Privacy Policy

This Privacy Policy for Lodekeep LLC("we", "us", or "our") describes how and why we collect, store, use, and share your personal information when you use Lodekeep. Lodekeep is a persistent, curated memory service for AI assistants: you capture information once through an MCP-connected surface (Claude, ChatGPT, Cursor, Grok, Gemini, or any MCP client) and recall it across your assistants. You control what is stored and can export or delete your data at any time. If you do not agree with this policy, please do not use the service. Questions? Contact us at [email protected].

1. Information we collect

• Account data.Email address, name (optional), and a salted password hash (scrypt; we never store or see your plaintext password), plus contact or authentication data such as API keys and session tokens. If you sign in with Google, we receive your email and profile name from Google (see "Social logins" below).
• User-generated content (memory notes and data). The notes, decisions, and context you (or an agent acting on your behalf) explicitly capture, plus the project name, type, tags, and platform you captured them from. This is the core product data and the most sensitive category: treat anything you capture as data that leaves your machine (see "Subprocessors" below).
• Usage and billing data. Your subscription tier, usage meters, persona/project configuration, and billing identifiers (Stripe customer ID, subscription ID, invoice history). We do not store your card number; all payment data is handled and stored by Stripe.
• Automatically collected data. Log and usage data (IP address, browser and device characteristics, operating system, referring URLs, timestamps, and information about how you use the service), device data, and coarse location data derived from your IP address. This is used to maintain security and operation and for internal analytics.

We do not process sensitive personal information (such as racial or ethnic origin, health, or biometric data), and we do not collect personal information from third parties.

2. How we use your information

• To create and authenticate your account and keep it in working order.
• To deliver the service: store your memory, generate embeddings, and recall relevant notes back to you across sessions.
• To fulfill and manage your orders, payments, and subscription.
• To respond to your inquiries and provide support.
• To send administrative information, such as changes to our terms and policies.
• To send marketing and promotional communications in line with your preferences; you can opt out at any time.
• To protect our services, including fraud monitoring and prevention, and to identify usage trends so we can improve.
• We do not sell your data, and we do not use your captured memory content to train any AI model.

3. Legal bases (EU/UK)

If you are in the EU or UK, the GDPR requires us to explain the legal bases we rely on. We process your personal information under one or more of: consent (which you can withdraw at any time); performance of a contract (to provide the service you request); legitimate interests (to secure the service, prevent fraud, analyze usage, and improve the product, where those interests are not overridden by your rights); and legal obligations. If you are in Canada, we rely on your express or implied consent, with the limited legal exceptions permitted under applicable law.

4. Subprocessors: who else touches your data

We are honest about this because it matters: your memory content leaves our servers and is processed by the third parties below. We do not run our own embedding model or vector database; the product is built on top of these providers, each under a contract designed to safeguard your information.

• OpenAI(AI service provider). Memory content you capture is sent to OpenAI's embeddings API to generate the vector representation used for recall.
• Pinecone (cloud vector storage). The resulting vectors, in a namespace scoped to your account, so your memory can be searched and recalled.
• Contabo (cloud hosting). Our primary PostgreSQL database and the encrypted offsite backup mirror run on server infrastructure we rent from Contabo and operate ourselves. It holds your account data and memory content. Every offsite backup copy is encrypted (AES-256) before it leaves the primary server.
• Stripe(invoicing and billing). All subscription billing and card payments are handled entirely by Stripe. We never see or store your raw card number. Stripe's privacy notice: stripe.com/privacy.
• Resend (transactional email). Address verification, password reset, billing receipts, and account notices are delivered through Resend, which processes your email address and message contents.
• Google (sign-in). If you choose to sign in with Google, Google processes your authentication and shares your email and profile name with us.
• Umami (privacy-first analytics) and Sentry (error monitoring). Used to understand aggregate usage and diagnose crashes. Umami is cookieless and does not track you across sites.

We may also share information in connection with a business transfer (such as a merger, acquisition, or sale of assets). Our Standard Contractual Clauses and details of our third-party safeguards can be provided on request.

5. AI-based products

Lodekeep offers features powered by artificial intelligence and machine learning. We provide these through third-party AI service providers, currently OpenAI. Your input, output, and associated personal information are shared with and processed by these providers to enable your use of the AI features. All such processing is handled in line with this Privacy Policy and our agreements with those providers.

6. Cookies and local storage

We keep you signed in with one first-party session cookie, cmm_session (HttpOnly, so page scripts cannot read it), plus a small first-party CSRF cookie, cmm_csrf, that protects against cross-site request forgery. These are essential to the service. We do not use third-party advertising or ad-targeting cookies, and we do not sell or share your information for behavioral advertising. For product analytics we use Umami, which is privacy-first and cookieless. Most browsers accept cookies by default; you can set yours to remove or reject them, though this may affect essential features.

7. Social logins

You may register or sign in using your Googleaccount. If you do, we receive limited profile information from Google, typically your name and email address, and use it only for the purposes described in this policy. We do not control, and are not responsible for, Google's own use of your information; review Google's privacy policy to understand their practices.

8. Data retention

Paid memory is kept for as long as your account exists. Free memory is a 30-day window, then deleted along with its vector:

• Free: 30 days, then deleted
• Pro, Max, and Team: kept for as long as your account is active

Account and billing records are kept while your account is active, plus a limited period afterward where required for tax, accounting, or fraud-prevention purposes. Deleting your account (below) removes your memory, projects, and billing records ahead of that schedule.

9. International data transfers

Our servers are located in the United States, and your information may be transferred to, stored, and processed by us and our subprocessors in the United States and other countries. For transfers of personal information from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and equivalent safeguards with our providers to protect your data in accordance with applicable law.

10. Security

Passwords are hashed (never stored in plaintext), all traffic is served over HTTPS, and every account's data is scoped so one customer cannot read another's memory, projects, or billing records. No system is perfectly secure. If you believe you have found a vulnerability, contact us before disclosing it publicly.

11. Children's privacy

This service is not directed at, and is not intended for, anyone under 18. We do not knowingly collect data from anyone under 18; account creation requires confirming you are 18 or older. If you believe we have collected data from a minor, contact us at [email protected].

12. Your privacy rights

You control your data directly, without waiting on a support ticket:

• Access and export. From Settings you can download every memory entry and project you have as a single JSON file.
• Deletion. The same Settings page lets you permanently erase your account: every memory entry, its vector, every project, and every billing record, with a typed confirmation. This cannot be undone.
• Correction. You can edit your name and re-capture or delete individual memory entries at any time.

Depending on where you live, you may have additional rights under laws such as the GDPR (EU/UK), Switzerland's FADP, Canada's PIPEDA, and US state privacy laws (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia). These include the right to know, access, correct, delete, obtain a copy of, and opt out of certain processing of your personal information, and to non-discrimination for exercising your rights. We do not sell personal information or use it for targeted advertising. To exercise a right that is not already self-service, or to appeal a decision, contact us at [email protected]. We will verify your request and respond in accordance with applicable law. EU/UK residents may also lodge a complaint with their supervisory authority.

13. Do-Not-Track

Because there is not yet a uniform industry or legal standard for recognizing Do-Not-Track (DNT) signals, we do not currently respond to them. If a standard is adopted that we must follow, we will update this policy.

14. Changes to this policy

We may update this policy as the product changes. Material changes will be reflected by updating the date at the top of this page, and where appropriate we will notify you directly.

15. Contact

Questions about this policy? Email [email protected] or write to us at:

Lodekeep LLC
8735 Dunwoody Pl, Ste 12513
Atlanta, GA 30350
United States