Privacy, in plain words.

Effective October 1, 2026. Controller: Avihay Zanetti (Israel). The short version: we hold the minimum, we sell nothing, and website analytics runs only if you accept it.

What we hold, and why

Account data: your name, email, and role in a vault. Needed to sign you in and enforce access rules.
Vault content: the notes your team and its agents write. Stored to provide the service, shown only to the people and agents your rules allow. We do not read it, sell it, or train models on it.
History and audit records: who changed which note and when, and which tools each agent called. This attribution is a core feature, visible to your own vault's members per your rules.
Operational logs: sign-in events and service health, kept briefly for security and debugging.
Forms: what you type in the signup form, used to answer you and for nothing else.
Website analytics, only if you accept: if you accept the notice on our marketing pages, Microsoft Clarity records how you use this website: pages viewed, clicks, scrolling, device type and approximate location. What you type into forms is masked. It never runs on the app or inside your vault, and nothing is loaded if you decline, do not answer, or your browser sends Global Privacy Control or Do Not Track. Change your choice any time with Cookie settings in the footer; data already collected stays with Clarity until its retention period ends.

What we do not do

No advertising or tracking scripts and no fingerprinting, on this site or in the product. The one analytics tool is Microsoft Clarity, and only if you accept. The cookies Memava sets are your session and, on a password-protected published site, a small cookie that keeps it unlocked for you.
No selling or sharing of personal data for advertising. Ever.
No reading of vault content, except the specific material you show us when you ask for support, or where the law compels us.

Connected accounts and your assistant

Memava Chief of Staff is a separate product from the vault. You can connect accounts to your own assistant: today that means Gmail, Google Calendar and Granola. A connection lets your assistant read what you connected so it can write your morning brief and draft replies and follow-ups. Nothing is sent or changed until you approve it with a tap, and approvals are signed, so a forged approval is refused.

What we store: your assistant's memory of your goals and tasks, your chat with it, your drafts and their status, a history of what the assistant did and what you approved, and the tokens that make each connection work. Tokens belong to your assistant and are used for nothing else.
Where connection tokens live: on our server, in files that only your own assistant's private container can use (for Google, in a separate credential service that hands your assistant short-lived access instead). The AI model is blocked from reading them, and no other customer's assistant can. Our server disk is not yet encrypted at rest; we will say so here the day that changes. Data is encrypted in transit.
How long we keep things: decided drafts are removed after 7 days (a short record of what you decided stays in your history). Files you send your assistant are removed after 30 days at most, and files it sends you after 30 days. Your assistant's memory and chat history stay until you ask it to forget something or ask us to delete your data. Routine backups rotate and are gone within 30 days of a deletion.
Drafts and AI models: to write a draft, the relevant text is processed by an AI model. We do not sell it, use it for advertising, or train models on it. Assistants that run on your own Claude subscription send that text to Anthropic. Assistants on a Memava-managed plan send it through our gateway, which does not store prompts, to a model from OpenAI, Anthropic, Google or xAI. Optional background lanes (for example classifying mail) run only if you switch them on with your own key.
Other services that receive some of your data: if you chat with your assistant on Telegram, Telegram carries those messages. Market-data providers (Finnhub, Twelve Data, Alpha Vantage) receive only the ticker symbols on your watchlist, never amounts or cost basis. Voice notes are transcribed on our own server.
Approval first, by default: nothing is sent or changed without your tap. Two exceptions are yours to create: a standing rule you approved for named people, which lets your assistant send mail to those addresses with a daily limit, and a group helper you set to work on its own, which acts only inside its group. If your assistant has a mailbox of its own, it also sends short fixed-wording notes from that address, such as scheduling offers, confirmations and acknowledgements, and when someone picks one of the times it offered, it books that meeting on your calendar and invites them. Anything in its own words waits for your tap unless you raise its level yourself, and anything in its own words to someone new, any attachment and any amount of money always waits.
Taking access away and deleting: you can take access away from any account at the provider or by writing to us, and you can ask us to delete your data at any time. The steps are on the delete your data page.
Social accounts: connecting social networks is coming soon. Before it launches, this page will say exactly what is stored and for how long.
Notes about your group: if you tell us about your group through the Chief of Staff page, we keep what you write (who you are, what you look after, what you would hand over first, who introduced you, when we can reach you) so that we can read it and write back. We use it for nothing else, and you can ask us to delete it at any time.

Cookies are covered on the cookies page.

Where it lives

Vaults are hosted on dedicated infrastructure in the United States (Hetzner's Ashburn, Virginia data center, operated by Hetzner Online GmbH), encrypted in transit, with daily backups. Sign-in emails are delivered through our mail provider. Website analytics, only if you accept the notice on the marketing pages, is processed by Microsoft (Clarity), in the United States and the European Union as described by Microsoft. For Memava Chief of Staff, the text your assistant works on is also processed by the AI model providers named above (Anthropic, and on managed plans OpenAI, Google and xAI). Paid checkout, when used, is handled by a merchant of record who processes your payment details; we never see your card number. That is the whole subprocessor list, and it changes only with notice on this page.

Your rights

Ask us what we hold about you, correct it, export it, or have it deleted: write through the form or to the address in your welcome email, and a person answers within 30 days. Vault deletion covers backups within 30 days. If you are in the EU or UK, the GDPR rights you expect apply, and a signed DPA is available for teams that process personal data inside their vault.