Memoto Privacy Statement
Version 2.3, 2 September 2026What changed
This statement covers memoto.nl and the Memoto web app at app.memoto.nl: what we keep about you, why, for how long, who else sees it and what you can arrange yourself.
This statement was drafted in Dutch. The Dutch text is the binding version; this English translation is provided as a service.
In short
This is the short version. Everything below it is explained in the chapters that follow.
- Your journal lives in Europe, and is processed there too. What you write, your photos, your videos and your mementos are stored in Frankfurt, Germany. Since 1 September 2026 the servers that run the app are there as well.
- To create your companion's messages and mementos, your text goes to an AI provider in the United States (Anthropic). For the read-aloud voice, only the generated message goes to ElevenLabs, also in the US. That is the most important sentence of this entire statement — which is why it is at the top.
- No AI model is trained on what you write.
- We do not sell your data. Our business model is your subscription. There is no advertising code in Memoto.
- Inside the app, behind your sign-in, nothing is measured. On the public site memoto.nl we use Google Analytics, and only if you first say yes. Before that yes, not a single request leaves for Google.
- No human reads along by default. Only if you ask for help yourself, or in the event of a concrete security incident.
- Your coach never sees what you write.
- Because what you write is about you, we apply the strictest rules and ask your separate, explicit consent for it. You can withdraw that consent at any time; because Memoto cannot work without it, withdrawing does mean your account ends (chapter 5).
- You can always get a copy of everything. One button in the app and your whole journal comes out, in a usable format. Free, as often as you like.
- You leave with one button. We delete your account and everything in it immediately, and in any case within 24 hours; shortly after that it also disappears from the security backups.
- Questions or complaints? E-mail privacy@memoto.nl. You may also complain to the Dutch Data Protection Authority (NL) or the Data Protection Authority (BE).
- Memoto exists for motivation and reflection. It is not care, not therapy and not treatment — and that changes nothing about how strictly we handle your data.
1. Who we are and how to reach us
Memoto is a service of Octadex, the sole proprietorship of Ronald Achtien.
| Data controller | Octadex (trading as Memoto) |
| Address | De Tilbarten 49, 9084 CB Goutum, the Netherlands |
| Dutch Chamber of Commerce (KVK) number | 99648156 |
| Trade name as registered with the KVK | Memoto |
| VAT identification number | NL005402523B71 |
| Privacy questions and requests about your data | privacy@memoto.nl |
| All other questions | hallo@memoto.nl |
"Data controller" means: we determine why and how your data is processed, and we are responsible for it.
We have no data protection officer. One is not required for a business of this size. You can direct all your privacy questions to privacy@memoto.nl; that mailbox is read by Ronald himself.
2. Who this statement applies to
This statement applies to everyone who visits memoto.nl and to everyone who has a Memoto account. Memoto is intended for adults aged 18 and over (see chapter 18).
This statement does not cover:
- other people's websites we link to — their own rules apply there;
- what your coach does with what you tell him or her yourself. Your coach is responsible for that. What you write in Memoto never reaches your coach (chapter 6).
3. Which data we process about you
Below is, per category, what we keep and where it comes from. Almost all of it comes from you.
3.1 Account data. Your e-mail address, your first name or preferred name, your language (Dutch or English), your time zone, your display choice (light or dark), the times at which you want a morning and evening nudge, the name and tone you gave your companion, and which read-aloud voice you chose. If you sign in with a password, we store it encrypted, together with the link to your authenticator app; if you sign in with Google or a sign-in link, we hold no password of yours.
3.2 Your answers when getting started (intake). At the start we ask three open questions about what you want to achieve and what motivates you. We store those answers and include them with every request to the AI model, so your companion's messages fit you.
3.3 What you write. Your answers to the three morning questions, your evening reflection with your day score, your weekly reflection with your week score, your moments (title, note, feeling, topics), your events, plans and tasks, and your messages in the conversation with your companion. This is the heart of your journal — and the most sensitive thing we hold about you. See chapter 5.
3.4 Photos and videos. The images you attach to your moments (up to 50 MB per file), including what is technically inside the file (such as the time the picture was taken). We do no facial recognition and we do not analyse the content of your images. We store them in shielded storage and show them to you, nothing more.
