Effective date: 2026-11-01

Privacy Policy

Codelabs Studio S.L. (Tax ID B88708797), with registered office at Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain, registered in the Commercial Registry of Málaga, sheet MA-198508, entry 1 ("Codelabs", "we"), operates MemoryFirst (the "Service"). This Privacy Policy explains how we collect, use and protect personal information when you use the Service. We are a data controller for account and account-billing data, and a data processor for content you add into the Service ("Workspace Data").

1. Information we collect

  • Account information. Name, work email, password hash or OAuth identifier, organisation name.
  • Billing information. Company name, VAT ID, billing address, payment-method last 4 digits (Stripe holds the full card data).
  • Workspace Data. Content you and your AI agents add (documents, voice transcripts, chats, web sources, ops events). This is Your Data; you own it. We process it under your instructions per the DPA.
  • Integration data. When you connect a third-party tool (Notion, Drive, Gmail, Calendar, GitHub, etc.) we receive OAuth tokens and the content you authorise the integration to read. Tokens are stored encrypted at rest.
  • Usage data. Basic feature usage, error logs, performance metrics, used to operate, secure and improve the Service. Anonymised after 90 days.
  • Communications. Emails to support, founders or sales addresses.

2. Legal basis (GDPR Art. 6)

  • Contract performance (Art. 6(1)(b)): providing the Service you subscribed to.
  • Legitimate interests (Art. 6(1)(f)): securing the Service, preventing fraud and abuse, anonymised analytics. You may object at any time.
  • Consent (Art. 6(1)(a)): marketing emails, optional cookies. Withdrawable at any time.
  • Legal obligation (Art. 6(1)(c)): tax records, lawful access requests.
  • Analysis of the use of the Service (Art. 6(1)(f), legitimate interest): activity figures of your account, the browsing data that does not depend on optional cookies, the questions put to the support chat and the opinions you send us. You can object by writing to privacy@memoryfirst.ai.
  • Browsing analytics with PostHog (Art. 6(1)(a), consent): only if you accept it in the cookie banner, where you can withdraw it at any time.

3. How we use your information

  • Provide, maintain, secure and improve the Service.
  • Authenticate you and manage your account.
  • Bill you and meet tax/accounting obligations.
  • Communicate about the Service (transactional). Marketing only with consent.
  • Comply with legal obligations and respond to lawful requests.

3a. How we analyse the use of MemoryFirst

We want to understand what fails and what we do not explain well. To do so we analyse how the Service is used: browsing on the public pages of the website, the questions put to the website's support chat and the opinions you send us. Memories, events, documents, connected sources and the text of your questions and their answers are not part of this analysis: from them we only use activity figures (for example, how many questions you ask and when you asked the last one), never their content.

  • Browsing. With your consent in the Analytics category of the cookie banner, which you can withdraw at any time, PostHog (EU region) records anonymously how the public pages are browsed, including the sign-up and sign-in pages. We do not record the session.
  • Your account dashboard. Where your memories are shown we do not record your behaviour, nor do we record or capture the screen. Page views are only counted in aggregate, technical errors are logged and, if you accepted the Advertising category, the Meta pixel receives the page address, without its content.
  • Opinions. We keep the text you write to us, the page you send it from, your account and, if you give it to us, your email. It accepts no voice notes, screenshots or attachments. If you paste part of a memory there, we will read it because you sent it to us.
  • No automated decisions. This analysis involves no automated decision producing legal effects on you or similarly affecting you: it does not change your price, your plan or your access.
  • Objection. You can object to the analysis based on legitimate interest by writing to privacy@memoryfirst.ai, with no need to give reasons and without losing the Service.
  • Controller. Codelabs Studio, S.L., PASAJE Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain.

4. AI processing of Your Data

The Service uses AI models to embed, retrieve and reason over Workspace Data. We route prompts to third-party LLM providers (Anthropic, OpenAI, Google, Mistral, Cerebras) via a gateway, governed by the provider's no-training contractual commitments. We do not train shared models on Your Data. Enterprise customers may pin processing to specific providers or self-hosted models. The full subprocessor list is at /legal/dpa.

