Privacy Policy
This document is published in English. English is the governing language for all legal purposes.
VERSION 1.0 | EFFECTIVE DATE: 20 AUGUST 2026 | LAST UPDATED: 20 AUGUST 2026
This Privacy Policy explains how memmoo handles personal data. It applies to the memmoo website at memmoo.com, the memmoo application at app.memmoo.com, memmoo AI Co-workers, and our sales, account administration, billing, support and related business activities.
memmoo is a platform for building, deploying and managing AI co-workers that operate within existing business systems. How privacy law applies depends on whose data is involved and who decides why and how that data is processed.
Data we handle for our own purposes: This includes website, account, billing, sales, security and support data. For this data, the applicable memmoo entity acts as controller, business or Data Fiduciary, depending on the relevant law.
Data that AI co-workers handle for a customer: This may include mailbox content, CRM records, invoices, documents, activity data and other information within customer-authorised systems. The customer normally acts as controller or business and memmoo acts as processor or service provider. The applicable processing terms are set out in the Data Processing Addendum.
This Privacy Policy should be read together with the memmoo Terms of Service, Data Processing Addendum, Cookie Policy and Sub-processor Register.
1. Who is responsible for your data
The responsible memmoo entity depends on how the service was purchased and the entity identified in the applicable Order Form, marketplace transaction, partner quote or other contract:
| How memmoo is obtained | Controller for account, billing and support data | Processor for customer content |
|---|---|---|
| Microsoft commercial marketplace, including "Get it now" | KLOUDPAD Mobility Research Private Limited | KLOUDPAD Mobility Research Private Limited |
| Microsoft Cloud Solution Provider partner | KLOUDPAD Mobility Research Private Limited | KLOUDPAD Mobility Research Private Limited |
| memmoo distributor or reseller quote | Kloudpad Inc.; the distributor or reseller may separately act as controller for its own sales and customer records | Kloudpad Inc. |
| Direct purchase under an Order Form | The memmoo entity named in the Order Form, ordinarily Kloudpad Inc. | The memmoo entity named in the Order Form, ordinarily Kloudpad Inc. |
| Website visitor, trial user or prospect without a separate Order Form | KLOUDPAD Mobility Research Private Limited | Not applicable unless trial processing is governed by a separate agreement |
1.1 Our legal entities
An Indian company
CIN: U64202KL2013PTC034312
Registered office: G7, 7th Floor, Heavenly Plaza, Civil Lane Road, Ernakulam, Kerala, India - 682021
A Delaware corporation, United States of America
File number: 10007782
Registered office: 131 Continental Dr, Suite 305, City of Newark, County of New Castle, Delaware 19713, USA
References in this policy to "memmoo", "we", "us" or "our" mean the applicable entity above. Microsoft is not the controller of customer content processed by memmoo AI co-workers merely because the service was obtained through a Microsoft purchasing channel.
1.2 How to contact us
| Purpose | Contact |
|---|---|
| Privacy enquiries and data subject requests | privacy@memmoo.com |
| Legal notices | legal@memmoo.com |
| Security incidents and vulnerability reports | security@memmoo.com |
| Technical support | support@memmoo.com |
| Online privacy request | /privacy-request |
Postal enquiries may be sent to either registered office. Please mark privacy correspondence "Attention: Privacy Team".
2. Our role when handling customer business content
memmoo is designed to act on data within customer-authorised systems. It is not intended to replace those systems as the authoritative system of record.
For example:
- If a co-worker creates a quote, the completed quote may be stored in the customer's CRM.
- If a co-worker posts an invoice, the completed invoice may be stored in the customer's accounting system.
- If a co-worker drafts or summarises an email, the relevant source and output may remain in the customer's mailbox or another customer-controlled system.
To perform these tasks, memmoo may need to read, transmit, transform, extract, classify, summarise or generate content. This processing may involve personal data.
2.1 Customer instructions and responsibility
- The customer determines the purpose of the processing and configures what systems, records and actions a co-worker may access.
- memmoo processes the data only on documented customer instructions, including instructions contained in the applicable agreement and authorised use of the service.
- The customer is responsible for providing required notices, selecting a lawful basis, responding to individuals' requests and ensuring that its deployment is lawful.
- memmoo assists the customer as described in the Data Processing Addendum.