3.5 Generated messages and mementos. Your companion's messages, its replies in the conversation and your mementos. They are written by AI based on what you wrote; they are about you and are therefore personal data too. For each message we record which model and which version of our instructions created it — without any journal content needing to be part of that record.
3.6 Audio. The read-aloud version of a message. It is created once and then stored, so listening again costs nothing extra and nothing has to go to the speech provider again.
3.7 Payment and subscription data. Your subscription status, your trial end date, your plan, the end of your current period, your customer and subscription number at Stripe, your payments (the amount, the date and the invoice number) and which friend or coach code you redeemed, if any. The payment itself runs through Stripe. We never see or store your card number — you enter it directly with Stripe.
3.8 Notifications. If you switch on push notifications, we store your browser's push subscription: the technical address a message may go to, with the accompanying keys.
3.9 Mail. A log of which e-mail we sent you, when and to which address — deliberately without the content of that mail. The daily mails contain your companion's message, including text from your journal — and that does not belong stored twice in a delivery log.
3.10 Technical data. Your IP address, browser and device type, error messages and the timing of your requests. These arise automatically when you use the app. We use them to fix outages and to counter abuse.
3.11 Support correspondence. What you e-mail us and what we e-mail back. Note: if you paste a piece of your journal into a mail yourself, it is thereby also in our mailbox. We treat it as carefully as the app itself.
3.12 Friend and coach codes. If you join through the code of a friend or a coach, we store which code you used and when. What the other person gets to see about that is in chapter 9.
3.13 Consent records. Which consent you gave, on which version of the text, when you gave it and when you withdrew it, if ever. We must be able to demonstrate that.
What we do NOT collect: we do not ask for your home address, your phone number, your date of birth or identification. We do not buy data about you from other parties.
4. Why we process your data, and on which legal basis
The law requires us to state, per purpose, why we are allowed to do something. That is below. The "basis" is the legal ground; "art." refers to the articles of the GDPR.
| What we do | Why | Basis |
|---|---|---|
| Creating your account and signing you in | No service without an account | Performance of our contract with you (art. 6(1)(b)) |
| Recording that you declared to be 18 or older | Memoto is not for children | Performance of the contract (art. 6(1)(b)) and our legitimate interest in keeping minors out (art. 6(1)(f)) |
| Storing and displaying your journal, moments, plans and intake answers | This is the service itself | Performance of the contract (art. 6(1)(b)) plus your explicit consent (art. 9(2)(a)) — see chapter 5 |
| Creating your companion's messages, conversations and mementos | This is what you use Memoto for | Performance of the contract (art. 6(1)(b)) plus your explicit consent (art. 9(2)(a)) |
| Creating and storing the read-aloud voice | A core feature of Memoto | Performance of the contract (art. 6(1)(b)) plus your explicit consent (art. 9(2)(a)) |
| Sending your nudges via push or e-mail | So you do not forget your ritual | Your consent (art. 6(1)(a)). You switch them on and off per channel whenever you want |
| Sending service e-mails (your sign-in link, your invoice, changes to the terms) | Part of the subscription | Performance of the contract (art. 6(1)(b)) |
| Handling your payment and subscription | Otherwise we can deliver nothing | Performance of the contract (art. 6(1)(b)) |
| Keeping invoices and records | Tax law requires us to | Legal obligation (art. 6(1)(c)) |
| Fixing outages and improving the technology (error messages, speed) | To keep the app working | Our legitimate interest in a working, reliable app (art. 6(1)(f)) |
| Countering abuse and fraud (too many sign-in attempts, abuse of trials and codes) | To protect your account and our service | Our legitimate interest in the security of your account and of Memoto (art. 6(1)(f)) |
| Measuring visitors of memoto.nl with Google Analytics | To know whether the site does its job | Your consent (art. 6(1)(a)), requested via the cookie banner. If you say nothing or no, nothing is measured. Nothing is ever measured in the app |
| Processing friend and coach codes, granting discounts and paying the coach | To keep the promises of the friends programme and to the coach | Performance of the contract (art. 6(1)(b)) and our legitimate interest in correct settlement (art. 6(1)(f)). The coach never sees content |
| Answering your support question | Because you ask us something | Performance of the contract (art. 6(1)(b)) |
| Executing your rights and being able to prove we did | Privacy law requires us to | Legal obligation (art. 6(1)(c)) |
Where we rely on "legitimate interest", that interest is concrete: an app that works, an account that does not get hijacked, and an honest settlement of trials and discounts. What you write always stays out of those balancing acts. You may object (chapter 13).
