Privacy Policy

Last updated: October 2, 2026.

This Privacy Policy explains how xmemory Inc. ("xmemory", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use our website, console, APIs, OAuth flows, and related services.

Information You Provide

When you submit a form, create an account, contact us, or use xmemory services, we may collect information you provide, such as your name, work email, organization, role, use case, support messages, and the content or configuration you choose to store in xmemory.

We use this information to respond to requests, provide and improve xmemory services, operate customer accounts, provide support, maintain security, and communicate about xmemory products, services, and onboarding options.

Data Minimization

xmemory is a first-party memory store for the data you choose to save. We store and process only the content that you, or an agent acting on your behalf, explicitly send to your xmemory instance. We do not ingest your full chat transcripts, conversation history, files, email, or cloud drives, and our connectors and APIs do not request access to them. You decide what is written to xmemory, and you can review, export, or delete it at any time (see Retention and Deletion below).

Google OAuth and Google User Data

If you sign in to the xmemory console or connect an xmemory OAuth flow using Google, we access Google user data only for authentication, account setup, account linking, access control, and security. The Google user data we may access includes your Google account email address, name, profile image, Google account identifier, email verification status, hosted domain or organization information when Google provides it, and OAuth tokens or authentication assertions needed to complete and maintain the sign-in or authorization session.

We use Google user data to verify your identity, create or locate your xmemory account, display the signed-in user in the console, associate your session with the correct workspace or organization, prevent unauthorized access, troubleshoot authentication issues, and maintain audit and security records. We do not use Google user data for advertising, sell Google user data, or use Google user data to train general-purpose AI models.

Unless a separate integration clearly asks for additional permission and you grant it, xmemory does not access the contents of your Gmail, Google Drive, Google Calendar, Google Docs, or other Google workspace content through Google OAuth. If we add a Google integration that requires additional Google API scopes, we will request only the scopes needed for that integration and explain the purpose before you authorize it.

How We Share Information

We do not sell personal information or Google user data. We may share information with service providers that help us operate xmemory, such as cloud hosting, database, security, analytics, logging, communications, and customer support providers. These providers are allowed to process information only to provide services to xmemory and must protect it under appropriate contractual obligations.

We may also disclose information if required by law, legal process, or government request; to protect the rights, safety, and security of xmemory, our users, or others; or as part of a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and data protection safeguards.

Storage and Protection

We use technical and organizational safeguards designed to protect personal information and Google user data, including access controls, encryption in transit, encrypted storage where appropriate, monitoring, least-privilege internal access, and operational security procedures. OAuth tokens, if issued to us, are stored securely and used only for the authorized authentication or integration purpose.

No method of transmission or storage is perfectly secure, but we work to protect information against unauthorized access, loss, misuse, alteration, and disclosure.

Retention and Deletion

We retain personal information and Google user data only for as long as needed to provide services, maintain accounts and security records, comply with legal obligations, resolve disputes, enforce agreements, and keep legitimate business records. Authentication logs and audit records may be kept for security and compliance purposes for a limited period.

Cookies are kept by your browser rather than by us, and each has its own period. The record of your cookie choice lasts 365 days, which a later visit does not extend; where you made that choice in the xmemory console, this website counts the 365 days from when it first saw it. The Mixpanel cookie that this website and the xmemory console share also lasts 365 days, but that period starts again on every later visit you make with analytics enabled, so for a visitor who returns at least once a year it does not lapse on its own. Google Analytics sets its own cookies, for periods Google determines. Clearing the cookies and site data your browser stores for xmemory.ai removes all of them; withdrawing your choice through the “Your privacy settings” link re-opens the question rather than removing the Mixpanel cookie, which goes if you then reject non-essential cookies.

You can request access, correction, export, or deletion of your personal information, including Google user data associated with your xmemory account, by contacting privacy@xmemory.ai. We will respond to deletion requests in accordance with applicable law and will delete or de-identify information unless we must retain it for legal, security, anti-fraud, or legitimate business record purposes.

