# Privacy Policy

Last updated: February 24, 2026

## 1. What We Collect

We collect the minimum data necessary to provide the Service:

- **Account data:** Email address (for signup and communication)
- **Memory data:** Conversations and text you submit via the API for knowledge extraction and storage
- **Usage data:** API call counts, timestamps, and error logs for billing and monitoring
- **Payment data:** Processed by Paddle (our payment processor). We do not store credit card numbers.

## 2. How We Use Your Data

- To provide and improve the Service (knowledge extraction, search, agents)
- To authenticate your API requests
- To track usage for billing and quota enforcement
- To send service-related communications (account, billing, security)
- To diagnose and fix technical issues

## 3. How We Process Your Memory Data

When you submit conversations or text, we:

- Send them to third-party AI providers (OpenAI, Cohere) for knowledge extraction, embedding, and reranking
- Store the extracted entities, facts, relations, and embeddings in our PostgreSQL database
- Do **not** use your data to train AI models
- Do **not** share your data with other users (unless you explicitly use team sharing features)

## 4. Third-Party Services

We use the following third-party services that may process your data:

- **OpenAI** — LLM inference and embeddings (subject to [OpenAI API data policy](https://openai.com/policies/api-data-usage-policies))
- **Cohere** — Search result reranking (Business plan only)
- **Paddle** — Payment processing
- **Railway** — Cloud hosting infrastructure
- **Upstash** — Redis caching (stores only cache keys, not raw content)

## 5. Data Storage and Security

- Data is stored in PostgreSQL databases hosted on Railway (US region)
- All API communication is encrypted via TLS (HTTPS)
- API keys are hashed before storage (we cannot see your full key)
- Database access is restricted to application processes only

## 6. Data Retention

- Your memory data is retained as long as your account is active
- You can delete individual entities or your entire account at any time via the API
- Upon account deletion, all data is permanently removed within 30 days
- Usage logs are retained for 90 days for billing purposes

## 7. Your Rights

You have the right to:

- **Access** your data via the API (GET /v1/memories, /v1/stats)
- **Delete** your data via the API (DELETE /v1/memory/{name}) or request full account deletion
- **Export** your data via the API at any time
- **Opt out** of non-essential communications

## 8. Cookies

The Mengram website uses minimal cookies for session management on the dashboard. We do not use advertising or tracking cookies.

## 9. Children's Privacy

Mengram is not intended for use by children under 13. We do not knowingly collect data from children.

## 10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email. Continued use after changes constitutes acceptance.

## 11. Contact

For privacy-related questions or data deletion requests, contact us at [the.baizhanov@gmail.com](mailto:the.baizhanov@gmail.com).