Privacy Notice

How Yonro Co., Ltd. collects, uses, shares and protects your information when you use XMemo.

Yonro Co., Ltd. is the controller for hosted XMemo account data and the contracting service provider for public users, unless an enterprise agreement states otherwise.
XMemo checks every memory request against the signed-in account, team or organization it belongs to. Additional database-level row security depends on how a deployment is configured and is not part of this commitment.
Token hashes, API keys, invite hashes, session secrets, and provider credentials are excluded from exports and support bundles.
We do not sell personal data, share it for cross-context behavioral advertising, or use customer memory content to train generalized AI or machine-learning models.
Team-shared memories stay with the Team after a member leaves or closes a Personal account; closing a Personal account does not withdraw them.
Automatic redaction records only how much was redacted and its status, never the personal data itself or a fingerprint of it.
ChatGPT and other MCP apps get only the permissions you approve, and XMemo never asks you to paste a secret token into a public page or app listing.

Data we process

XMemo processes the information needed to store, search, recall, update, and govern user-owned memories for authenticated users and connected agents.

Memory content provided by users or their authorized agents, including preferences, project context, decisions, reminders, and action items.
Ownership information for each memory, such as its owner and the team or organization it belongs to, which XMemo uses to decide who can access it.
Account records, such as users, sign-in sessions, single sign-on settings, team and organization roles, and details of the access tokens you create.
Technical service data, limited to the type of request, its result and timing, rate-limit signals, and support diagnostics with personal details removed.

Purposes and legal bases

We process personal data to provide the service, secure accounts, support users, comply with law, and improve reliability. For GDPR and UK GDPR users, the legal bases are contract performance, legitimate interests, consent where required, and legal obligations.

Contract performance covers account creation, authentication, memory storage, recall, export, deletion, support, and connected-agent workflows requested by the user or customer.
We do not use customer memory content to train generalized AI or machine-learning models, sell it, or use it for advertising.
Legitimate interests cover security monitoring, abuse prevention, rate limiting, fraud detection, debugging, reliability telemetry, product safety, and service improvement, balanced against user privacy.
Consent covers optional cookies or marketing communications if introduced; consent can be withdrawn without affecting necessary service cookies.
Legal obligations cover tax, accounting, consumer-protection, security, dispute, and regulatory records that we are required to keep.

OAuth and agent access

ChatGPT and other MCP apps request specific permissions, so each app gets only the memory access it needs for your task.

Searching, recalling, explaining and listing memories needs read access only.
Write or destructive tools require write-capable scopes and are annotated so clients can present the right level of caution.
OAuth authorization codes, bearer tokens, cookies, provider secrets, and raw API keys are not shown in public pages, listing copy, screenshots, or tool responses.

Google Sign-In and Google user data

When a user chooses "Continue with Google," XMemo uses Google OAuth for account sign-in and requests only the `openid`, `email`, and `profile` scopes.

Data accessed: Google account subject identifier, email address, email verification status, display name or profile name, and profile fields returned by Google Sign-In such as a profile picture URL when Google provides it.
How we use it: to authenticate the user, create or find the user's XMemo account, link the Google identity to that account, keep the account email/display name current, issue an XMemo session, apply local MFA checks where configured, and record security/audit events for the sign-in.
How we store it: XMemo stores the Google subject identifier, email address, email verification status, provider name, identity link metadata, account display name, session metadata, and related audit records. Ordinary Google social sign-in does not store Google access tokens or refresh tokens after the sign-in exchange is complete.
How we share it: we do not sell Google user data, use it for advertising, provide it to data brokers or information resellers, or use it to train generalized AI or ML models. We share it only with subprocessors needed to operate, secure, audit, and support XMemo, or when required by law.
Retention and deletion: Google identity data is retained while the account or linked identity remains active and is deleted or deactivated through the account deletion, identity unlinking, or privacy request workflows described in this notice, subject to limited backup, security, audit, dispute, and legal-retention needs.
Protection: Google user data is protected with the same account, transport, storage, access-control, audit, and secret-handling controls described in this notice and the Trust Center.

Data we do not expose

Exports, support diagnostics, tool responses and public pages do not expose secrets, debugging data or infrastructure settings.

No API key values, token hashes, invite hashes, session secrets, provider client secrets, database URLs, or support-bundle secrets.
No raw memory content is included in public pages or unauthenticated discovery surfaces.
XMemo's responses to ChatGPT are designed not to include unrelated personal data, internal IDs, raw logs or local file paths.
While automatic redaction is turned on, XMemo refuses end-to-end-encrypted writes, because encrypted content cannot be checked for personal data.

Access, export, deletion, redaction, and privacy rights

Authenticated users can manage memory records from the XMemo Console and request access, correction, export, deletion, restriction, objection, portability, or redaction workflows for their account or workspace.