Do you have to provide this data? You are not obliged to fill in anything. For an account we only need your e-mail address. But without what you write, your companion cannot create a message or memento for you — then the app does not work. And without payment we cannot deliver a subscription after your trial.
5. What you write is especially sensitive — and this is how we treat it
What this is about. In Memoto you write about your day: what you are working towards, what will be challenging, what you are happy about, how it went. The app never asks about your health, your relationships, your faith or anything of the kind — but in a journal all of that may appear, simply because you write it down.
What privacy law says about that. The law has a separate category of personal data to which the strictest rules apply: special categories of personal data (Article 9 GDPR). These include data about a person's health. According to European case law, information from which such things can be inferred can also fall into that category.
What we do with that. We do not know in advance what you will write, and we do not assess it. So we choose the safe side: we treat everything you write in Memoto as if it falls under that strictest category. That means we put more protection around it than strictly necessary, and that we ask your separate and explicit consent for it.
What this does NOT mean. It does not mean Memoto provides care, and it does not mean we establish anything about your health. We do not and cannot. Memoto exists for motivation and reflection. It makes no diagnosis, passes no judgement on how you are doing and attaches no score to it. The choice to apply the strictest rules is about how we handle your text — not about what Memoto is.
Where you give that consent. When creating your account, in a separate checkbox that is not pre-ticked, separate from agreeing to the terms of service and separate from taking note of this statement. You give that consent for: storing and displaying what you write and add, and for creating your companion's messages, voice and mementos.
How you withdraw it. With the switch under Settings → Your data → Permissions, or by e-mail to privacy@memoto.nl. Withdrawing costs nothing and you do not have to give a reason. We only ask you to confirm it is really you, because a deletion is attached to it.
What happens if you withdraw it — honestly. Without this consent we cannot provide Memoto: there is then no journal to store and no message to write. Withdrawing therefore means your account is terminated and your data deleted. What you did before withdrawing remains lawful — withdrawal does not work retroactively. Before we delete anything, we offer to send you a complete copy of your journal first. If you are still within the first 14 days of your paid subscription, you get everything back; if your annual subscription is running, we refund the remaining full months in accordance with the terms. On a monthly subscription, the remainder of the current month lapses — we say that honestly.
The other consents are separate from this. Nudges and the cookie choice on the site are separate choices. You can switch them on and off one by one, and switching them off has no consequences whatsoever for your subscription or for what you can do in the app.
6. Can anyone at Memoto read my journal?
This is the question everyone asks, so it is answered here honestly.
No human reads along by default. Access to content only occurs upon an explicit support request from the user, or in the event of a concrete security incident.
What that means in practice:
- No one reads through, assesses or responds to your entries. The messages and mementos are created by AI, without a human in between.
- If you e-mail us "my memento from last week is wrong, can you look?", we look — because you ask.
- If there is a security incident and we must investigate what happened, that can mean we need to access data.
- Technically, the administrator has access to the systems your data lives in. That is unavoidable for a service someone must maintain. What we do about it: that access is limited to one person (Ronald), and confidentiality applies.
What we deliberately do not say here. We do not say "even we cannot read your journal" and we do not call Memoto "end-to-end encrypted". That would not be true: the AI must be able to read your text to write your companion's messages. See chapter 14 for what we do technically.
Your coach cannot read along. Even if you joined through a coach's code. Your coach sees that people signed up through his code and receives a settlement about that — never your name linked to content, never a line about how you are doing, never anything from your journal.
7. How the AI in Memoto works
What happens. For every message, every chat reply and every memento we send a request to the AI model of Anthropic (Claude). It contains: your first name, the name and tone you gave your companion, your intake answers and your journal text for the period concerned. The model writes your companion's text from that. If you want to hear that text, only the generated message goes to the speech technology of ElevenLabs, which turns it into an audio file once; we store that ourselves, so listening again does not pass through ElevenLabs anew.
