Memoriia was designed with privacy as an architectural principle, not a regulatory requirement. We don't sell data. We don't show advertising. We don't share your information with third parties for any commercial purpose. This policy explains with total transparency what we do with your data and why.
1. Identity of the Data Controller
| Company | Bremen Core LLC |
| Jurisdiction | State of Wyoming, United States |
| Product | Memoriia (WhatsApp-based reminder platform) |
| Contact / DPO | contact@memoriia.io |
| EU Representative | To be designated pursuant to Art. 27 GDPR if thresholds are exceeded. Contact enabled at contact@memoriia.io. |
Bremen Core acts as Data Controller (Controller under GDPR/UK GDPR, Controlador under LGPD) for data collected directly through Memoriia, and as Data Processor regarding the content that the User voluntarily enters into the service.
2. Key Definitions
| Term | Definition |
|---|---|
| Personal data | Any information that identifies or makes identifiable a natural person. |
| Processing | Any operation on personal data: collection, storage, use, transmission or deletion. |
| Sub-processor | Authorized external provider that processes data on behalf of Bremen Core under contract with equivalent guarantees. |
| Guardian | Third party designated by the User to receive automated notifications in escalation protocols. |
| Biometric data | Data derived from physiological characteristics of the human body: heart rate, ECG, temperature, accelerometer. |
| Location data | GPS coordinates or equivalent that allow determining the physical location of a person in real time. |
3. Categories of Personal Data Processed
| Data | Description |
|---|---|
| Phone number | Primary identifier. Linked to the WhatsApp account. Mandatory for the service. |
| Reminder content | Free text, transcribed audio or images sent to Memoriia. Entirely controlled by the User. |
| Guardian | Name and number of a voluntarily designated third party. See §9. |
| Preferences | Language, time zone, settings, contracted plan. |
| Data | Retention |
|---|---|
| Interaction metadata | Date/time of messages and confirmations. Until cancellation. |
| System logs | Technical logs. Anonymized after 90 days. |
| Audit data | System action log. Up to 12 months. |
Card data is processed exclusively by Stripe, Inc. (PCI-DSS Level 1). Bremen Core never receives, stores or processes payment method data.
3b. Biometric and Geolocation Data — Special Regime
Using Memoriia's biometric monitoring and geolocation system (Smartwatch and Safe zone features) involves processing special categories of data that require enhanced protection under the laws of every country where we operate. This data is processed exclusively with the User's explicit, free, informed, unambiguous and revocable consent.
Memoriia may receive from the User's smartwatch: heart rate (BPM), electrocardiogram (ECG), body temperature, accelerometer data (fall detection) and physical activity patterns.
The Safe zone feature (for the care of older adults with Alzheimer's or other conditions) uses GPS coordinates from the monitored family member's device. Memoriia may also store the main User's last location for biometric emergency protocols (Level 3).
4. Processing Purposes and Legal Basis by Jurisdiction
| Purpose | GDPR (EU) | LGPD (BR) | CCPA (CA) |
|---|---|---|---|
| Provide the reminder service | Art. 6.1.b | Art. 7-II | Business |
| Execute escalation protocol | Art. 6.1.b | Art. 7-V | Business |
| Biometric and GPS monitoring | Art. 9.2.a | Art. 11-I | Opt-in |
| Safe zone | Art. 9.2.a | Art. 11-I | Opt-in |
| Subscription and billing management | Art. 6.1.b | Art. 7-II | Business |
| Security and fraud prevention | Art. 6.1.f | Art. 7-IX | Business |
| Compliance with legal obligations | Art. 6.1.c | Art. 7-II | Legal |
| Service improvement (anonymized) | Art. 6.1.f | Art. 7-IX | Business |
| Marketing communications (opt-in) | Art. 6.1.a | Art. 7-I | Consent |
5. Principles Governing Processing
① Minimisation: We only collect data strictly necessary for the service to work.
② Purpose limitation: Data collected for one purpose is not used for others without new consent.
③ Accuracy: We give the User the means to correct their data at any time.
④ Integrity and confidentiality: Technical and organisational measures to protect data against unauthorised access.
⑤ Accountability: Bremen Core keeps records of processing (ROPA) and can demonstrate compliance to regulatory authorities.
⑥ Privacy by Design: Privacy is built into the system architecture, not added as an afterthought.
6. Technical and Organizational Security Measures
| Measure | Description |
|---|---|
| Encryption in transit | TLS 1.3 for all communications between the User, WhatsApp and Memoriia's servers. |
| Encryption at rest | AES-256 for the data stored in the database. |
| Credentials | Access credentials for services are stored encrypted and rotated when necessary. |
| Restricted access | Your reminders are stored in our database, encrypted in transit and at rest. Access is restricted to Memoriia's technical lead and is only used to fix service problems. We do not sell, share or analyze your reminders for commercial purposes. |
| No database access | No User accesses the database directly: everything goes through WhatsApp and the Memoriia system. |
| Rate limiting / Redis | Protection against brute force, flooding and automated abuse. |
| Audit | We log system operations for auditing and troubleshooting. |
| Copies and deletion | What you ask us to delete is erased and is not kept in any copy. Data that is no longer needed is deleted automatically. |
In the event of a security incident, Bremen Core will notify affected Users and regulatory authorities within the applicable legal deadlines (72 hours under GDPR; equivalent deadlines under other regulations).
