Mem

GDPR overview

The site never uses the words GDPR or General Data Protection Regulation anywhere: Mem makes no explicit compliance claim, and equally makes no denial. What the privacy policy does provide is narrower. It acknowledges that residents of the European Economic Area may complain to their local supervisory authority and links the European Commission's directory, with an equivalent pointer for Switzerland. Access, correction and deletion requests go to support@mem.ai, with a stated 30-day response. A separate section covers California residents. Beyond that, the record is empty: no Article 27 representative, no named data protection officer, no published Data Processing Agreement, and no transfer mechanism cited for a US-established company. Subprocessors are listed at the Trust Center with their purpose and data location.

Who owns the data?

Mem Labs, Inc., trading as Mem, operates the service under a privacy policy last revised on 24 March 2026. Users keep control of their own content: the policy lets them review, change or terminate the account at any time, and the product supports a one-click export of every note and Collection to Markdown files. Deleting an account deactivates or erases the data from active databases, though some records may be retained to prevent fraud, resolve disputes or satisfy legal obligations. Mem commits in writing that it neither sells user data to advertisers or third parties nor mines it to serve advertising.

Reuse rights

Users may reuse their own content freely; the one-click Markdown export of all notes and Collections exists precisely so nothing is locked in, and no permission step is described. On Mem's side, the stated purposes are running the account, delivering the service, providing support, protecting the platform against fraud, meeting legal obligations and sending administrative or marketing messages, relying on consent, legitimate interest, contract performance and legal obligation. Data drawn from Google APIs is used to surface relevant email and calendar items under Google's Limited Use requirements. Three uses are ruled out by name: selling data, showing third-party advertising, and training generalised AI or ML models on personal information, notes or third-party data. Queries routed through the MCP integration are likewise excluded from training. Content is decrypted only for AI processing, by third-party vendors that are themselves SOC 2 compliant.

Data retention & training

Hosting summary

Mem states that its application is hosted on Google Cloud, chosen for the provider's security practices, but it names no country and no region. Account credentials are managed entirely by Google Cloud Platform, so Mem never holds user passwords, and serverless infrastructure is used for mission-critical parts of the system. Content is encrypted at rest with AES-256 and in transit with TLS, the Security page citing 128-bit TLS; it is not end-to-end encrypted, since it must be readable for AI processing. Third-party subprocessors are listed in the Trust Center at trust.mem.ai together with their purpose and the location of the data they handle, though that page renders through JavaScript and could not be read directly. The domain resolves to a Fastly anycast node in the United States, which indicates a content delivery network rather than a storage jurisdiction. No hosting country should therefore be inferred from the network data alone.