What does and does not go there.
| To Anthropic | To ElevenLabs | |
|---|---|---|
| The text you write yourself | Yes, the text needed for that one message or memento | No |
| Your intake answers | Yes, with every request | No |
| Your first name and your companion's name and tone | Yes | No |
| The generated message | Originates there | Yes — this is the only thing that goes there |
| Your e-mail address or account ID | No | No |
| Your photos and videos | No. They stay in Frankfurt and are not analysed | No |
| Your payment details | No | No |
How long they keep it. Anthropic keeps what comes in and what goes out for at most 30 days by default, and longer if their safety screening flags something. We are working on an arrangement under which nothing is retained ("zero data retention"). As long as that arrangement is not in place, the 30 days apply. We write that here honestly instead of promising that nothing is kept. We conclude a data processing agreement with ElevenLabs; as soon as the arrangements on their retention period are final, you will read them here. As soon as anything changes here, we update this statement and you will see it in the version history.
No AI model is trained on what you write. Not by us, and our suppliers are contractually forbidden to. If we ever come up with a way in which that could help, we will ask your separate consent — off by default, and refusing has no consequences.
What the model does not do. It makes no diagnosis, does not assess how you are doing and attaches no score to it. It is expressly instructed by us not to name complaints or conditions and not to offer treatment — not even if you ask. It is not a therapist and not a counsellor.
What the model does do, and what is imperfect about it. It recognises patterns in language. Sometimes it infers something that is not right — that you are looking forward to something you did not mean that way, for example. AI texts can be wrong or incomplete. Something not right? E-mail us and we will delete the message or memento for you.
One thing deliberately does NOT go to the model. If your text contains words from a fixed list that point to serious distress, we do not send that text to the AI model. Instead you see a fixed, human-written text with support services. Chapter 15 explains how that works and what we do NOT keep track of in the process.
What we do NOT do with AI. We do not use AI to determine what you pay, whether you get access, or to sort you into groups. No decision about you is made that is based solely on automated processing and that has legal effects or affects you significantly. Creating your message and memento is a form of profiling: a personal text is created based on what you wrote. That is why we explain above how it works, even though the law does not require this level of detail.
Everything AI created is marked as such. You are told once when getting started, the explanation is permanently available under Settings, and every AI-generated block carries a label. That is an obligation from the European AI Act, and it is also simply decent.
So it can be checked, we record per generated message which model and which version of our instructions created it.
8. Product improvement and model training — off by default
We do not use what you write to improve our product or an AI model.
If we ever want to, it will happen only via a separate, voluntary choice that is off by default, with a concrete explanation of what it is for. Saying no has no consequences: your subscription, your price and everything you can do in the app stay exactly the same. At present we do not even offer this choice — it will only come if there is a real, described purpose for it.
What we do to improve Memoto: look at numbers and failures. How many mementos are created and how often something fails — figures from our own server logs and database, without measurement scripts in the app. Those are counts, not journal content.
9. Who we share your data with
We do not sell your data. To anyone, ever. We do engage a number of companies to make Memoto work. Our processors may use your data solely to perform that one task for us; we conclude data processing agreements with them. Not every party in this table is a processor: Google is itself responsible for the sign-in, as is your browser's push service, and Stripe has the double role described below the table.
