Privacy Policy · Remembrall

This policy explains what personal data Remembrall collects when you use the web app and the browser extension, why we use it, who we share it with, how long we keep it, and the rights you have.

1.Who is responsible for your data

[COMPANY NAME] AB (Remembrall), organisation number [ORG NUMBER], [STREET ADDRESS], [POSTCODE] [CITY], Sweden, is the controller of the personal data described in this policy. This means we decide why and how it is used.

[To be drafted/approved by counsel: Whether we need a separate privacy contact address or a Data Protection Officer, and whether we need a representative in the UK (or elsewhere) because we sell to consumers there.]

2.What data we collect

Account data

Your name, email address and profile picture (from signing in with Clerk), your time zone, your plan, and your progress through getting started.

Content you add

What you capture and create: web pages, selected text, social posts and videos captured with the extension, with their address (URL), title, site icon and thumbnail; notes you write and files you upload; any instructions you give for how content should be summarised or turned into cards; and what we generate from your content, namely summaries, study cards and the data we use to find related captures.

Study data

Your study sessions and answers: which cards you studied and when, how long you spent, whether you answered correctly, the text of your open-ended answers with the AI’s score and feedback, your review schedule and snoozes, and the points (XP) you earn.

Billing data

Your payment details are collected and held by Stripe and Link, not by us, and we never see your full card number. We keep what we need to run your subscription: your plan, the status of your subscription, and a customer reference from Stripe.

Usage and technical data

How much of your plan’s allowance you use (daily credits and AI usage), and technical logs created when you use the service, such as IP address, browser and device information, and error reports.

[To be drafted/approved by counsel: Exactly what our logs and our providers’ logs contain (Vercel, Railway, Clerk), and whether any analytics or error-monitoring tool is used.]

Data from the browser extension

When you capture something with the extension, it sends us the content you chose to capture, with the page’s address, title and icon. The extension also keeps your sign-in token and a short history of your recent captures in your browser’s local storage.

[To be drafted/approved by counsel: Exactly what the extension reads on pages you visit without capturing anything (its companion-card script runs on every page), and whether anything from those pages is sent to us. This must match the extension’s store listing and privacy disclosures.]

Other people’s data in your captures

[To be drafted/approved by counsel: Our role and legal basis for personal data about other people that appears in content you capture (for example names in articles or social posts), and what we ask of users about it.]

3.Why we use your data, and our legal bases

Purpose	Data	Legal basis (GDPR)
Providing the service: storing and organising your captures, generating summaries and study cards, scheduling reviews and running study sessions	Account, content, study and extension data	Contract (art. 6(1)(b))
Running your subscription and applying your plan’s limits	Account, billing and usage data	Contract (art. 6(1)(b))
Keeping billing records for bookkeeping and tax	Billing data	Legal obligation (art. 6(1)(c))
Keeping the service secure, preventing abuse and fixing errors	Usage and technical data	Legitimate interest (art. 6(1)(f))
Anything we ask your permission for: [To be drafted/approved by counsel: which processing, if any, is based on consent]	Depends on what you agree to	Consent (art. 6(1)(a)), which you can withdraw at any time

[To be drafted/approved by counsel: Confirmation of each purpose and legal basis; the legitimate-interest assessments; what, if anything, is based on consent (for example non-essential cookies, emails or notifications); and whether any other purposes apply (analytics, product improvement, marketing).]

4.AI processing

To provide the AI features, we send content to Google’s Gemini API:

the content you capture, to write summaries and generate study cards;
the question and your answer, to grade open-ended answers and give feedback; and
your captures, to create numerical representations (embeddings) that let us find related captures.

Google processes this content on our behalf and returns the result to us. The AI does not make decisions about you with legal or similarly significant effects: what it produces is study material and feedback for you.

[To be drafted/approved by counsel: Google’s role and terms for the Gemini API tier we use, including whether content may be used to train or improve Google’s models and how long Google keeps it; where the processing takes place; and approval of the statement about automated decision-making.]

5.Who we share data with

We use the service providers below. Unless stated otherwise, they process personal data on our behalf, as processors.

