Analytics preferences

We use optional Google Analytics cookies to understand visits to this marketing site. They stay off unless you accept. We do not use advertising pixels or advertising cookies. Read our privacy policy.

Privacy Policy

Last updated: November 3, 2026

1. Introduction

HyperMemory ("we," "us," or "our"), with a business address at 20 Olive Avenue, Unit 102, North York, Ontario, M2N 7G5, Canada, operates hypermemory.io, docs.hypermemory.io, app.hypermemory.io, the HyperMemory MCP server, CLI, and REST API (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service.

HyperMemory is the controller for account administration, billing, security, service telemetry, support, and its own business operations. HyperMemory generally acts as a processor for memory content and files that customers control and submit to the Service.

10. Children's Privacy

Our Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

12. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

Privacy Lead: privacy@hypermemory.io

HyperMemory, 20 Olive Avenue, Unit 102, North York, Ontario, M2N 7G5, Canada

2. Information We Collect

Account information

When you create an account, we collect information provided by your OAuth identity provider (GitHub, Google, or email/password via Supabase). This typically includes your name, email address, and profile avatar. We do not receive or store third-party passwords.

Log data

Our servers automatically record information such as your IP address, browser type, referring/exit pages, and timestamps. This data is retained for security monitoring and debugging purposes.

Memory data

The core purpose of Hypermemory is to store memory data on behalf of your AI agents. This includes nodes, edges, hyperedges, and associated descriptions, metadata, and files you upload through our Service. You control what you submit and are responsible for having authority to process third-party personal data. HyperMemory personnel cannot retrieve, search, or view customer memory content or files through administrative or support tooling.

Usage data

We automatically collect certain information when you interact with the Service, including query counts, API call metadata (timestamps, response codes), and general usage patterns. This data is used for billing, rate limiting, and service improvement.

3. How We Use Your Information

Depending on the activity, we rely on performance of a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, or consent where consent is required. When we process customer-controlled content as a processor, we act on the customer's documented instructions.

  • To provide, maintain, and improve the Service
  • To process your transactions and manage your subscription
  • To enforce rate limits, usage quotas, and billing
  • To communicate with you about your account, updates, or support requests
  • To detect and prevent fraud, abuse, or security incidents
  • To comply with legal obligations

4. How We Do NOT Use Your Information

  • We do not train AI models on your data. Your memory graphs, nodes, edges, uploaded files, and any content stored through the Service are never used by Hypermemory to train, fine-tune, or improve any machine learning model. Where we use third-party AI providers for features like memory enrichment and file summarization (see Section 7), data is sent for inference only, not for training. Our agreements with these providers prohibit use of your data for model training.
  • We do not sell your personal information to third parties.
  • We do not share your memory data with other users unless you explicitly grant access via API key scoping or graph sharing.

5. Data Storage and Security

Access controls

Access to production systems is restricted to authorised named accounts protected by multi-factor authentication. API access to your memory graphs requires authenticated credentials (OAuth tokens or API keys). API keys are SHA-256 hashed before storage, and we cannot see your raw keys after creation. Administrative and support tooling does not provide HyperMemory personnel with a way to retrieve, search, or view customer memory content or files. Support is limited to account-side records, technical metadata, customer self-service export and deletion, and actions the authenticated customer can perform or specifically instruct within the supported product boundary.

Encryption

All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 or equivalent.

EU-hosted infrastructure

HyperMemory's primary infrastructure is configured for European hosting. Approved providers may process limited data in other jurisdictions as described in our subprocessor information and subject to applicable transfer safeguards.

6. Data Retention

Your memory data is retained for as long as your account is active. Following a valid deletion request or account termination, active production copies are deleted within 30 days and protected backup copies expire within 90 days, unless a legal hold or another binding requirement applies.

Product operational logs are retained for 12 months. Security and audit evidence is retained for 4 years. Accounting, tax, billing, and historical financial records are retained for 7 years, subject to any longer binding requirement or legal hold.

7. Third-Party Services

We use the following third-party services to operate Hypermemory:

  • Hetzner, European production compute, networking, backups, attached storage, and S3-compatible object storage
  • Supabase, Authentication and account identity services
  • Stripe, Payment processing, subscriptions, invoicing, and fraud prevention
  • OpenRouter and the selected downstream model provider, AI inference and reranking for requested memory, note, document, and recall features. Requests are sent for inference, not model training. Most routes require zero-data-retention routing; the documented batch note-import route may use a provider endpoint that retains requests while still denying provider data collection
  • Unstructured, Document parsing, text extraction, and OCR for uploaded files
  • Brave Search, Search queries for requested note lookup, research, and related search features
  • Bright Data, Public web-page and image retrieval when a user invokes a feature that needs external page reading and direct retrieval is insufficient
  • Resend, Transactional email delivery
  • Vercel, Hosting and delivery of the public documentation site
  • Google Workspace and ClickUp, Business email, support, controlled documentation, work management, and compliance evidence
  • Intuit QuickBooks, Accounting and transaction reconciliation; customer memory content is not stored there
  • MEGA, Encrypted secondary endpoint backups for approved company-device files; it is not the production memory store
  • Google Analytics, Optional website analytics loaded only after opt-in consent (marketing site only, not the app or API)

Each provider processes data only as necessary to deliver their specific service and is bound by their own privacy policies and data processing terms.

8. GDPR Compliance

Hypermemory is designed and operated to support compliance with applicable GDPR requirements through documented accountability, privacy-by-design, security, data-subject-rights, deletion, incident-response, processor, and transfer controls. The programme is partially implemented and is collecting operating evidence; this policy does not claim certification or independent legal validation. If you are in the European Economic Area (EEA), you have the following rights:

Data Processing Agreements (DPAs) are available for paid and enterprise plans where applicable. Where HyperMemory acts as a processor without a standalone DPA, applicable processor terms are incorporated into the service terms. HyperMemory does not make decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact us at privacy@hypermemory.io.

  • Access, Request a copy of the personal data we hold about you.
  • Rectification, Request correction of inaccurate data.
  • Erasure, Request deletion of your personal data.
  • Portability, Request your data in a structured, machine-readable format.
  • Restriction, Request that we limit processing of your data.
  • Objection, Object to processing based on legitimate interests.

9. Cookies

Our marketing site (hypermemory.io) loads Google Analytics cookies only after you opt in, and you can change that choice through the Privacy choices control. The Hypermemory application (app.hypermemory.io) uses session cookies strictly necessary for authentication. We do not use advertising pixels, advertising cookies, or cross-site tracking.