Cookies and Similar Technologies

We use essential cookies and similar storage technologies to run the website and services, maintain security, remember your cookie consent preference, and support core functionality such as session handling.

Analytics cookies are optional and are only enabled when you consent. When you accept them, we use Google Analytics 4 to understand how visitors use the site, including page views, navigation patterns, documentation engagement, chat interactions, and form submission outcomes, and Mixpanel to understand how the xmemory product is used. We configure analytics to avoid advertising use and do not enable analytics cookies before consent.

Google may process technical information such as your IP address, device/browser details, pages viewed, approximate location derived from IP, and interaction events that we send from the site after consent. The cookie banner asks you once whether to accept or reject non-essential cookies and records that choice. To change or withdraw it afterwards, follow the “Your privacy settings” link in the footer of this site's main pages (the home, about, why, product overview, pricing and chat demo pages) and in the footer of the documentation pages: it withdraws the recorded choice on this website and the xmemory console together, and asks you again. On the page you use it, analytics stops at once. The withdrawal removes the shared choice cookie that this website and the console both read, together with the copy of your choice this website keeps in your browser; with no choice left to find, each treats that as no consent — so a tab you already have open elsewhere stops when you next bring it to the front, when your browser restores it, or when it next tries to send something, whichever happens first; reloading such a tab stops it straight away. Clearing the cookies and site data your browser stores for xmemory.ai has the same effect, and is the way to do it with JavaScript turned off.

Mixpanel receives product usage events together with the identifiers of the user and the company account they belong to, so that we can measure product analytics such as feature adoption and where people encounter problems. It also records session replays of product interactions, in which text you enter and the content shown to you are masked before the replay is sent. Mixpanel processes this data in the United States. Your choice in the cookie banner applies to both this website and the xmemory console.

Mixpanel also runs on this website itself, whether or not you already have an xmemory account. From a consented visit it collects the pages you view and how you navigate the site, together with the website you came from. Campaign parameters are read once and not again: the address of a later page you view is not searched for them, and none of them is attached to the events that page sends. The campaign parameters carried in the address of the page that was open when analytics was enabled for that visit, taken as that page was loaded rather than as its address stood by the time you answered the banner, are kept as your first touch: against your profile, and stored in a cookie for 365 days, counted again from each later visit you make with analytics enabled rather than from the visit that carried them, and shared with the xmemory console at console.xmemory.ai, which reads that same cookie. If that page carried none, the first campaign parameters seen on a later consented visit are kept instead; a visit through a different campaign after that does not replace them, and a page that carries no campaign parameters of its own is recorded with none. Signing out of the xmemory console clears the cookie the two properties share, so a campaign seen after that sign-out is recorded as the first touch on your events from then on; the copy kept against your profile still holds the original. We keep both records, and where they disagree the copy kept against your profile is the one we treat as your first touch. The page recorded as your first touch is kept under the same rules as the campaign above, and is the one that was open when analytics was enabled, at the address that page was loaded on: if you had browsed other pages before accepting, it is the page you accepted on rather than the one you first arrived at, and if that page's address had changed by the time you answered the banner, the address it was loaded on is the one kept. This website records only the name of the site you came from, not the address of the page on it; where your browser is already carrying a referring address in the record the two properties share, that address may be attached to your profile; neither property adds one. Mixpanel also receives technical information about your device and browser and approximate location derived from your IP address, in the same way Google does. This website shares its Mixpanel identifier with the xmemory console, so if your browser already carries it from a previous console sign-in, this visit may be linked to that account immediately; if not, and you later create an xmemory account, the visit may be linked to the account it led to, so the site you came from, the page, and the campaign recorded when analytics was enabled can be attributed to it.

International Processing

We may process and store information in the United States and other countries where we or our service providers operate. Where required, we use appropriate safeguards for international transfers.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and provide additional notice where required.

Contact

For privacy questions, rights requests, or data deletion requests, contact privacy@xmemory.ai.