any of these rights, email [email protected] from the address on your account. We respond within 30 days.
Supervisory authority: You may lodge a complaint with our competent data
protection authority:
Die Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen)
Prinzenstraße 5, 30159 Hannover
www.lfd.niedersachsen.de
We maintain Data Processing Agreements (Art. 28 GDPR) with all processors listed below. Our DPA template is available at mempalace.cloud/dpa, or by emailing [email protected].
sendDefaultPii: false)Reach measurement is not on this list on purpose. Umami runs on our own server rather than as a hosted service, so no additional company receives your data and no new processor is involved.
Payments (Merchant of Record): Paid subscriptions are sold through Polar Software Inc. (Delaware, USA), which acts as our reseller and merchant of record. Polar is not a processor acting on our behalf — it is an independent controller for the payment and billing data it collects (card details, billing address, tax data) under Polar's own privacy policy. We never receive or store your card data; we receive only your Polar customer ID and subscription status. As the merchant of record, Polar is the controller for this payment data and is responsible for any transfer of it outside the EU under its own privacy policy; Polar relies on EU Standard Contractual Clauses (SCCs) for such transfers. Purchases made before July 2026 were sold through Paddle.com Market Limited (United Kingdom), the previous merchant of record, which remains an independent controller for the payment data it collected under its own privacy policy.
International transfers (Art. 44–49 GDPR): Transfers to US-based processors (Sentry, Cloudflare) are protected by the EU-US Data Privacy Framework adequacy decision and Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor). A copy of the SCCs applicable to your transfer is available on request from [email protected].
We will notify you at least 30 days before adding a new processor. You may object within 14 days of notification.
We implement technical and organizational measures per Art. 32 GDPR:
Note: Memory content is protected by disk-level encryption and tenant isolation, not application-level encryption. This is a deliberate trade-off to enable server-side semantic search. Session credentials are additionally encrypted at the application level because they are high-value bearer tokens.
In the event of a personal data breach, we will notify you without undue delay and in any event within 72 hours of becoming aware of the breach, as required by Art. 33(1) GDPR. We will also notify the competent supervisory authority (LfD Niedersachsen) as required by Art. 33 GDPR.
We do not carry out automated decision-making — including profiling — that produces legal effects or similarly significantly affects you within the meaning of Art. 22(1) GDPR.
Rate limiting and plan enforcement: When you reach your plan's usage limits (e.g. memory count, API calls), automated enforcement may temporarily block further writes until you upgrade or the window resets. These thresholds are purely quantitative (counts per tenant) and do not analyze the content or meaning of your data. We consider rate limiting outside the scope of Art. 22 because temporary usage caps do not produce legal effects or similarly significantly affect users within the meaning of Art. 22(1) — they are quantitative service-level measures that impose no legal consequence and are not comparable in significance to decisions affecting employment, credit, or access to public services. If you believe an automated block should be reviewed, email [email protected] and a human will review within one business day.
We use only strictly necessary cookies for authentication. We do not use tracking cookies or third-party advertising cookies.
Since August 2026 we measure reach with Umami, which we run ourselves on our own server in Nuremberg. It is not a third-party service: no analytics provider receives your data, and no new processor is involved. It sets no cookies and stores nothing on your device, which is why no consent banner appears — § 25(2) TDDDG applies only where information is stored on or read from your device.
Only our public website is measured. Reach measurement runs on pages anyone can visit — the home page, pricing, blog, documentation, sign-up and log-in. It does not run anywhere inside the signed-in application: once you are logged in, your use of MemPalace Cloud is not measured at all. Team-invitation links are excluded as well, so the invitation token in the address bar never reaches our analytics.
What it records is listed in section 2 under "Reach measurement". What it does not do: it sets no identifier, does not recognise you across days or across websites, does not store your IP address, and is never linked to your account. Records are kept for 12 months and then deleted.
How to opt out. Either works, and both take effect immediately:
localStorage.setItem('umami.disabled', 1) in your browser console to disable
it for this site in that browser.You may also object to reach measurement at any time under Art. 21(1) GDPR by emailing [email protected]. Because the data identifies no individual, we cannot retroactively find and delete "your" past visits — but we will ensure no further ones are recorded.
We will notify you by email at least 14 days before any material change to this policy. The current version is always available at mempalace.cloud/privacy.