Privacy Policy

Welcome to LongTerMemory ("we," "our," or "us"). We are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered study and exam preparation platform.

LongTerMemory is a SaaS platform that uses Retrieval-Augmented Generation (RAG) to auto-generate question-answer pairs from your uploaded study materials and implements spaced repetition scheduling for long-term retention.

Data Controller: LongTerMemory operates as the data controller for the personal information collected through our service. By using our service, you agree to the collection and use of information in accordance with this policy.

We collect the following types of information:

Account Information

• Email address (required) - Used for authentication and communication
• Phone number (optional) - For account recovery if provided
• Name (optional) - For personalization
• Timezone - Auto-detected from your browser for scheduling

Study Materials

• Documents - PDFs and other files you upload for study
• Web links - URLs you submit for content extraction
• Personal notes - Any notes you add to your study projects

Technical and Usage Data

• Authentication tokens - Secure tokens for session management
• Usage data - Study session progress, Q&A interactions, and spaced repetition performance
• Device information - Browser type, operating system, and IP address for security and analytics

We use your information for the following purposes:

Authentication and Security

We use passwordless magic link authentication. When you sign in, we send a one-time code to your email that expires after 15 minutes. This approach enhances security by eliminating password-related vulnerabilities.

AI-Powered Study Features

Your uploaded documents and web links are processed through our AI pipeline to:

• Generate question-answer pairs for studying
• Create vector embeddings for semantic search and retrieval
• Implement personalized spaced repetition schedules

Payment Processing

We use Stripe to process all payments. We do not store your payment card details on our servers. Stripe handles all payment information securely in compliance with PCI-DSS standards.

Analytics and Improvement

We analyze aggregated, anonymized usage patterns to improve our service, enhance the user experience, and develop new features.

For users in the European Economic Area (EEA) and UK, we process your personal data based on the following legal grounds:

• Performance of Contract - Processing necessary to provide you with our study platform services, including document processing, Q&A generation, and spaced repetition scheduling.
• Legitimate Interests - Processing for our legitimate business interests, such as improving our services, preventing fraud, and ensuring security, where these interests do not override your fundamental rights. Analytics data sent to Google Analytics is also processed under this legal basis, with IP anonymization applied to minimize privacy impact.
• Consent - Where you have given explicit consent for specific processing activities, such as receiving marketing communications. You may withdraw consent at any time.
• Legal Obligation - Processing necessary to comply with our legal obligations, such as tax and accounting requirements.

We share your information with the following third-party service providers who help us operate our platform:

OpenAI (AI Processing)

We use OpenAI's APIs to process your study materials and generate question-answer pairs. Your document content is sent to OpenAI for processing. OpenAI's data processing is governed by their Privacy Policy.

Stripe (Payment Processing)

Stripe processes all payments and handles your payment card information. We do not have access to your full card details. Stripe's data practices are described in their Privacy Policy.

Google Analytics & Search Console

We use Google Analytics to understand how users interact with our platform. The information shared with Google Analytics includes: pages visited, session duration, referral source, device type, browser type, and anonymized IP address. We do not share personally identifiable information with Google Analytics. We have enabled IP anonymization to protect your privacy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Google Search Console is used solely by our team to monitor site indexing and search performance. No user personal data is transmitted to this service.

We have entered into a Data Processing Agreement with Google LLC to govern the processing of personal data through Google Analytics in compliance with GDPR Article 28.

PostHog

With your consent, we use PostHog (PostHog Inc., data hosted in the EU) for product analytics, session recordings and error tracking. PostHog receives the pages you visit, the actions you take on the site (for example signing in, viewing pricing or starting a checkout), device and browser information, and technical error reports. When you are signed in, these are linked to your account ID, email address, name and plan. Session recordings mask the text you type in form fields. The content of your study materials, notes and chat messages is not sent to PostHog.

PostHog is only activated after you accept analytics cookies, and stops as soon as you withdraw consent via "Cookie Settings" in the footer. We have entered into a Data Processing Agreement with PostHog to govern the processing of personal data in compliance with GDPR Article 28.

Brevo (Account and Marketing Emails)

We use Brevo (Sendinblue SAS, France, data hosted in the EU) to send emails from team.longtermemory.com. Brevo receives your email address, your name and the content of the email, which may include a summary of your activity (for example the number of projects, questions and reviews, or when your trial or pack ends).

• Account emails - Tips to get started, reminders before your free trial or access pack ends, a notice when it has ended and short one-click surveys. They relate to the service you signed up for (performance of contract and legitimate interest).
• Marketing emails - Study tips, product updates and occasional offers, sent only if you opted in (consent). We keep the date and the place where you gave your consent.

Every email has an unsubscribe link for its category, and you can change both choices at any time in your Profile under "Email Preferences". We record when you click a link in these emails, and the answers you give to the surveys, to understand which emails are useful. Login codes and daily study reminders are sent separately and are not affected by these choices.

