Created 13 October 2026 Last updated 2 November 2026

GDPR

HyperMemory, with its business address at 20 Olive Avenue, Unit 102, North York, Ontario, M2N 7G5, Canada, is designed and operated to support compliance with the General Data Protection Regulation (GDPR), with documented accountability, privacy-by-design, security, rights handling, deletion, incident-response, processor, and transfer controls (GDPR Arts. 5(2), 24–25, 28, and 32–35).

Public summary

• HyperMemory acts as controller for account, billing, security, support, and business operations, and generally as processor for customer-controlled memory content (Arts. 4(7)–(8) and 28).
• Controller processing uses contract, legitimate interests supported by an assessment where required, legal obligation, or consent as applicable (Arts. 6–7). Processor activity follows documented customer instructions (Art. 28(3)).
• Customers control the content they submit. HyperMemory personnel cannot retrieve, search, or view customer memory content or files through administrative or support tooling, and HyperMemory will not build tooling that creates that access. Customer self-service export and deletion, authenticated account-side records, and documented customer instructions define the supported assistance boundary.
• Privacy requests can be submitted to privacy@hypermemory.io. HyperMemory does not perform customer KYC and does not require passports, government identity documents, or proof of address for ordinary privacy requests; verification is proportionate to the account and request risk (Arts. 12(2) and 12(6)).
• The internal response target is 20 calendar days and never later than the applicable legal deadline. Direct-marketing objections and opt-outs are applied immediately (Arts. 12(3) and 21(2)–(3)).
• Active production deletion is targeted within 30 days; protected backup copies expire within 90 days unless a documented legal hold or binding obligation applies (Arts. 5(1)(e) and 17).
• HyperMemory is globally available. Processing locations, recipients, transfers, and retention are maintained in controlled records (Arts. 13–14, 30, and 44–49).
• Data Processing Agreements are available for paid and enterprise plans where applicable; processor terms are incorporated into service terms where no standalone DPA is used (Art. 28).
• Enterprise customers receive at least 30 days’ advance notice of new or replacement subprocessors, subject to the applicable agreement (Art. 28(2)).
• HyperMemory does not sell personal information, use advertising cookies or cross-context behavioural advertising, or make solely automated decisions with legal or similarly significant effects (Art. 22).
• Google Analytics on the marketing site is optional and loads only after opt-in consent; no advertising pixel is used (Art. 7 and ePrivacy Directive Art. 5(3)).

Current evidence status

Area	Current state
Governance and roles	Controller and processor roles, privacy ownership, approval authority, and privacy-governance controls are documented and approved.
Lawful basis, RoPA, and notices	Lawful bases, processing purposes, recipients, locations, retention rules, records of processing, legitimate-interest assessments, and transparency controls are documented and maintained.
Rights operations	Email intake, proportionate identity verification, the no-KYC rule, response targets, secure delivery, self-service capabilities, and account-side support boundaries are implemented.
Security and privacy by design	Technical and organizational measures, privacy-by-design review, change control, incident response, DPIA triggers, and security governance are documented and implemented.
Retention and deletion	Active-data deletion, protected-backup expiry, lifecycle management, legal-hold handling, and supplier-exit requirements are documented and implemented.
Processors and transfers	Provider-standard terms, DPAs, SCCs and other transfer safeguards, subprocessor disclosures, processing roles, and approved service boundaries are documented in the controlled supplier register.
Accountability and monitoring	Privacy operations, request handling, compliance monitoring, and control reviews are governed through approved procedures and controlled internal records.