2.2 AI model training
memmoo does NOT use customer business content to train shared foundation models for memmoo's or a third party's independent benefit. Where an external model provider is used, the relevant provider must be listed or covered through the Sub-processor Register.
2.3 On-device deployments
Certain co-workers may operate wholly or partly on a user's device. A customer must review the applicable deployment documentation before use. A feature should not be described as fully local where it sends content or telemetry to memmoo or an external model provider.
3. Personal data we handle as controller
The categories below describe personal data that memmoo may process for its own business purposes:
| Category | Examples | Purposes | GDPR or UK GDPR lawful basis, where applicable |
|---|---|---|---|
| Account and identity data | Name, work email, job title, employer, user ID, password hash, authentication and SSO identifiers, roles and permissions | Create and secure accounts, authenticate users, administer access and subscriptions | Contract; legitimate interests in security and service administration |
| Billing and transaction data | Company name, billing contact and address, tax identifiers, plan, quantities, invoices, payment status, purchase order references | Invoice customers, collect payment, administer subscriptions, resolve billing disputes, meet accounting and tax duties | Contract; legal obligation |
| Payment data | Payment status and limited transaction references; full card or bank details are handled by payment providers | Take and reconcile payment, prevent fraud and issue refunds | Contract; legitimate interests; legal obligation where applicable |
| Support and correspondence data | Ticket content, emails, attachments, screenshots, call notes and diagnostic information submitted to us | Answer requests, troubleshoot issues, meet support commitments and improve support processes | Contract; legitimate interests |
| Product usage and telemetry | Feature use, workflow-action and AI-credit counts, run outcomes, error and performance data, browser and IP address | Meter entitlements and usage, bill accurately, maintain reliability, diagnose faults, improve service and prevent misuse | Contract; legitimate interests |
| Security and audit data | Sign-in events, IP addresses, administrative actions, configuration changes, access events, consent records | Detect, prevent and investigate misuse, maintain auditability and demonstrate compliance | Legitimate interests; legal obligation |
| Sales and marketing data | Business contact details, discovery notes, enquiry details, event and webinar registration, marketing preferences | Respond to enquiries, scope work, manage leads and send permitted business communications | Consent where required; legitimate interests for proportionate B2B communications; steps before contract |
| Website and cookie data | Cookie identifiers, pages viewed, referrer, device information and approximate location derived from IP | Run website, provide requested functions, measure performance, consented analytics or marketing | Consent for non-essential cookies; necessity for strictly necessary technologies |
| Recruitment data | Application details, CV, employment history, qualifications, interview notes, right-to-work info | Assess candidates, manage recruitment, communicate with applicants and meet legal requirements | Steps before entering contract; legitimate interests; legal obligation; consent where required |
We do NOT sell personal data. We do NOT share personal data for cross-context behavioural advertising.
4. Data processed by AI co-workers for customers
A customer decides which co-workers to deploy, which systems they may access and what information they can process:
| Co-worker | Typical activities | Personal data that may be processed | Individuals concerned | Customer considerations |
|---|---|---|---|---|
| Riya, customer support | Reads, summarises, routes and escalates email | Sender and recipient details, subject lines, message bodies, attachments and signatures | Customers, employees and third parties communicating with customer | Provide appropriate notices, restrict mailbox access and control retention of summaries |
| Alex, inbox and document processing | Monitors mail, classifies requests and documents, extracts fields, updates files, drafts replies | Email and attachment content, invoice fields, supplier and customer contact information | Customers, suppliers, employees and correspondents | Document creation of new copies, restrict access, consider human review before sending |
| Chloe, sales development | Looks up accounts and opportunities, updates quotes and CRM records | Prospect and customer names, business contact details, job titles, account history, notes | Prospects and customers | Define approval and correction processes, ensure privacy notice covers CRM processing |
| Max, finance | Creates invoices, tracks payments, drafts reminders, processes voice notes | Customer and supplier data, billing addresses, invoice details, payment status, voice recordings and transcripts | Customers, suppliers and customer personnel | Maintain human approval for high-impact outbound communications, apply short retention on voice |
| Sam, work activity tracking | Produces configured work-activity information and summaries | Application and document usage, time and duration, task signals, productivity-related indicators | Customer employees and contractors | Employee monitoring requires clear notice, necessity and proportionality review, lawful basis, and DPIA where required |
| Nova, legal and risk | Uses public or customer-provided records, enrichment data and model output for assessments | Organisation and public filing details, officer names and roles, addresses, compensation where published | Individuals connected with assessed organisations | Assess transparency, source terms, accuracy, contestability and material impact |
| Ring 3, memmoo cognitive layer | Coordinates authorised co-workers, routes tasks and creates operational reports | Metadata and content made available by connected co-workers, decision and routing records | Individuals represented in the connected data | Review whether combining information from separate systems is compatible with disclosed purpose |
4.1 Automated actions and human review
AI co-workers may perform automated actions where a customer enables them to do so. The customer is responsible for deciding which actions require prior review. A customer must maintain meaningful human review where an automated action is used to make decisions that produce legal or similarly significant effects on a person.
