Legal · memore.tech
Last updated: 19 August 2026
Memore.tech ("Memore") is operated by Shoon's LLC ("we", "us", "our"). Memore is software for independent tutors and their students: it manages lessons, students, study materials, payments and recordings, with AI-assisted transcripts, summaries and materials.
This policy explains what we do with personal data. Two companion documents complete it: the Data Processing Agreement, which governs data you record about your students, and the Cookie Policy.
Memore handles two different kinds of personal data, and our legal role differs between them. Almost every question about your rights depends on which one you mean.
| Data | Who decides how it is used | Where it is governed |
|---|---|---|
| Your account data — your name, email, password, timezone, settings, billing, support messages, and how you use the product. | We are the controller. | This policy |
| Customer Data — what a tutor records about their students: names, contact details, lesson history, attendance, notes, materials, recordings, transcripts, vocabulary, balances. | The tutor is the controller. We are their processor and act on their instructions. | The DPA |
So: if you are a student and want to know why your tutor holds a note about you, or want it corrected or erased, ask your tutor — they decide, and we assist them. If you hold your own Memore account, we are the controller of that account and you can exercise every right below directly with us.
| Category | What it covers |
|---|---|
| Account | Email address, name, password hash, authentication and one-time codes, role, language, timezone, avatar. |
| Profile and settings | Currency, lesson pricing and defaults, cancellation policy, working hours, notification preferences, public teacher-card content you choose to publish. |
| Relationships and scheduling | Students or tutors you are connected to, lessons, groups, series, attendance, availability, booking requests. |
| Teaching content | Notes, homework, study materials, glossaries, exercises and attempts, uploaded files and images. |
| Recordings and derived content | Audio, video and screen recordings you create or upload, and the transcripts, summaries, corrections and other AI outputs derived from them. |
| Financial records | Lesson charges, payments, balances, payment-proof uploads, ledger entries. We do not receive or store full card numbers. |
| Calendar | Events, times, titles and busy periods from a calendar you connect, and access tokens for that connection. |
| Communications | Email we send you and records of delivery, support and feedback messages, and push notification tokens if you use the iOS app. |
| Usage and technical | Pages and features used, device and browser information, IP address, and error diagnostics. Analytics collected in your browser (which requires a cookie) happens only with your consent. A smaller set of events is recorded on our servers when you take an action such as creating a lesson — no cookie is involved, and we rely on legitimate interests. You can object to the latter at any time. |
| Purpose | Basis |
|---|---|
| Creating and running your account, delivering the features you use, taking payment | Performance of a contract |
| Keeping the service secure, preventing abuse and fraud, fixing errors, defending legal claims | Legitimate interests |
| Analytics cookies, marketing email, and any processing where consent is legally required | Consent, which you may withdraw at any time |
| Server-side product analytics and error diagnostics that involve no cookie or device storage | Legitimate interests — understanding and fixing our own product. You may object at any time |
| Tax, accounting and other statutory record-keeping; responding to lawful requests | Legal obligation |
| Processing Customer Data on a tutor's behalf | The tutor's basis, not ours — see section 1 |
Withdrawing consent does not affect processing carried out before you withdrew it.
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not make decisions producing legal or similarly significant effects about anyone by automated means alone.
Features such as transcription, summaries, generated materials, corrections and the in-app assistant send the relevant content — which may include lesson text, uploaded files, recordings and transcripts — to an AI provider so it can return a result.
Your content is not used to train AI models. We send it for inference only. Our providers are contractually bound not to use content submitted through their APIs to train or improve their models, and we do not use it to train any model of our own. Providers may retain content briefly for abuse monitoring under their own terms.
Current AI providers: Anthropic (summaries, materials, the assistant) and OpenAI (speech transcription). AI output is generated automatically, is not reviewed by us, and may be inaccurate — you must review it before relying on it.
Recording is never automatic: a recording exists only because a user started one or uploaded a file. Whoever does so is responsible for obtaining every consent, notice and authorisation the law requires from the people captured, before recording. Recordings and their transcripts are Customer Data — the tutor is the controller, and we process them only to deliver the features they use.
Where you connect a calendar we may read, create, modify and synchronise events as you authorise. Google Calendar connects through an authenticated two-way integration; other providers (Outlook, Apple, iCloud) connect as read-only subscriptions, and we also publish an outbound feed you can subscribe to.
Memore's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide the calendar features you enable, do not transfer it except as needed to provide those features, do not use it for advertising, and do not allow humans to read it except with your consent, for security, or as required by law.
You can disconnect a calendar at any time in Settings, which revokes our access token.
Memore is a service for people aged 16 and over. The Services are not directed to anyone under 16, no one under 16 may hold or operate an account, and we do not knowingly collect personal data from anyone under 16. If we learn that an account belongs to someone under 16, we will close it. For a user aged 16 or 17, a parent or guardian must have agreed to the Terms on their behalf.