5. Sharing & subprocessors

We do not sell personal data. We share data only with subprocessors that operate under written contracts and EU-standard data-protection obligations. Current subprocessors are listed in the DPA and include cloud infrastructure (Hetzner Online GmbH, Germany), edge security (Cloudflare Inc., US, with SCCs), payments (Stripe Payments Europe Ltd., Ireland) and the LLM providers above. We notify customers 30 days before adding or replacing a subprocessor.

6. International transfers

Workspace Data is stored in Germany (EU) by default. Some subprocessors are located outside the EEA. Transfers rely on EU Standard Contractual Clauses (SCCs) (Commission Decision 2021/914) and, where applicable, additional technical and organisational measures (encryption in transit and at rest, pseudonymisation, access controls). Enterprise customers can pin data residency to EU-only.

7. Security

TLS 1.3 in transit. AES-256 encryption at rest, per-workspace keys. Multi-tenant isolation enforced at the database via row-level security. Bcrypt-hashed API keys (cost factor 12). Daily encrypted backups with 30-day retention. Annual penetration test (planned for FY 2026). Vulnerabilities can be reported to security@memoryfirst.ai; we follow a 90-day responsible-disclosure policy.

8. Retention

  • Workspace Data: for the duration of your account. On termination, exported on request and permanently deleted within 30 days.
  • Account & billing: kept for the duration of the contract plus statutory tax retention (6 years in Spain).
  • Logs & metrics: raw 30 days; anonymised aggregates indefinitely.
  • Support emails: 24 months after the last interaction.

9. Your rights (GDPR Arts. 15–22)

You have the right to access, rectify, delete, restrict or object to processing of your personal data, the right to data portability, and the right not to be subject to solely automated decisions with legal effect. To exercise any of these rights, email privacy@memoryfirst.ai. We respond within 30 days. You may also lodge a complaint with your national supervisory authority; in Spain, the AEPD ( aepd.es).

10. Cookies

We use strictly necessary cookies (authentication session, language, theme and your cookie choice). If you accept the Advertising category in the cookie banner, we also set a first-party attribution cookie (cl_attr), which records where your visit came from (source, medium, campaign, landing page and, if you arrive from an ad, the platform click id) so we can measure which channels make us known, and we load the Meta pixel (Meta Platforms Ireland Ltd.), which measures the effectiveness of our advertising. Neither is set before you accept or if you choose "Essential only", and you can withdraw your consent at any time from "Cookie settings" in the footer. We use no other advertising or tracking cookies. Detail: /legal/cookies.

10 bis. Support chat

AI support chat. The assistant on this site runs on AgenteUno, of which we are a customer, acting as a processor. Until you open it and write, it stores nothing on your device. When you write, we keep a session identifier in your browser's session storage to keep the conversation going, and on AgenteUno's servers the text of your messages, the assistant's replies and the date and time of the conversation, so we can answer you and improve our support. To generate the replies, the text is sent to Cerebras Systems Inc. (U.S.), the language-model provider AgenteUno uses for this chat, acting as a sub-processor. Cerebras Systems Inc. is not on the EU-U.S. Data Privacy Framework (DPF) list: the transfer relies on the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) incorporated into its data processing agreement. If you use the assistant's voice, the audio is processed with Google Gemini Live (Google, U.S.), certified under the EU-U.S. Data Privacy Framework. Please do not type in that chat data you do not want us to keep (for example health data or other people's data). Chat usage statistics (opens and messages) are measured only if you accept the Analytics category in the cookie banner. The legal basis is our legitimate interest in answering your enquiry (art. 6.1.f GDPR). You can ask us to delete the conversation by writing to privacy@memoryfirst.ai.

11. Children

The Service is intended for use in a business context and is not directed to children under 16. We do not knowingly collect personal data from children.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced by email at least 30 days before they take effect. The current effective date is shown at the top of this page.

13. Contact

Privacy questions: privacy@memoryfirst.ai · Security: security@memoryfirst.ai · Founders: founders@memoryfirst.ai.

This policy is governed by the laws of Spain. If you are a business or professional, any dispute is submitted, waiving any other forum, to the Courts of Málaga (Spain). If you are a consumer, the forum determined by the mandatory applicable law applies and, only where the law allows, the Courts of Málaga. You can complain to the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid).