MixMemo

GDPR overview

The word GDPR does not appear anywhere on the site: zero occurrences across the nine published pages. There is no DPA, no sub-processor list, no EU representative under Article 27 and no named DPO. Some GDPR-adjacent machinery is nonetheless cited: Standard Contractual Clauses are used as the safeguard for transfers from the EEA and the United Kingdom, and the 14-day statutory withdrawal right is acknowledged for EEA and UK consumers, subject to the usual waiver where service starts immediately. Data subject rights, access, correction, deletion, restriction, portability, objection, withdrawal of consent and marketing preferences, are offered but framed under US state privacy law, and are exercised by writing to privacy@mixmemo.com (section 11 of the policy, effective 19 June 2026). The publisher sits outside the EU, in Shenzhen, China, and states that data may be processed in countries other than yours.

Who owns the data?

The terms leave you the owner of everything you upload: product photos, reference images, prompts, notes, logos and brand assets. MixMemo claims no ownership over it. You grant the publisher a limited, non-exclusive, worldwide licence to host, copy, transmit and process that content solely to operate the service, ending once the content is removed from MixMemo's systems and its partners', typically within seven days of upload. You also own the rights you hold in the AI outputs, with commercial use, publication, modification and distribution at no extra charge. MixMemo reserves that similar inputs may produce similar outputs for other users, so no exclusivity is guaranteed; you warrant you hold the rights to what you upload.

Reuse rights

MixMemo states it processes content to run the service: fulfilling generation requests, administering accounts, communications, security and fraud prevention, legal compliance, service improvement and AI content safety. The product is local-first, so notes and canvases sit in the browser's IndexedDB and are not uploaded automatically; content leaves the device only when an action requires the cloud, namely generating or editing an image, analysing a document, or creating a public share link. Submitted content is then passed to unnamed third-party AI providers. MixMemo states it does not use your notes, images or other user content to train its own AI models, and that its AI providers neither train their general-purpose models on submitted content nor share it with other third parties. Google Analytics and Microsoft Clarity are named as analytics tools, sign-in can run through Google OAuth, and payments go through Creem. Content may also be shared with service providers covering payment, infrastructure, analytics and email delivery, for legal obligations, in a business transfer, or with your consent. On the reuse side, outputs are yours to publish, modify, distribute and sell commercially on paid plans and credit packs, without asking permission.

Data retention & training

Hosting summary

No hosting country or region is declared anywhere on the site. The domain resolves to 216.150.1.1, an anycast node on AS16509 (Amazon.com Inc.) geolocated in the United States, which is an infrastructure clue rather than a statement by the publisher, and an anycast address does not indicate where user data physically sits. The publisher itself is located in Shenzhen, China. The privacy policy announces that data may be processed in countries other than the user's, and cites Standard Contractual Clauses as the safeguard for transfers from the European Economic Area and the United Kingdom. In practice, much of the note-taking side never reaches a server: notes and canvases are held by default in the browser's IndexedDB, on the device. For what does travel, MixMemo describes TLS/SSL encryption in transit, plus encryption and access controls for temporarily stored data. Card payments are handled by third-party processors compliant with PCI-DSS, and MixMemo states it does not store card numbers. No sub-processor is named in the legal documents, so the published material does not reveal which providers or which jurisdictions handle images submitted for AI processing.