| Who | For what | What goes there | Where |
|---|---|---|---|
| Supabase | Database, sign-in, storage of photos, videos and audio | Almost everything: account, journal, media, audio, mementos, subscription status | US company; your data lives in Frankfurt, Germany (EU) |
| Anthropic | Writing your companion's messages, conversations and mementos | Your first name, your companion's name and tone, your intake answers and your journal text for the period concerned. Never your e-mail address or payment details | United States |
| ElevenLabs | The read-aloud voice | Only the text of the message being read aloud. No personal or account data | United States |
| Stripe | Payment and subscription management | Your e-mail address and the payment details you enter with Stripe yourself. No journal content | Ireland (EU) and United States |
| Scaleway (Transactional Email) | Sending our e-mails | Your e-mail address and the content of the mail. The daily mails contain your companion's message, including text from your journal | France (EU) |
| Vercel | Hosting of the website and the app; all traffic passes through here | The traffic and technical data such as your IP address. No separate transfer of your journal; it is the pipe everything flows through, encrypted | US company with a worldwide network |
| Sign in with Google (only if you choose it) and Google Analytics on memoto.nl (only after your consent, see the cookie statement) | For sign-in: your e-mail address, from Google to us. For Analytics: visit data of the public site, never anything from the app | United States; for Analytics, Google Ireland Limited is the contracting party | |
| Your browser's push service (Google, Apple or Mozilla) | Delivering push notifications | The technical address of your device and the message | Worldwide |
Stripe has a double role. For the payment we commission, Stripe is our processor. In addition, Stripe uses data for its own purposes, such as fraud prevention and complying with anti-money-laundering laws. Stripe is itself responsible for that; what Stripe does with it is set out in Stripe's privacy statement.
What your coach sees. Your coach receives a settlement with numbers: how many people signed up through his or her code, how many of them took a subscription, and what amount goes with that. No names, no e-mail addresses, and never anything from your journal. The same applies to the friends programme: whoever invited you sees the discount on their next payment, not what you do in Memoto.
Beyond that, we share data only if the law obliges us to (for example a valid order from a competent authority) or if it is necessary to defend our rights in a dispute. Even then we give no more than strictly necessary, and we tell you if we are allowed to.
We keep this list current. If anything changes about who we engage, we update this statement and you will see it in the version history.
10. Does your data leave the EU?
Your journal lives in Europe. What you write, your media, your audio and your mementos are stored in Frankfurt, Germany. Since 1 September 2026 the servers that execute the app also run in Frankfurt, so your data is not only stored there but processed there. Our e-mails are sent from France.
But we are honest about the rest. This leaves the EU:
- The text for your companion's messages and mementos goes to Anthropic in the United States, together with your first name, your companion's name and tone and your intake answers.
- The generated message goes to ElevenLabs in the United States to be turned into audio once.
- Payments run through Stripe, which processes partly in the United States.
- The traffic to and from the app runs through Vercel, a US company with a worldwide network. Technical data such as your IP address is seen along the way. That is inherent to how the internet works.
- If you sign in with Google or accept the cookie banner, Google processes data (your e-mail address for the sign-in, visit data of memoto.nl for Analytics), partly in the United States.
- Push notifications run through your browser's push service (Google, Apple or Mozilla), with a worldwide network.
Why that is allowed. For transfers to countries outside the EU, the law requires additional safeguards. We rely on two instruments:
- the standard contractual clauses of the European Commission — a fixed contract obliging the recipient to protect your data as within the EU; and/or
- the EU-US Data Privacy Framework, a decision of the European Commission granting certain US companies an adequate level of protection.
Want to know which safeguard applies to which supplier, or see a copy of those contracts? E-mail privacy@memoto.nl and we will send you the current state of affairs.
What we do not say. We do not say "100% European" or "all your data stays in the EU". That would not be true.
11. How long we keep your data
Honestly put: your data remains for as long as your account exists. A journal exists to be kept, and we throw nothing of yours away without you asking. There is one automatic clean-up: expired nudges are deleted after a week.
Around that, these rules apply:
| What | How long | Why |
|---|---|---|
| Your account and everything you wrote and added (journal, media, audio, mementos, intake) | As long as your account exists; gone immediately with the delete button, in any case within 24 hours | This is your journal; you decide when it must go |
| After the end of your subscription or trial | Everything remains stored, so you can come back later or request a copy — until you ask for deletion | See chapter 12 |
| Expired nudges | One week | After that they serve no purpose |
| Payment, invoice and subscription data | 7 years from the end of the financial year, and up to 10 years where European VAT rules require it | Statutory retention obligation of the tax authorities |
| Consent records and the register of deletion requests | As long as needed to demonstrate what you consented to and that we executed your request | Accountability duty under the GDPR |
| What arrives at Anthropic | At most 30 days at Anthropic itself; longer only if their safety screening flags something (see chapter 7) | Supplier policy; we are working towards zero |
| Security backups | Automatically replaced by newer backups; we do not restore deleted data | To be able to recover after an outage |
Fixed, automated retention periods per data type — for example automatically clearing old technical logs — do not otherwise exist at this moment; if we introduce them, you will read it here.