Where self-service export is available, you can download a prepared Personal export with a short-lived, one-time link that only you can use, after signing in again. Otherwise our team prepares the export and delivers it securely. Either way, the request and its delivery are recorded in the audit log.
Deleting, forgetting or redacting a memory keeps the audit record needed to show that the action took place.
Requests can be sent to privacy@xmemo.dev. We may need to verify account ownership before acting on a request.
Users in the EEA, UK, Japan, California, and similar jurisdictions may have additional statutory rights, including the right to complain to a supervisory authority where available.
Yonro is established in Japan; for data-protection matters, contact privacy@xmemo.dev. Where a representative is legally required for EU or UK users, we will appoint one and publish its contact here.

Retention and deletion

We keep personal data only as long as needed for the service, security, legal, accounting, dispute, backup, and audit purposes, unless a customer-specific agreement or law requires a different period.

Active memory content is retained while the account, workspace, or tenant remains active, until deleted by the user, admin, or authorized workflow.
Team-shared memories remain available to the Team after a member leaves or closes a Personal account, because they form part of that Team's shared record. Closing a Personal account revokes access and deletes Personal memories and account data; it does not withdraw content you contributed to a Team.
Security, audit, and support records are retained for the period reasonably needed to protect the service, prove actions, resolve disputes, and meet legal obligations.
Backups and deletion logs may persist for a limited technical period after deletion, but are protected and not used for ordinary service access.
Where retention is customer-managed, customer administrators are responsible for configuring and communicating workspace retention rules.

International transfers and subprocessors

XMemo is operated by a Japanese company. In the hosted service, persistent memory storage and the regional embedding deployment are provisioned in Azure Japan East. A separately configured GlobalStandard Azure OpenAI chat deployment, Cloudflare edge services, optional Google Sign-In, and Microsoft operational or support processing may involve other countries as described below and on the Subprocessors page.

For EEA and UK users, transfers to Japan rely on the adequacy decisions for Japan where applicable; transfers to other regions rely on standard contractual clauses or other equivalent safeguards.
For users in Japan, where personal data is provided to or stored by subprocessors located outside Japan, we handle such cross-border provision in accordance with the Act on the Protection of Personal Information (APPI), including by informing you of the destination countries and the relevant data-protection context, or by obtaining your consent where required.
As part of our security control measures we maintain awareness of the external environment (the data-protection regimes of the countries where data is stored) and supervise the subprocessors that handle personal data on our behalf.
The text of a memory is sent to Microsoft Azure OpenAI Service when XMemo generates an embedding or performs another AI operation you request. The production embedding deployment is regional in Japan East. The separately configured chat deployment is GlobalStandard and may process a request in another Azure geography. [Microsoft states](https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy) that customer prompts, outputs, and embeddings are not made available to OpenAI or used to train generative foundation models without permission or instruction; Microsoft content-safety and abuse-monitoring processing may still apply.
Named subprocessors are listed on the Subprocessors page: Microsoft for Azure runtime, PostgreSQL, Key Vault, backups, and Azure OpenAI Service; Cloudflare for DNS, TLS, edge proxying, and security filtering; GMO DigiRock, Inc. (Value-Domain) for transactional email; and Google for Google Sign-In if you choose it.
Third-party services process data under their own terms and privacy commitments where users or customers connect them directly.

Children, security, and incidents

XMemo is not intended for anyone under 18, or under the higher minimum age required to form a binding account contract where the user lives, consistent with the Terms of Service. We use commercially reasonable security measures, but no online service can guarantee perfect security or zero data loss.

If we learn that a child used the hosted service without required consent, we may delete the account or request guardian authorization.
We investigate security incidents and notify affected users, customers, and authorities as required by applicable law.
XMemo does not make legal or similarly significant automated decisions about users without human involvement.

Billing and payment data

For subscriptions, Yonro processes billing account relations, Stripe customer and subscription identifiers, plan/price mappings, invoice and payment states, renewal and cancellation states, and necessary webhook processing, audit and reconciliation records. Stripe handles sensitive payment card information; XMemo does not store full card numbers or card security codes. These records support contract performance, accounting, taxes, security, fraud prevention, disputes, refunds and legal duties, and are retained under the retention rules in this notice as needed for those purposes. Stripe supplies payment and billing services. For Managed Payments, Stripe is merchant of record and may act as an independent controller for its transaction obligations; its [Privacy Policy](https://stripe.com/privacy) applies to its processing.

Controller: Yonro Co., Ltd. (corporate number 3420001017436), Shinagawa-cho 1-4, Hirosaki, Aomori, Japan. Privacy contact: privacy@xmemo.dev.