7. Sub-processors and Third-party Providers
| Provider | What for | What data it sees | Country |
|---|---|---|---|
| Meta Platforms (WhatsApp Business) | All messages and calls over WhatsApp | Phone number and message content | USA / Global |
| Supabase | Database | All account data and reminders | USA / UE |
| Telnyx | Phone calls and the voice that reads them | Phone number and the text converted to voice | USA |
| Anthropic (Claude) | Understanding what you write. Not used for training. | The message text | USA |
| OpenAI (Whisper) | Turning voice notes into text. Not used for training. | The audio sent | USA |
| Calendar and Maps (health centers in an emergency) | Calendar events; coordinates only during an alert | USA / Global | |
| Stripe | Payments (PCI-DSS Level 1) | Billing data. Memoriia never sees the card. | USA / UE |
| DigitalOcean | Our own servers (three, in New York) where the system and the call center run | All data the system processes | USA (New York) |
Bremen Core may disclose data if a competent judicial or regulatory authority requires it through a valid legal order. In such a case, we will notify the User to the fullest extent permitted by law.
8. International Data Transfers
| Jurisdiction | Mechanism |
|---|---|
| EU / UK | Standard Contractual Clauses (SCCs 2021/914) + UK IDTA. DPIA available upon request. |
| Brazil | Countries with adequate level or clauses compliant with Art. 33 LGPD. |
| Argentina | Pursuant to DNPDP Provision 60-E/2016 (Law 25.326 Art. 12). |
| Mexico | Contractual clauses compliant with Art. 36 LFPDPPP. |
| SE Asia (ID/TH) | Compliant with Thailand PDPA (2019) and Indonesia UU PDP. Prior explicit consent. |
9. Third-Party Data — Guardian
By designating a Guardian, the User declares and guarantees that:
· They have previously informed the third party about the Memoriia service and the nature of the notifications they may receive.
· They have obtained the third party's explicit consent to receive automated communications.
· The third party can request deletion of their data by writing to contact@memoriia.io.
What your guardian receives: your name, the details of the reminder you didn't confirm (for example, the medication) and the time. If you use a watch, also your location and the three nearest health centers. They only receive alerts about critical matters: your medication and your safety. We explain this before you designate anyone, so you know what will be shared.
You can remove them anytime: once removed, they stop receiving alerts immediately.
Your guardian has rights too: you entered their data (name and phone), and they can ask us to delete it at any time.
10. Data Retention Periods
| Category | Period |
|---|---|
| Active account data | During the active subscription |
| Data after cancellation | 90 days (reactivation) |
| Reminder content | Permanent deletion at 90 days |
| Biometric and GPS data | Immediate deletion upon deactivating the service or within 30 days of cancellation |
| Audit logs | Up to 12 months (legal obligation) |
| Billing data | 5–7 years (tax regulations) |
| Rights requests (DSAR) | 3 years (compliance proof) |
| Guardian data | Deleted when account or settings are deleted |
11. Data Subject Rights
Exercisable by writing to contact@memoriia.io. Response within a maximum of 30 business days (15 days under LGPD).
Request what data we hold, how we use it and who we share it with.
Correct inaccurate, outdated or incomplete data.
Complete deletion within 30 days, except where legally required to retain.
Receive data in structured format (JSON/CSV) to transfer it.
Object to processing based on legitimate interest.
Withdraw consent at any time, without retroactive effect.
Exercising rights does not affect the quality or price of the service.
Request human intervention in significant automated decisions.
12. Artificial Intelligence and Automated Decisions
Memoriia uses AI models to interpret the natural language of reminders. Data sent to the models is not used to train them. No decisions with legal effects on the User are made based solely on automated processing. All text messages are processed with Claude (Anthropic) and voice notes with Whisper (OpenAI): it is not possible to use Memoriia without this processing. If you don't agree, you can ask for your account and data to be deleted at any time.
13. Cookies and Tracking Technologies
The memoriia.io website uses technical cookies needed for it to work, plus two measurement tools: Google Analytics, to learn in aggregate how many people visit the site, from which country and which pages they view; and the Meta pixel, to measure the results of our ad campaigns. Neither identifies visitors by name, nor has access to the User's reminders, messages or health data, which are processed exclusively over WhatsApp and never go through the website. You can block these tools in your browser settings or with any blocking extension without affecting your use of the service. The main service runs over WhatsApp and does not use cookies.
14. Protection of Minors
Memoriia is not intended for people under 18. If we become aware that we have processed a minor's data without verifiable parental consent, we will notify the parents or guardians, delete all data immediately and irreversibly, and cancel the account free of charge. When a parent or legal guardian sets up a minor's watch, they declare that they are and give consent on the minor's behalf. Contact: contact@memoriia.io
15. Supervisory Authorities by Jurisdiction
| Country / Region | Authority |
|---|---|
| EU | Member State supervisory authority (AEPD, CNIL, BfDI, etc.) |
| UK | Information Commissioner's Office (ICO) — ico.org.uk |
| Brazil | National Data Protection Authority (ANPD) |
| Argentina | Public Information Access Agency (AAIP) |
| Mexico | National Transparency Institute (INAI) |
| California | California Privacy Protection Agency (CPPA) |
| Indonesia | Ministry of Communication and Digital (Komdigi) |
16. Updates to this Policy
Material changes will be notified via WhatsApp at least 15 days in advance. Non-material changes may apply without prior notice. Continued use of the service implies acceptance of the updated Policy.