4.2 Special-category and regulated data
Unless expressly agreed in writing and supported by an appropriate service configuration, memmoo is not intended for special-category data under Article 9 GDPR, criminal-offence data, HIPAA PHI, or full payment card data.
4.3 No professional advice
AI-generated output is informational and is not professional legal, tax, accounting, or compliance advice.
5. How and why we use personal data
We use personal data only where we have a valid purpose and legal basis, including:
- Providing, operating and administering memmoo
- Registering and authenticating users
- Managing subscriptions, entitlements and billing
- Providing support and responding to requests
- Securing the website, application, infrastructure and customer accounts
- Maintaining auditability and investigating misuse or incidents
- Monitoring performance, reliability and service usage
- Complying with law, enforcing agreements and protecting legal rights
6. How long we retain data
We keep personal data only for as long as needed. Our standard retention schedule is:
| Data | Standard retention |
|---|---|
| Account records | For the subscription term and up to 90 days after termination or expiry |
| Customer content processed transiently during a co-worker run | Deleted at the end of the run where technically practicable and, in any event, normally within 24 hours, unless customer enables retention |
| Prompt and model output records | Up to 30 days where retention is enabled |
| Execution and workflow logs | Up to 12 months |
| Voice notes processed by Max | Audio for up to 7 days and transcript for up to 30 days |
| Sam activity data and daily summaries held by memmoo | Up to 30 days by default, subject to customer configuration |
| Nova assessments and reports held in the service | For the subscription term or until deleted by customer |
| Security and audit logs | Up to 12 months, or longer where required for active investigation |
| Consent, acceptance and version records | Up to 7 years after the relationship ends |
| Billing, tax and accounting records | For the period required by applicable Indian, United States and tax laws |
| Support tickets | Up to 24 months after closure |
| Marketing contacts | Until opt-out (minimal suppression record retained to honour opt-out) |
| Trial account data | Up to 30 days after trial expiry |
| Backups | Rotated and purged within 35 days |
7. Who we share data with
| Recipient | Purpose and role |
|---|---|
| Sub-processors | Hosting, infrastructure, model inference, payment processing, communications, support, security. (See Sub-processor Register). |
| Microsoft | Marketplace and CSP transactions, listing administration, billing, technical integration. |
| CSP partners, distributors and resellers | Order administration, invoicing, renewals, account management. |
| Payment processors | Processing payments. Stripe processes direct purchases with Kloudpad Inc. as merchant of record. |
| Professional advisers | Legal, audit, accounting, tax, banking under professional confidentiality duties. |
| Group companies | Operations, support, finance, security across Kloudpad group. |
| Authorities and courts | Compliance with applicable law and lawful process. |
8. International transfers
memmoo operates through entities in India and the United States and uses service providers that may process data in other countries. Where required, we use recognised safeguards including the European Commission's 2021 Standard Contractual Clauses, UK International Data Transfer Addendum, and Swiss adaptations.
9. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit and at rest, tenant isolation, role-based access controls, SSO integration, secret management, logging and audit trails.
9.1 Security incidents
Where a personal data incident affects customer content processed on a customer's behalf, our target contractual notification period is within 48 hours of confirmed awareness. Report suspected vulnerabilities to security@memmoo.com.
10. Cookies and similar technologies
memmoo uses cookies for authentication, security, preference storage, analytics, and marketing. Users can configure choices through or view our Cookie Policy.