A tutor may still teach students of any age: where a student is under 16, any account on the learning side is held by a parent or guardian. Where a tutor records information about a child, the tutor is the controller of it and is responsible for the lawful basis, the transparency information, and any parental authorisation required. If you believe a child's data has reached us without proper authorisation, write to legal@memore.tech and we will act on it.
Necessary cookies keep you signed in and remember your language. Analytics cookies are set only if you agree, and you can review or withdraw that choice at any time from the Cookie settings link in the footer of every page. Full detail, including every cookie we set: Cookie Policy.
These providers process personal data to help us run Memore. Each is bound by a data processing agreement and may use the data only to provide its service to us.
| Provider | What it does | Processing location |
|---|---|---|
| Fly.io | Application hosting | European Union (Amsterdam) |
| Supabase | Database and file storage | As configured for our project; European Union or United States |
| Anthropic | AI generation (summaries, materials, assistant) | United States |
| OpenAI | Speech transcription | United States |
| Resend | Transactional email delivery | United States and/or European Union |
| PostHog | Product analytics — only with your consent | European Union |
| Sentry | Error monitoring and diagnostics | United States and/or European Union |
| Calendar synchronisation — only if you connect it | United States and/or European Union | |
| Apple | Push notifications and Sign in with Apple — only if you use the iOS app | United States |
| Zoom | Meeting-link creation — only where enabled | United States |
We will publish any material new or replacement sub-processor here at least 30 days before it starts processing, so a customer who objects has time to raise it. Where a replacement is needed urgently to keep the Services secure or available, we may engage it immediately and will publish the change as soon as reasonably practicable. This page is the authoritative notice of sub-processor changes. See section 6 of the DPA.
Shoon's LLC is established in the United States, so personal data from the EEA, the United Kingdom and Switzerland is transferred there. We rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the equivalent arrangement for Switzerland, together with the technical measures described in section 14. The clauses as we have completed them are set out in section 11 of the DPA. A copy is available on request.
| Data | Retention |
|---|---|
| Account and profile | While the account is active; erased on deletion, subject to the rows below |
| Lessons, notes, materials, glossaries | While the account is active, or until you delete them |
| Recordings and transcripts | Until deleted by the user; we do not retain them beyond the life of the account |
| Items in Library Trash | Purged automatically 30 days after deletion |
| Financial and ledger records | Up to 7 years, where required by tax and accounting law |
| Email delivery records | Until you delete your account |
| Analytics (with consent) | Up to 12 months |
| Error diagnostics | Up to 90 days |
| One-time sign-in codes | 10 minutes |
| Refresh tokens | Up to 60 days, revoked on sign-out or rotation |
| Imported calendar busy periods | Pruned after 45 days |
| Backups | Deleted data disappears from backups on their normal rotation |
We may keep data longer where necessary to establish, exercise or defend legal claims, or where law requires it.
We share personal data only with:
We do not sell personal data.
Measures include TLS for all traffic; passwords stored as Argon2 hashes and one-time codes only as digests; calendar tokens encrypted with AES-256-GCM at rest; expiring session tokens with hashed, rotating refresh tokens; every query scoped to the requesting account; a Content Security Policy, server-side HTML sanitisation, protection against requests to internal addresses, and rate limiting on authentication. The full list is the Annex to the DPA. No system can be guaranteed secure.
If a personal data breach is likely to result in a high risk to your rights, we will inform you without undue delay, and we will notify the competent supervisory authority within 72 hours where the law requires it. Where we act as a processor, we notify the controller without undue delay after becoming aware.
Depending on where you live, you may have the right to access your data, correct it, erase it, receive a portable copy, restrict or object to processing, withdraw consent, and complain to a supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is your national authority.
How to exercise them:
We respond within one month, extendable by two further months for complex requests, and we do not charge unless a request is manifestly unfounded or excessive.
Deleting your account removes your own records and permanently severs the identifiers that could re-link a new registration to your old relationships. Where you shared a teaching relationship, the other person keeps their own records of it and your name may remain visible to them, marked as a deleted account; your email address and private notes are removed.
Shoon's LLC is established outside the EEA and the United Kingdom and has not appointed a representative under Article 27 of the EU and UK GDPR. If one is appointed, they will be named here. Individuals in those regions can raise any data protection matter with us directly at legal@memore.tech, and we will handle it under this policy.
If you live in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you may have the right to know what personal information we collect, to access and delete it, to correct it, to a portable copy, and to appeal a refusal. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of on those grounds. We do not use personal information for profiling with legal or similarly significant effects. Exercise any of these at legal@memore.tech; we will not discriminate against you for doing so.
We may update this policy. The "Last updated" date above changes whenever we do, and we will notify you by email or in the product before a material change takes effect. A change that requires consent will be asked for, not assumed.
Memore is operated by Shoon's LLC. Privacy questions, data protection requests and complaints: legal@memore.tech.