Your family's memories belong to your family.

1. Introduction

Memorate helps families capture and preserve a parent's or grandparent's life story — through recorded voice conversations, photos, and the memories only they can tell. We built Memorate around a simple belief: the stories you're trusting us with are irreplaceable, and the people telling them deserve to be treated with care, clarity, and respect — especially when they're not the ones who signed up for the account.

This Privacy Policy explains what information Memorate (“Memorate,” “we,” “us,” or “our”) collects, how we use it, who we share it with, and the choices and rights available to you. It applies to two different kinds of people:

• Sponsors — the adult children, grandchildren, or other family members who create an account, set up a storyteller profile, and invite a loved one to participate.
• Storytellers — the parents, grandparents, or other loved ones who receive an invite and share their story through a voice conversation. Storytellers don't create an account or password; a private invite link is how they access Memorate. Because their situation is different, Section 10 is written specifically for them.

This policy covers our website, web application, and related services (the “service”). By using Memorate, you agree to the collection and use of information as described here. If you're a Storyteller, you're always free to decline participation at any point, including mid-conversation.

We know this service touches something deeply personal: a family's history, in a parent's own voice. We've written this policy to be genuinely readable, not just legally defensible. If anything is unclear, contact us (Section 14).

2. Information We Collect

Account information (Sponsors). When you sign up, we collect your name and email address. We use passwordless email one-time-code sign-in, so we do not store a password.

Storyteller profile information. When a Sponsor sets up a profile for their loved one, we collect the Storyteller's name, email address (if used for an invite), relationship to the Sponsor, and biographical context the Sponsor provides to help the AI ask better questions (where they grew up, their profession, family milestones, topics they love or want to avoid).

Voice recordings. We record the audio of interview conversations — both AI-guided sessions and live calls between a Sponsor and a Storyteller. This is voice data, and we treat it as biometric information; see Section 4.

Transcripts. We convert voice recordings into text so conversations can be summarized, searched, and turned into written stories.

Photos. Sponsors and Storytellers can upload photos to accompany a story. We use AI to analyze photos and generate descriptions (who or what is in the photo, the setting, the era) to help weave them into the finished story or album.

Uploaded materials. Families can upload source documents — letters, journal pages, existing biographies, family trees — that inform the story the AI helps compile.

Voice clone data (optional). If a family chooses to create a synthetic voice model of a Storyteller (for example, to narrate a memoir in their own voice), we process voice recordings to generate that model. This is sensitive biometric data, handled under the specific rules in Section 4, and never created without the Storyteller's own explicit, separate consent.

Payment information (Sponsors). If Memorate is a paid product for you, billing is handled by a third-party payment processor. We receive limited billing details (such as the last four digits of a card and billing address) but do not store full card numbers ourselves.

Communications. If you email us or submit a support request, we keep a record so we can help you and maintain a history of consent and requests.

Technical and usage information. Like most web services, we automatically collect some technical data — IP address, browser and device type, pages visited, and timestamps — for security, debugging, and reliability, not for advertising profiles.

We do not intentionally collect government ID numbers, precise geolocation, health records, or financial account credentials, and we ask that you not include such information in profile fields, uploaded materials, or conversations if you can avoid it.

3. How We Use Your Information

We use the information above to:

• create and secure Sponsor accounts, and authenticate sign-ins via email code;
• build and send invites so Storytellers can access their private conversation link;
• power the AI interview experience — generating relevant topics and questions, conducting the voice conversation, and hosting live calls;
• transcribe conversations and generate AI summaries, stories, memoirs, photo albums, graphic novels, and mini-documentary films from what a family provides;
• analyze uploaded photos to generate descriptions that place them in the right context;
• organize everything a family has collected into their private digital vault;
• send transactional emails: invites, session reminders, processing-complete notifications, and account or billing notices;
• provide customer support and process payments;
• maintain the security, integrity, and reliability of the service, including detecting abuse and debugging errors; and
• comply with legal obligations and enforce our Terms of Service.

We do not use your family's stories, photos, or voice recordings to build advertising profiles, and we do not use them for third-party marketing. Any AI processing of your content is in service of producing the outputs you asked for — a story, a keepsake, a summary — not for unrelated purposes.

4. Voice Recordings & Biometric Data

This is the part of the policy we most want you to read, because it covers the most sensitive thing we handle: the sound of a person's voice.

Why this matters legally, not just personally. A voice recording — and especially a voiceprint or synthetic voice clone derived from one — is considered a biometric identifier under laws like the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, Washington's biometric privacy law, and the “sensitive personal information” categories under the CCPA/CPRA. These laws generally require that we tell you in advance what biometric data we collect and why, get your affirmative consent before collecting it, publish a retention and destruction schedule, and never sell it. We've built Memorate around those requirements, not the minimum we could get away with.

Consent before recording begins. Before any conversation is recorded, the person being recorded sees a plain-language notice explaining that the conversation will be recorded, transcribed, and used to generate content the inviting Sponsor (and anyone they've shared the vault with) will be able to see. Recording doesn't start until the person affirmatively agrees. A Storyteller's consent is their own — a Sponsor cannot consent to being recorded on someone else's behalf — and a Storyteller can decline or stop at any time, including mid-session.