We employ multiple layers of security to protect your data:

Data Storage

• Documents - Stored in secure, S3-compatible object storage (MinIO)
• Vector Embeddings - Stored in a dedicated vector database (Qdrant) for semantic search capabilities
• User Data - Stored in encrypted MySQL databases
• Session Data - Cached in Redis with automatic expiration

Security Measures

• All data transmitted over HTTPS with TLS 1.2+ encryption
• Passwordless authentication eliminates password-related vulnerabilities
• Magic link codes expire after 15 minutes
• JWT tokens for secure session management
• Regular security audits and monitoring
• Access controls and principle of least privilege
• Our staff does not access or read user data unless required for security investigation, legal compliance, or with the user's explicit prior consent

We retain your data for the following periods:

• Account Information - Retained while your account is active and for up to 90 days after account deletion request, before being permanently erased.
• Study Materials - Documents, web links, generated Q&A pairs, and related project data are retained for up to 3 years from creation, or until you delete the item, whichever is sooner. Study session and study plan history is retained for up to 1 year. These retention periods are the same for all users regardless of which access pack was purchased.
• Vector Embeddings - Deleted when the corresponding source material is removed.
• Usage and Analytics Data - Aggregated and anonymized data may be retained indefinitely for service improvement.
• Payment Records - Retained as required by law for tax and accounting purposes (typically 7 years).

Upon account deletion, we retain your account data for 90 days (to prevent abuse of free-trial offers via re-registration with the same email) before permanently deleting or anonymizing it, except where we are required to retain it for legal purposes.

Depending on your location, you may have the following rights regarding your personal data:

GDPR Rights (EEA/UK Residents)

• Right of Access - Request a copy of your personal data
• Right to Rectification - Correct inaccurate or incomplete data
• Right to Erasure - Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability - Receive your data in a machine-readable format
• Right to Object - Object to processing based on legitimate interests
• Right to Restrict Processing - Request limitation of processing in certain circumstances
• Right to Withdraw Consent - Where processing is based on consent

CCPA Rights (California Residents)

• Right to Know - What personal information we collect and how we use it
• Right to Delete - Request deletion of your personal information
• Right to Opt-Out - Opt out of the "sale" of personal information (note: we do not sell personal information)
• Right to Non-Discrimination - Equal service regardless of privacy choices

To exercise any of these rights, please contact us at support@longtermemory.com. We will respond to your request within 30 days.

LongTerMemory is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

For users between 13 and 18 years of age, we recommend using our service under the supervision of a parent or guardian. In the European Union, users under 16 may require parental consent to use our service, depending on their country of residence.

We comply with the Children's Online Privacy Protection Act (COPPA) and will delete any information we discover has been collected from a child under 13.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country.

When we transfer personal data from the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) - EU-approved contract terms that require recipients to protect personal data
• Adequacy Decisions - Transfers to countries with adequate data protection laws as determined by the European Commission
• Data Processing Agreements - Contracts with our service providers that require them to protect your data

We use cookies and similar technologies to operate our service:

Essential Cookies

These cookies are necessary for the website to function and cannot be disabled. They include:

• Authentication tokens (stored in localStorage)
• Session management cookies
• Security cookies to prevent cross-site request forgery (CSRF)

Analytics Cookies

With your consent, we use Google Analytics and PostHog to understand how visitors interact with our platform. These cookies collect information including:

• Pages visited and time spent on pages
• Referral sources
• Device and browser information
• Actions taken in the app, session recordings and error reports (PostHog)

No analytics cookies are set until you click "Accept" in the cookie banner, and you can change your choice at any time via "Cookie Settings" in the footer.

We have enabled IP anonymization to protect your privacy. You can opt out of Google Analytics tracking by installing the browser opt-out add-on or using browser privacy settings.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last updated" date at the top of this policy
• For significant changes, we will notify you by email or through a prominent notice on our platform
• We encourage you to review this policy periodically to stay informed about how we protect your data

Your continued use of our service after any changes indicates your acceptance of the updated policy.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

LongTerMemory integrates with Google Workspace (Google Drive) to allow users to import study materials directly from their Drive files. Our use of data obtained through Google Workspace APIs is strictly limited to the following:

• Providing the service — reading files you explicitly select in order to generate question-answer pairs and study materials within LongTerMemory.
• Security and error detection — detecting and preventing security threats, abuse, or technical issues in our application.

We do not:

• Use Google user data for advertising or for creating advertising profiles.
• Transfer Google user data to third parties except as necessary to provide or improve the service, or as required by law.
• Allow humans to read Google user data unless you have given explicit consent, it is necessary for security purposes, or it is required by law.

Data obtained from Google Workspace APIs is used solely to deliver the functionality you request and is not used for any secondary purpose inconsistent with the Limited Use requirements described in the Google API Services User Data Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related inquiries, you also have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.