MemMachine

GDPR overview

The privacy policy, last updated on 20 May 2026, addresses the GDPR explicitly and at length. A dedicated section for users in the EEA and the UK sets out the legal bases relied on and enumerates nine rights: information, access, rectification, erasure, restriction, portability, objection, protections around automated decision-making and profiling, and the right to complain to a supervisory authority. Requests are answered within one month, free of charge unless manifestly unfounded, repetitive or excessive, and are exercised at privacy@memverge.com. International transfers are covered by standard contractual clauses and the international data transfer agreement or addendum, available on request. A Data Processing Agreement can be requested. One gap is worth noting: the policy says an EEA representative may be contacted "as explained below", but no representative is ever named and no contact details appear anywhere in the document.

Who owns the data?

MemVerge's terms treat customer data as the customer's. "Customer Data" covers everything submitted, uploaded, transmitted, stored or indexed through the Services, and on termination MemVerge undertakes to destroy it, subject to applicable law. Where MemVerge processes personal information on behalf of a customer, it acts as processor or service provider, and the customer's own privacy policy governs that processing rather than MemVerge's. MemVerge states that it does not sell or share personal information with third parties for their promotional or direct marketing purposes. Running the open-source edition in a private cloud or on-premises keeps the data entirely within the customer's own infrastructure.

Reuse rights

The open-source edition is licensed under Apache 2.0, so the code may be used, modified and redistributed without asking permission, subject to the licence's attribution and notice requirements. The hosted Services are different: the licence granted is non-exclusive, non-transferable and limited to the customer's personal or internal business use, with no right to sublicense. Customers may not resell, lease, distribute or create derivative works of the Services, reverse engineer them, or use them to build competing functionality or train competing AI models. Data the customer puts in remains theirs to use. On the vendor side, MemVerge collects user content submitted to the Services, including prompts and uploaded files, images and audio, and uses usage data to administer and improve the platform; it also shares aggregated, non-personal information with third parties for business and marketing purposes. Nothing in the privacy policy or the terms states whether customer data is or is not used to train AI models.

Data retention & training

Hosting summary

For the hosted service, the jurisdiction is the United States and only the United States. MemVerge states that it is located there and that the personal information it collects is stored on servers located there. Users are asked to consent explicitly to their data being processed and stored in the United States, with the policy acknowledging that protection may fall short of what other regions, and the European Union in particular, require. No alternative region and no data-residency option are offered. For transfers, MemVerge says it may enter into standard contractual clauses and an international data transfer agreement or addendum, and that further details are available on request. The self-hosted route changes the picture completely: because the open-source edition runs locally, in Docker, in a private cloud or in an on-premises data centre, hosting is wherever the customer puts it, and MemVerge sees none of it. One detail worth separating out: the marketing site itself resolves to a GitHub Pages address behind a Fastly anycast front end, which describes the website's hosting and not the service's.