Voice cloning requires separate, explicit opt-in. Creating a synthetic voice clone is a materially different, higher-sensitivity use than simply recording and transcribing a conversation, and we treat it that way. We only create a voice clone when the person whose voice it is has given explicit, informed, opt-in consent to that specific use — a general agreement to be recorded is not enough. That consent is documented and can be withdrawn at any time by requesting deletion of the voice clone.

We do not sell biometric data. We do not sell, rent, license, or trade voice recordings, transcripts, or voice clones to anyone, for any purpose. Voice data is shared only with the AI providers strictly necessary to run the conversation and produce your family's stories (Section 5), under contracts that restrict their use of it to providing that service to us.

Retention and destruction. We retain voice recordings and voice clones only as long as needed for the purpose they were collected for, or as long as the associated storyteller profile remains active — whichever is shorter. In no case do we retain biometric identifiers longer than three years after your last interaction with Memorate, consistent with BIPA's default destruction schedule.

Your control. You can download the original audio of any conversation, and delete individual recordings or an entire voice clone, at no cost, at any time — from within the service or by contacting us.

5. AI Processing & Service Providers

Memorate uses AI at several stages: conducting the voice interview, transcribing it, analyzing photos, and writing the summaries and keepsakes your family receives.

To run the service, we rely on a small set of trusted third-party providers — for cloud hosting and storage, AI voice and transcription, AI writing, email delivery, and live calls. We share only the data each provider needs to do its job, and we bind each of them to contractual terms that restrict their use of your data to providing the service to us.

Under those agreements, your voice recordings, photos, transcripts, and story content are not used to train their general-purpose AI models. A current list of the specific providers we work with is available on request — just contact us (Section 14).

6. How We Share Information

We do not sell your personal information. We have never sold, and do not sell, personal information — names, emails, photos, transcripts, or biometric data — to data brokers, advertisers, or anyone else, and we do not share it for cross-context behavioral advertising. This is true for every user, not just California residents (who have specific rights in Section 9).

Beyond that baseline, we share information only in these circumstances:

• With the service providers described in Section 5, strictly to provide the service.
• Within a family's own vault. The Sponsor who creates a profile can see the resulting stories, transcripts, and photos, and can invite additional family members to view a Storyteller's shared vault. Storytellers are told, before recording, that their conversation will be visible to the Sponsor and anyone the Sponsor shares the vault with.
• For legal reasons — if required by law, subpoena, or court order, or to protect the rights, property, or safety of Memorate, our users, or the public.
• In a business transfer — if Memorate is involved in a merger, acquisition, financing, or sale of assets, personal information may transfer as part of that transaction; we'll notify affected users, and this policy continues to govern unless a new one is presented and agreed to.
• With your direction — if you ask us to share or export data to a third party on your behalf.
• In aggregated or de-identified form that can't reasonably be tied back to you, to understand and improve the service. This never includes raw voice recordings or identifiable biometric data.

7. Data Retention & Deletion

We keep your information for as long as your account (or your family's vault) is active, plus a limited period afterward, unless a longer period is required by law or a shorter one is required for biometric data (Section 4).

Your control over your data. Memorate is built so families own their material, not us. At any time, and at no cost, you can export/download the originals of everything — voice recordings, transcripts, photos, uploaded materials, and generated keepsakes — and delete individual items or an entire storyteller profile and everything associated with it.

After a deletion request. We remove the content from active systems within 30 days, and it is purged from encrypted backups within 90 days thereafter. We may retain a minimal record that a deletion occurred (not the deleted content itself) to comply with legal obligations and prevent abuse.

Account closure. If a Sponsor closes their account, we treat that as a request to delete the associated storyteller profiles and content unless you tell us otherwise — for example, if you'd like to export everything first, which we strongly encourage.

8. Security

We take reasonable, industry-standard steps to protect your information, including:

• Encryption in transit and at rest. Data moving between your device and our servers is encrypted using TLS; data stored in our database and file storage is encrypted at rest using our providers' standard encryption.
• Access controls. Access to production data is limited to team members who need it, using role-based, least-privilege access. Storyteller access is scoped to a single-use, revocable invite token rather than a persistent login.
• Authentication. Sponsor accounts use passwordless email code sign-in and short-lived session tokens rather than long-lived stored passwords.
• Backups. We maintain regular, encrypted backups to protect against accidental loss.
• Vendor diligence. We select subprocessors (Section 5) that maintain their own security programs and are bound by contract to protect your data.

No system is perfectly secure, and we won't claim otherwise. We do not currently hold formal certifications like SOC 2 or ISO 27001, and Memorate is not a healthcare product and does not claim HIPAA compliance. If we become aware of a security incident affecting your personal information, we will notify affected users and relevant authorities as required by law.

9. Your Privacy Rights

Regardless of where you live, you have meaningful control over your information with Memorate. You can:

• Access the personal information we hold about you.
• Export/download the originals of your voice recordings, transcripts, photos, and materials, for free, at any time.
• Correct inaccurate information in a storyteller profile or account.
• Delete your account, a storyteller profile, or specific content (Section 7).
• Withdraw consent for future recording or processing at any time (this doesn't affect the lawfulness of anything already done based on earlier consent).