12. What happens when you stop
You cancel. Your subscription runs until the end of the period you paid for. After that, and also if your trial ends without a subscription, writing stops: capturing new days and everything your companion does no longer works. Reading back stays open: your journal is still there and you can read and download it. We say that honestly, so it does not take you by surprise.
Signing in always keeps working. You then land on your account page, where you can take out a subscription, download a copy of everything and delete your account. So your data is never behind a paywall.
You lose nothing. Your journal remains safely stored. At any time you can:
- download a complete copy with the button "Download my journal" — also without a subscription, free of charge, as often as you like;
- come back: if you take out a subscription (again), everything will be there, exactly as you left it;
- delete everything: with the button "Delete my account and everything in it" it is gone immediately, in any case within 24 hours, and you get a confirmation. It then disappears from the security backups automatically, as old backups are replaced by new ones; we do not restore deleted data from a backup.
What remains after a deletion: your invoices and payment data, because tax law obliges us to keep them, and an irreversibly encoded record with which we can demonstrate that there was a deletion request and when.
13. Your rights
You have a number of rights over your own data. You handle most of them yourself, in the app under Settings → Your data: download your journal, delete your account, review your consents and pause processing. Anything not there — or if you get stuck — you e-mail to privacy@memoto.nl, preferably from your account's e-mail address.
Before downloading and before deleting we ask you to confirm it is really you: either you just signed in, or you get a code at your account address. That is the only hurdle, and it is there to protect your data, not to hold you up.
| Your right | What it means | How you use it |
|---|---|---|
| Access (art. 15) | You may have a copy of everything we hold about you, plus an explanation of why, for how long and with whom we share it | Button "Download my journal" under Settings → Your data; this statement gives the explanation. Or e-mail privacy@memoto.nl |
| Rectification (art. 16) | If something is wrong, you may have it corrected. That also applies to what the AI writes about you | What you can change in the app yourself, you change there; for the rest, e-mail us |
| Erasure (art. 17) | You may have your data deleted | Button "Delete my account and everything in it"; executed immediately, in any case within 24 hours, and confirmed. Or e-mail privacy@memoto.nl |
| Restriction (art. 18) | You may have processing temporarily paused without losing anything | Button "Pause my account"; the AI processing, the nudges and the mail stop, everything remains stored. Or e-mail privacy@memoto.nl |
| Objection (art. 21) | You may object to processing based on our legitimate interest (see chapter 4) | E-mail privacy@memoto.nl with what bothers you. We stop unless we have a compelling reason to continue, which we will then explain |
| Data portability (art. 20) | You may receive your data in a usable, machine-readable format to use elsewhere | Button "Download my journal": you receive your journal as a readable file plus the underlying data as JSON. Or e-mail privacy@memoto.nl |
| Withdrawing consent (art. 7(3)) | Any consent you gave, you may withdraw. It works from that moment on, not retroactively | Settings → Your data → Permissions; nudges also via the unsubscribe link in every e-mail; you change the cookie choice on memoto.nl. Withdrawing the journal consent ends your account (see chapter 5) |
| Not being subject to automated decisions (art. 22) | You do not have to accept a decision made entirely automatically that affects you significantly | We do not make such decisions. See chapter 7 |
How fast we respond. Within one month. If your request is complex, we may extend that period by two months — in that case we tell you within the first month that we need longer and why. It costs you nothing.
How we know it is you. In the app: you just signed in, or you enter a code we send to your account address. If you e-mail us from your account's e-mail address, that is generally sufficient. If you e-mail from another address, we first ask you to sign in and confirm the request from your account. We never ask for a copy of your identity document.
Complaining is allowed too. If you disagree with how we handle your data, tell us first via privacy@memoto.nl — we prefer to solve it ourselves. In addition, you always have the right to lodge a complaint with a supervisory authority:
- If you live in the Netherlands: the Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl
- If you live in Belgium: the Gegevensbeschermingsautoriteit (GBA) — gegevensbeschermingsautoriteit.be
- If you live elsewhere in the EU, you can turn to your own country's supervisory authority.
