MyMemo

GDPR overview

No page on the site mentions the GDPR: the word appears nowhere in the text or in the archived HTML of the pages reviewed. The rating of N therefore records a silence, not a refusal, since MyMemo neither claims compliance nor states that it is out of scope. The privacy policy, effective 18 May 2025, rests entirely on US law: CCPA/CPRA in section 10, Nevada law in section 11, COPPA for under-13s in section 8. Section 9.a extends the rights to know, delete, correct, opt out of sale and to non-discrimination to every user, not only Californians; requests go through the Account page after login, or privacy@mymemo.ai. Section 12 warns that data is transferred to and kept on US servers under laws that may not be equivalent to those of your country. No Article 27 representative, no DPA, no sub-processor list and no standard contractual clauses are published.

Who owns the data?

Under section 2.e of the user agreement, last modified on 15 May 2025, the intellectual property rights in your data remain yours or your licensors'. You grant MyMemo a non-exclusive license to use, copy, store, host, display, transmit and process that data, extended to its employees and contractors, only as far as necessary to deliver the service. You warrant that you hold the rights and consents covering everything you upload. MyMemo may remove or disable data where the law compels it, with reasonable efforts to notify you. Retrieval is free: Settings > Export produces a full zip archive, one export per day, sent as a link valid for 24 hours.

Reuse rights

Section 2.e of the user agreement provides that your data may serve as an Input to AI features, the result being the Output, and grants MyMemo a license to use, modify and adapt that Input as necessary to perform and improve its services. Nothing on the site says whether models are trained on user content, and no opt-out mechanism is documented, which is why the training status is recorded as unclear rather than yes or no. The privacy policy, effective 18 May 2025, lists the declared purposes: delivering the service, maintaining, improving and personalizing it, communicating with you, account and network security, legal compliance, enforcement of the terms and fraud prevention. Data is shared with service providers (payment, advertising, analytics, IT, support), affiliated entities, authorities on lawful request and any acquirer in a corporate transaction. First and third-party cookies, web beacons, pixels and session-replay technology (mouse movement and scrolling, not keystrokes) are in use, including for targeted advertising; under the CPRA, sharing cookie identifiers and IP addresses for interest-based advertising may qualify as a sale, and an opt-out right is offered. The reverse is not symmetrical: section 3.f forbids you from using MyMemo property to train an AI of your own.

Data retention & training

Hosting summary

Uploaded files are stored in an AWS cloud database, as stated on the home page and in the site FAQ. Section 12 of the privacy policy is explicit about jurisdiction: MyMemo is based in the United States and, wherever you use the service from, the information collected is transferred to and held on servers located in the United States, under laws the policy admits may not be equivalent to those of your country of residence. Using the service counts as consent to that transfer. No hosting region can be chosen and no European data center is mentioned anywhere. Section 13 describes the safeguards in general terms only: data on secure servers behind firewalls, payment transactions encrypted over SSL. No certification such as SOC 2 or ISO 27001 is claimed. The website itself is served through Cloudflare (anycast IP 188.114.97.12), which reflects delivery and says nothing about where the stored data actually sits.