To exercise any of these rights, contact us using the details in Section 14. We will verify your identity before acting on a request (see Section 10 for how this works if you're a Storyteller without a login).

California Residents (CCPA/CPRA)

If you're a California resident, you additionally have the right to know what personal information we've collected, used, and disclosed and why; to delete personal information we've collected from you, subject to legal exceptions; to correct inaccurate information; to limit the use of sensitive personal information (which includes your biometric data); to opt out of sale or sharing (not applicable in practice, since we don't sell or share); and to not be discriminated against for exercising these rights. You may use an authorized agent to submit a request, subject to identity verification. We will respond to verifiable requests within 45 days, extendable once by another 45 days for complex requests.

Other U.S. State Privacy Laws

If you're a resident of a state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, or Utah, among others as they take effect), you have similar rights to access, correct, delete, and obtain a portable copy of your personal information, and to appeal a denied request. Contact us and we'll honor the rights available under your state's law.

EU/UK/EEA Users (GDPR)

Memorate is a U.S.-based product primarily serving U.S. families, but if you're located in the EU, UK, or EEA, you have rights under the GDPR including access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent, as well as the right to lodge a complaint with your local supervisory authority. Our legal basis for processing is generally your consent (for voice recordings and biometric data specifically), our contract with you to provide the service, and, in limited cases, our legitimate interests (such as securing the service). We'll respond to GDPR requests within one month, extendable by two further months for complex requests.

10. Storytellers Who Don't Have Accounts

Most privacy policies assume the person reading is the one who signed up. For Memorate, that's often not true — so this section is written for you directly if you're a Storyteller.

How you got here. A family member (a Sponsor) set up a profile describing you and sent you an invite by email. Clicking that link — a “magic link” tied to a private, single-use invite token — is how you access Memorate. You don't create an account, choose a password, or give us a credit card. The token can expire or be revoked.

What the Sponsor told us about you. The inviting family member may have entered basic biographical context (your name, relationship to them, and details meant to help the AI ask good questions) before you ever opened the link. You're always able to see, correct, or ask us to remove that information.

Your consent is your own. Nobody — not even the family member who invited you — can consent to your voice being recorded on your behalf. Before your first conversation, you'll see a clear screen explaining that the conversation will be recorded and transcribed, turned into a written story and possibly other keepsakes, and made visible to the inviting Sponsor and anyone they've shared the vault with. Recording only starts once you actively agree. You can decline, ask questions first, or stop at any point — nothing is recorded without your say-so, and stopping mid-conversation doesn't forfeit anything you've already shared unless you ask us to delete it.

Voice cloning needs your separate “yes.” If your family wants to create a synthetic version of your voice, that is never done just because a Sponsor requested it. We ask you directly, in plain language, before creating a voice clone, and creation only proceeds with your explicit agreement. You can revoke that consent and have the clone deleted at any time.

Your rights work the same as anyone else's — we just verify you differently. Because you don't have login credentials, we verify your identity through your invite link, the email or phone number the invite was sent to, or another reasonable method, before acting on a request. Once verified, you can ask to see what we've collected about you, download your original recordings and photos, correct inaccurate profile details, or delete your data — including a specific conversation, your voice clone, or everything associated with you. You don't need the Sponsor's permission, and we won't route your request through them without your say-so.

If you'd simply rather not participate, tell us or the inviting family member, and we will not send further invites and will honor any deletion request for what's already been collected.

11. Children's Privacy

Memorate is not directed to, and is not intended for use by, anyone under 18. The service is designed for adult Sponsors and, on the Storyteller side, for older adults sharing their life story. We do not knowingly collect personal information from children under 13, and any storyteller profile a Sponsor creates must describe an adult.

If we become aware that we've inadvertently collected personal information from a child without appropriate consent, we will delete it promptly. If you believe a child's information has been provided to us, contact us (Section 14) and we'll investigate and remove it.

12. International Data Transfers

Memorate and its infrastructure are based in the United States. If you access Memorate from outside the U.S., your information will be transferred to, stored, and processed in the U.S. and other countries where our subprocessors operate, which may have data-protection laws different from those in your country.

Where we transfer personal data from the EU, UK, or EEA to a country without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses with our subprocessors.

13. Changes to This Policy

We may update this Privacy Policy from time to time as Memorate evolves or as laws change. When we do, we'll update the “Last updated” date at the top of this page, and for material changes — especially any change to how we collect, use, or retain voice recordings or biometric data — we'll provide more prominent notice, such as an email to Sponsors and/or Storytellers, and, where required by law (including biometric privacy laws like BIPA), obtain fresh consent before applying the change to your data. We encourage you to review this policy periodically.

14. Contact Us

If you have questions, concerns, or requests regarding this policy or your personal information — whether you're a Sponsor or a Storyteller — reach out to us:

Email: hello@memorate.co

For California residents submitting a CCPA request, or EU/UK/EEA residents submitting a GDPR request, please use the same contact and clearly state the nature of your request so we can route and verify it appropriately.