Provider	What they do	Data involved
Clerk	Sign-in and authentication	Account data, sign-in and session data
Stripe / Link	Payments. A processor for payment processing, and an independent controller for its own fraud prevention and legal compliance.	Billing data
Google (Gemini API)	AI processing of content you capture	Content you add, open-ended answers
Vercel	Hosting of the web app	Data passing through the web app, technical data
Railway	Hosting of our API and database	All data we store
Redis	Background-job queue and rate limiting	[To be drafted/approved by counsel: confirm Redis is hosted on Railway, and what personal data (if any) it holds]

[To be drafted/approved by counsel: Confirmation that a data processing agreement is in place with each provider; Stripe’s and Link’s roles given that Link is the merchant of record (including whether Link is also an independent controller for the sale itself), with links to their privacy notices; and any other recipients (authorities where the law requires it, professional advisers, a buyer if the business is sold).]

6.International transfers

Some of our providers are based in, or process data in, the United States. For those transfers we rely on the EU-US Data Privacy Framework, where the provider is certified under it, and on the European Commission’s Standard Contractual Clauses (SCCs).

[To be drafted/approved by counsel: For each provider: where data is processed, which transfer mechanism applies (Data Privacy Framework certification or SCCs, and any supplementary measures), how users can get a copy of the SCCs, and the equivalent mechanisms for UK users.]

7.How long we keep data

Data	How long we keep it
Account data, content you add, study data	Until you delete it, or until you delete your account
Billing records	7 years, as the Swedish Bookkeeping Act (bokföringslagen) requires; 10 years where the EU One-Stop-Shop (OSS) VAT rules apply
Usage and technical logs	A short period: [To be drafted/approved by counsel: exact retention periods for each kind of log]
Data held by Stripe and Link	Under their own retention policies

[To be drafted/approved by counsel: How long deleted data stays in backups; which billing records we hold ourselves, given that Link is the merchant of record; and whether inactive free accounts are deleted after a period.]

8.Your rights

Under the GDPR you have the right to:

access your personal data and get a copy of it;
rectification: have inaccurate data corrected;
erasure: have your data deleted;
portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another service;
object to processing based on our legitimate interests;
restriction: ask us to limit how we use your data in some situations; and
withdraw any consent you have given, at any time.

Some of these rights have exceptions. For example, we must keep billing records for as long as the law requires, even if you ask us to delete them.

How to use your rights

Email us at [SUPPORT EMAIL]. We may need to confirm your identity first. We reply within one month; if a request is complex we may extend this by up to two more months, and we will tell you why.

[To be drafted/approved by counsel: Self-service routes (in-app data export and account deletion), how we verify identity, and approval of this section.]

Complaints

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se. You can also complain to the data protection authority in the country where you live or work. We would like the chance to put things right first, so please contact us too.

9.Children

If you live in Sweden, you must be at least 13 years old to use the free service. Other countries may set a different minimum age.

To buy a paid plan you must be 18 or older, or have permission from a parent or guardian.

If you believe a child has given us personal data without the permission they needed, contact us at [SUPPORT EMAIL].

[To be drafted/approved by counsel: Minimum ages in other countries and how we apply them (for example an age question at sign-up); what we do with data from a child below the minimum age; and whether a parent’s or guardian’s permission has to be verified.]

10.Cookies and local storage

We use a small number of cookies and similar technologies:

cookies set by Clerk that keep you signed in to the web app;
your theme choice (light or dark), stored in your browser’s local storage; and
in the browser extension, your sign-in token and recent capture history, stored in the extension’s local storage.

[To be drafted/approved by counsel: A full inventory of cookies and local storage (name, provider, purpose, duration) for the website, web app and extension, including anything set by Stripe checkout or our hosting providers; whether any of them are not strictly necessary and so need consent under the Swedish Electronic Communications Act (lagen om elektronisk kommunikation); and whether a cookie banner is needed.]

11.Security

Data travels between your browser, the extension and our servers over encrypted connections (HTTPS). Every request to our API is checked against your signed-in account, and your data is returned only to you.

[To be drafted/approved by counsel: A description of our security measures that matches what is actually in place (encryption at rest, staff access, backups, incident response and personal data breach notification).]

12.Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change significantly affects you, we will tell you.

[To be drafted/approved by counsel: How and how far in advance we tell users about significant changes (email, in-app).]