You can also go to court.
14. How we secure your data
We do the following, and no more than that — we promise nothing we cannot deliver.
- Encrypted in transit and at rest. All traffic travels over an encrypted connection (TLS), and the database and the storage of your media and audio are stored encrypted.
- Strictly separated accounts. In the database, an access rule applies to every row (row level security), making your data technically unreachable from someone else's account. Those rules are switched on for every table.
- Shielded media storage. Your photos, videos and audio are not public; you get a signed, temporary link that expires after one hour.
- The AI keys stay with us. The access keys to the AI and speech providers live only on our servers and never end up in your browser.
- Signing in with an extra lock. If you choose a password, two-step verification with an authenticator app is mandatory. If you sign in with a sign-in link or with Google, there is no password to steal from us.
- Limited access. See chapter 6: one administrator, only upon a support request or an incident.
- Backups. We make backups that are automatically replaced by newer ones. They are used only to recover after an outage.
- Our e-mail log contains no content. We record that we sent you a mail, not what was in it — precisely because daily mails contain journal text.
What we deliberately do not say. Memoto is not "end-to-end encrypted" and not "zero-knowledge", and we do not say your data is 100% safe. Absolute safety does not exist. What we do in the event of an incident is in chapter 20.
15. The support card: a promise about what we do NOT track
If you write something containing words that point to serious distress, two things happen: your text does not go to the AI model, and you see a fixed, pre-written, human-made text with support services — 113 Suicide Prevention (0800-0113 and 113.nl in the Netherlands), de Luisterlijn, and for Belgium Zelfmoordlijn 1813. That check comes before every other step, even when your trial has expired.
What we do NOT do in the process — built that way on purpose:
- No AI is involved in deciding whether the card appears. It is a fixed word list, not an analysis of your state of mind.
- We attach no judgement, score or grading to it and we keep nothing over time. The message itself receives a marker — needed to show the card and to keep that text away from the AI model — but those markers are never added up, counted per person or combined into a picture of you.
- We do not measure whether you click or call a helpline. Ever.
- We alert no one else: no doctor, no emergency service, no contact person, no coach. Nor do we contact you ourselves.
Why we do it this way. A file of "who saw a support card and when" would be the most sensitive file in the entire company. By not creating it, it cannot leak, cannot be requested and cannot be used against you. What you wrote simply remains in your journal, just like everything else.
16. Nudges and e-mail
You switch nudges on yourself. If you want a nudge in the morning and evening, you choose the times yourself, by push notification in your browser and/or by e-mail. You switch them off per channel just as easily — in the app, or via the unsubscribe button at the bottom of every mail, which works with one tap.
The daily mails contain your companion's message. That is deliberate: it makes them useful. But it also means those mails contain text from your journal. That is why we send them through a European party (Scaleway, France), and why our own log only records that a mail was sent — not its content (chapter 3.9). If you prefer no journal-derived text in your mailbox, switch off the e-mail nudges and use only push or the app itself.
Service e-mails always arrive. For example: your sign-in link, your invoice, an important change to this statement or the terms. You cannot unsubscribe from those while you have an account, because without those messages we cannot provide the service.
We add no tracking pixels of our own to our e-mails. We do not measure whether you open a mail or what you click.
17. Are you in a photo or video in someone's Memoto?
Users can attach photos and videos to their moments. Other people sometimes appear in them: a partner, a child, a friend. We then process data of someone who knows nothing about it. We do not know who they are and therefore cannot reach them — which is why this explanation is here, publicly.
What you should know:
- The images are private. Only the user who added them can see them.
- We do no facial recognition and do not analyse the content of images.
- Images are not sent to the AI provider.
- Images are not shared, not published and not sold.
- Are you in an image and do you have a question about it? E-mail privacy@memoto.nl. We do not search users' journals — that would itself be an intrusion — but we will think along with you and can contact the user where possible.
We process these images on the basis of the legitimate interest in offering a personal journal with photos and videos (art. 6(1)(f) GDPR); they come from the user who added them.
