Privacy Policy

1. Introduction

HyperMemory ("we," "us," or "our") operates the hypermemory.io website, the HyperMemory application at app.hypermemory.io, the HyperMemory MCP server, CLI, and REST API (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account information

When you create an account, we collect information provided by your OAuth identity provider (GitHub, Google, or email/password via Supabase). This typically includes your name, email address, and profile avatar. We do not receive or store third-party passwords.

Memory data

The core purpose of HyperMemory is to store memory data on behalf of your AI agents. This includes nodes, edges, hyperedges, and any associated descriptions, metadata, and files you upload through our Service. This is your data.

Usage data

We automatically collect certain information when you interact with the Service, including query counts, API call metadata (timestamps, response codes), and general usage patterns. This data is used for billing, rate limiting, and service improvement.

Log data

Our servers automatically record information such as your IP address, browser type, referring/exit pages, and timestamps. This data is retained for security monitoring and debugging purposes.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To process your transactions and manage your subscription
• To enforce rate limits, usage quotas, and billing
• To communicate with you about your account, updates, or support requests
• To detect and prevent fraud, abuse, or security incidents
• To comply with legal obligations

4. How We Do NOT Use Your Information

• We do not train AI models on your data. Your memory graphs, nodes, edges, uploaded files, and any content stored through the Service are never used by HyperMemory to train, fine-tune, or improve any machine learning model. Where we use third-party AI providers for features like memory enrichment and file summarization (see Section 7), data is sent for inference only — not for training. Our agreements with these providers prohibit use of your data for model training.
• We do not sell your personal information to third parties.
• We do not share your memory data with other users unless you explicitly grant access via API key scoping or graph sharing.

5. Data Storage and Security

EU-hosted infrastructure

All data is stored and processed in European Union data centres. Our infrastructure providers are selected for their compliance with EU data protection standards.

Encryption

All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 or equivalent.

Access controls

Access to production systems is restricted to authorised personnel only. API access to your memory graphs requires authenticated credentials (OAuth tokens or API keys). API keys are SHA-256 hashed before storage — we cannot see your raw keys after creation.

6. Data Retention

Your memory data is retained for as long as your account is active. If you delete a memory graph, nodes, or your account, the associated data is permanently removed from our systems. Backups containing deleted data are purged within 30 days.

Usage logs and billing records are retained for the period required by applicable law (typically up to 7 years for financial records).

7. Third-Party Services

We use the following third-party services to operate HyperMemory:

• Supabase — Authentication (OAuth provider)
• Stripe — Payment processing
• Scaleway — Object storage for uploaded files
• OpenRouter — AI inference for memory enrichment and content processing (your memory content is sent for inference only, not training)
• LlamaCloud — Document parsing and extraction for uploaded files
• Resend — Transactional email delivery
• Google Analytics — Website analytics (marketing site only, not the app or API)

Each provider processes data only as necessary to deliver their specific service and is bound by their own privacy policies and data processing terms.

8. GDPR Compliance

HyperMemory is fully GDPR compliant. If you are a resident of the European Economic Area (EEA), you have the following rights:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate data.
• Erasure — Request deletion of your personal data.
• Portability — Request your data in a structured, machine-readable format.
• Restriction — Request that we limit processing of your data.
• Objection — Object to processing based on legitimate interests.

Data Processing Agreements (DPAs) are available for all paid plans upon request.

To exercise any of these rights, contact us at privacy@hypermemory.io.

9. Cookies

Our marketing site (hypermemory.io) uses cookies for analytics. The HyperMemory application (app.hypermemory.io) uses session cookies strictly necessary for authentication. We do not use advertising cookies or cross-site tracking.

10. Children's Privacy

Our Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

12. Contact

If you have questions about this Privacy Policy or our data practices, contact us at:

privacy@hypermemory.io