EverMind

GDPR overview

Neither GDPR nor any equivalent wording appears anywhere on the pages collected: the company makes no compliance claim, and no EU representative under Article 27 is identified. The privacy policy of 20 January 2026 (IX) does grant rights that mirror the regulation, namely access, erasure, rectification, portability, restriction and objection, withdrawal of consent, and complaint to your national data protection authority, exercised through the account or by writing to legal@evermind.ai. International transfers rest on generic references to appropriate safeguards and legally valid transfer mechanisms, with no mechanism named and no standard contractual clauses cited. Services are stated to be provided from Singapore, and the terms place disputes under Singapore law and the exclusive jurisdiction of Singapore courts. Under-18s are not accepted; data collected from them unintentionally is deleted once reported.

Who owns the data?

The publisher is Evermind AI, Inc., named in both the terms of service and the privacy policy, each effective 20 January 2026. Under those terms you keep all rights to your Inputs, and the publisher grants you whatever rights it may hold in the Outputs generated from them. That grant is conditional by construction: it transfers only rights the company actually has, and Outputs are not guaranteed to be unique, so identical Outputs produced for other users give you no claim over them. The home page markets the arrangement as data sovereignty remaining forever yours, and the self-hosted edition is the practical expression of it, since the stored memories then sit on your own infrastructure rather than the publisher's.

Reuse rights

User content feeds the running of the service: the publisher uses it to provide, maintain, develop and improve the products, to comply with the law and to enforce its own rules. On training, the stated principle is that non-public user content is not used to train EverMind's models. The two documents do not list the same exceptions, and the gap is worth knowing. The privacy policy (II.5) names three: content flagged for Trust and Safety review, feedback you explicitly send through the company's channels, and an explicit opt-in. The terms of service (IV.5) name only two, keeping the flagged content and the feedback but dropping the opt-in. Model training is otherwise declared to draw on the public internet, licensed third-party datasets, contributions from users and crowd workers, and internally generated synthetic data. One clause colours everything else: all user content is treated as non-confidential unless agreed otherwise in writing (terms IV.3.c).

Data retention & training

Hosting summary

What the publisher declares: the privacy policy of 20 January 2026 (V.2) states that the services are generally provided from Singapore. It reserves the right to transfer personal data outside your own jurisdiction, to an affiliate or to a third party abroad, and warns that local protection laws may differ and be less protective than your own. Transfers are said to rest on appropriate safeguards and legally valid transfer mechanisms, but not one is named: no standard contractual clauses, no adequacy decision. Recipients appear as categories only, covering hosting and infrastructure, compliance and audit, research and data processing, payment, and customer support. No subprocessor is named, no precise hosting country is given beyond Singapore, and no cloud region is declared. One network observation, offered as context rather than as a declaration: the home page resolves to an anycast node of AS16509, Amazon.com, in Amsterdam, which is a CDN point of presence and says nothing about where data is stored. Self-hosting changes the question entirely, since the open-source stack then runs on your own infrastructure, under your own jurisdiction.