18. Children
Memoto is for people aged 18 and over. When creating your account you declare that you are 18 or older; we record that.
We do not verify your age with an identity document and we do not estimate your age. That is a deliberate choice: doing so would require collecting precisely more sensitive data about you — an identity document, a facial scan — and we consider that a worse outcome than the problem it solves.
What happens if we discover it anyway. If we notice or hear that an account belongs to someone under 18, we close that account and delete the data. Of such a deletion, too, we keep only an irreversibly encoded record with the date, so we can show it was carried out. Are you a parent or guardian and do you think your child has an account? E-mail privacy@memoto.nl and we will handle it.
19. If you pass away
Privacy law does not apply to deceased persons, and in the Netherlands nothing supplementary has been arranged for this. What happens to your journal is therefore a choice we make — and for an app about memories, we want to make it well.
What we do. If next of kin report a death and can substantiate it, we stop the subscription; nothing more is charged. We delete the data 12 months after the report.
What next of kin can ask. They have no legal right to the content of your journal, and we do not hand it over just like that — precisely because it is your journal. As long as you have not laid down anything else yourself, we provide nothing. Silence never leads to disclosure with us.
Do you want your journal preserved for the people around you? Then request a copy from time to time (chapter 13) and keep it in a place your loved ones know.
Note: a journal almost always also contains data about living people — your partner, your children, your friends. Privacy law fully applies to their data. That, too, is why we provide no more than what the user chose.
20. If something does go wrong
If something ever goes wrong with your data, you will hear it from us, in plain language, as fast as we can.
Concretely:
- We report a data breach to the Dutch Data Protection Authority within 72 hours, unless it clearly poses no risk to you.
- If it likely poses a high risk to you, we inform you immediately — with what happened, which data is involved, what the consequences may be, what we are doing about it and what you can do yourself.
- We keep an internal register of all incidents, including the small ones.
For a breach involving journal content, our starting point is that we report it. We do not go looking for reasons not to.
21. Cookies
On memoto.nl there is a cookie banner for one thing: the visitor counter (Google Analytics). It only switches on if you say yes; before that yes, not a single request leaves for Google. In the app, behind your sign-in, nothing is measured.
What the site and the app otherwise place on your device is what is needed to make them work: your sign-in session, your language choice, your display choice, a referral code if any, and your cookie choice itself — plus the app's own files (service worker and cache), a few small preferences in browser storage and, if you switch nudges on, your push subscription.
The full explanation is in the cookie statement at memoto.nl/cookies. That is also where you change your choice, via the Cookie preferences button at the bottom of every page.
22. Changes to this statement
This statement is version 2.3 and applies from 2 September 2026.
If something important changes — a new purpose, a new supplier, a change in how you exercise your rights, or something affecting the scope of your consent — we will actively notify you by e-mail and with a notice in the app, at least 30 days before it takes effect. That message states what changes and what it means for you, so you can decide in time whether you want to continue.
If the change affects your explicit consent for the processing of what you write, we will ask for that consent again. An amended statement is not enough for that.
Small textual improvements (spelling, a clearer sentence) are not announced separately, but they do appear in the version history.
All versions remain available. On memoto.nl you will find, per version, the date, the version number and, in two lines, what changed and why.
| Version | Date | What changed |
|---|---|---|
| 2.1 | 1 September 2026 | Your rights move from an e-mail to a button: access, a copy, erasure, restriction and withdrawing your consent are handled in the app under Settings → Your data. The erasure deadline moved from 30 days to 24 hours. Signing in keeps working without a subscription, so you can always reach your data. The privacy@memoto.nl route remains as a fallback |
| 2.0 | 31 August 2026 | Updated to the app as built: four sign-in methods, the conversation with the companion, moments with video, Google Analytics on the site with a cookie banner, Scaleway as e-mail sender, honest description of retention and deletion (on request, by hand), copy and deletion via e-mail request |
| 1.0 | 24 August 2026 | First version |
This statement was drafted in Dutch. The Dutch text is the binding version; this English translation is provided as a service.
Questions about this document? Email hallo@memoto.nl, or privacy@memoto.nl if it is about your data. We reply within two working days.