11. Marketing communications
We send marketing communications where permitted by law, based on consent or proportionate B2B legitimate interests. You may opt out anytime by clicking unsubscribe or emailing privacy@memmoo.com.
12. Your rights under the GDPR, UK GDPR and Swiss law
| Right | What it means |
|---|---|
| Access | Ask whether we process your personal data and obtain a copy and related information |
| Rectification | Correct inaccurate data and complete incomplete data |
| Erasure | Request deletion where there is no overriding lawful reason to retain the data |
| Restriction | Ask us to pause or limit processing in specified circumstances |
| Portability | Receive eligible data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interests and object at any time to direct marketing |
| Withdraw consent | Withdraw consent at any time for future processing that relies on consent |
| Complaint | Complain to the competent data protection supervisory authority |
To exercise a right, use /privacy-request or email privacy@memmoo.com.
12.1 Requests involving customer content
If an AI co-worker processed your data on behalf of a memmoo customer, that customer is normally the controller. You should direct your request to that organisation.
12.2 EEA and UK representatives
Current representative details are published in the Legal Hub or supplied through privacy@memmoo.com.
13. California and other United States privacy rights
13.1 Our role
For account and website data, memmoo acts as a business. For customer content processed under instructions, memmoo acts as a service provider or contractor. We do not sell personal information or share it for cross-context behavioral advertising.
13.2 Categories of personal information
| California category | Examples collected | Sources | Business purposes | Recipient categories |
|---|---|---|---|---|
| Identifiers | Name, email, IP address, account ID | You, employer, partner, device | Service delivery, authentication, security, billing | Sub-processors, Microsoft, partners |
| Commercial information | Products, plans, purchase records | You, Microsoft, partners | Billing, subscription management | Sub-processors, Microsoft |
| Internet or network activity | Website, app interaction, logs, telemetry | Browser, device, service use | Security, metering, reliability, consented analytics | Sub-processors |
| Approximate geolocation | Approximate location from IP | Device and network | Security, localisation, transaction admin | Sub-processors |
| Professional or employment information | Job title, employer, business contact info | You or your organisation | Account admin, support, sales communications | Sub-processors and partners |
13.3 California rights
California residents hold rights to Know, Delete, Correct, and Non-discrimination. Submit requests through /privacy-request or privacy@memmoo.com.
14. Rights under India's Digital Personal Data Protection Act, 2023
Where the DPDP Act 2023 applies and KLOUDPAD Mobility Research Private Limited acts as Data Fiduciary, Data Principals may exercise rights to information, correction, erasure, grievance redressal, and nomination.
15. Children's data
memmoo is a business product sold to organisations and is not directed to children. We do not knowingly collect personal data directly from anyone under 18 for our own purposes.
16. Recruitment
If you apply for a role with memmoo, we process applicant information to assess suitability, arrange interviews, and comply with employment laws.
17. Sub-processors
The memmoo Sub-processor Register identifies third parties authorised to process customer personal data on memmoo's behalf.
18. Third-party services and links
The service may link to or integrate with third-party applications. A third party's independent handling of personal data is governed by its own privacy notice.
19. Changes to this policy
We may update this Privacy Policy to reflect changes in law, regulation, service functionality, or data handling.
20. Contact
Privacy and data subject requests: privacy@memmoo.com · /privacy-request
Legal notices: legal@memmoo.com
Security incidents: security@memmoo.com
CIN: U64202KL2013PTC034312
G7, 7th Floor, Heavenly Plaza, Civil Lane Road, Ernakulam, Kerala, India - 682021
Delaware corporation, File number: 10007782
131 Continental Dr, Suite 305, City of Newark, County of New Castle, Delaware 19713, USA
Kloudpad Mobility Research Private Limited (CIN U64202KL2013PTC034312) contracts Microsoft Marketplace and Microsoft CSP purchases and is the controller for website visitors, trials and prospects. Kloudpad Inc. (File 10007782) contracts direct purchases and distributor or reseller quotes. Governing law is India, with exclusive jurisdiction in the courts of Ernakulam, Kerala.
Questions about these documents?
Write to legal@memmoo.com for legal notices, privacy@memmoo.com for privacy enquiries and data subject requests, or post to either registered office below.