Privacy Policy

Welcome to MemoLink ("MemoLink," "we," "us," or "our"). MemoLink is a memory preservation platform operated by MemoLink, based in the Republic of Uzbekistan, accessible at memolink.io and through our associated mobile applications and services (collectively, the "Platform").

This Privacy Policy describes how we collect, use, process, store, share, and protect your personal information when you access or use our Platform, including our website, mobile applications, APIs (hosted at api.memolink.io), and all related services. It also describes your rights regarding your personal data and how you can exercise those rights.

By creating an account, accessing, or using the Platform, you acknowledge that you have read, understood, and agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree with the practices described herein, please do not use the Platform.

This policy applies to all users worldwide, including those in Uzbekistan, the Commonwealth of Independent States (CIS), and all other regions where MemoLink operates or plans to expand.

We collect information to provide, improve, and personalize the MemoLink experience. The types of information we collect include:

2.1 Information You Provide Directly

• Account Registration Data: When you create an account, we collect your phone number, first name, last name, email address, and password. Your password is stored using industry-standard cryptographic hashing and is never stored in plain text.
• Verification Data: We collect one-time passwords (OTP) sent to your phone number for identity verification during registration and authentication.
• Event Data: When you create or participate in events, we collect event titles, descriptions, dates, times, venue names, location addresses (including GPS coordinates/geolocation data), and event settings such as access level and maximum attendees.
• Media Content: Photos, videos, voice notes, and other media files you upload to memory capsules, event albums, or your profile.
• Communications: Messages, feedback, support requests, and any other communications you send to us.

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type and version, unique device identifiers, screen resolution, and device settings.
• Usage Data: Pages visited, features used, actions taken, time spent on the Platform, click patterns, navigation paths, search queries, and interaction data. We use Vercel Analytics to collect and analyze this information.
• Log Data: IP addresses, access times, referring URLs, error logs, and server request data.
• Location Data: With your permission, we collect precise geolocation data from your device to enable location-based memory features. You may also provide location data manually when creating events or capsules.
• Local Storage Data: We use browser localStorage to store authentication tokens and session-related information on your device to maintain your logged-in state.

2.3 Information from Third Parties

• Analytics Providers: We receive aggregated and anonymized analytics data from Vercel Analytics about Platform usage and performance.
• Social Media: If you interact with us on platforms such as Telegram or Instagram, we may receive limited profile information in accordance with those platforms' privacy settings.

2.4 Future Data Collection

As our Platform evolves, we may collect additional categories of data to support new features, including but not limited to:

• Biometric and Behavioral Data: Typing patterns, device handling patterns, and other behavioral biometrics for our planned MemoID behavioral passport feature.
• Health and Wellness Data: Emotional health indicators, activity data, and physiological metrics from wearable devices through our planned MemoHealth and MemoSense features.
• Augmented Reality Data: Spatial mapping data and AR interaction data for our planned AR Geo-Memories feature.
• Blockchain Data: Transaction records and digital asset data for our planned MemoChain feature.

Before collecting any new categories of sensitive data, we will update this Privacy Policy, notify you, and obtain your explicit consent where required by applicable law.

We use the information we collect for the following purposes:

3.1 Providing and Maintaining Our Services

• Creating, managing, and securing your account
• Authenticating your identity through phone number verification and OTP
• Enabling you to create, manage, and share memory capsules and events
• Processing event registrations and RSVPs
• Delivering notifications about events, capsule openings, and Platform updates
• Providing customer support and responding to your inquiries

3.2 Improving and Personalizing the Platform

• Analyzing usage patterns to improve features, design, and user experience
• Developing new features, products, and services
• Conducting research and analytics on Platform performance
• Personalizing content and recommendations based on your preferences and activity

3.3 Safety, Security, and Legal Compliance

• Detecting, preventing, and addressing fraud, security breaches, and abuse
• Enforcing our Terms of Service and other policies
• Complying with applicable laws, regulations, and legal processes in the Republic of Uzbekistan and other jurisdictions
• Responding to lawful requests from government authorities

3.4 Communications

• Sending service-related notifications (account verification, security alerts, policy changes)
• With your consent, sending promotional communications about new features, events, and services
• Facilitating communication between event organizers and attendees

We process your personal data based on the following legal grounds:

• Consent: You provide explicit consent when you create an account, grant location permissions, upload content, or opt in to promotional communications. You may withdraw your consent at any time.
• Contractual Necessity: Processing is necessary to fulfill our contractual obligations to you, including providing the Platform's services, managing your account, and processing event registrations.
• Legitimate Interests: We process data to pursue our legitimate business interests, such as improving the Platform, ensuring security, preventing fraud, and conducting analytics — provided these interests do not override your fundamental rights and freedoms.
• Legal Obligation: We process data when required to comply with applicable laws and regulations of the Republic of Uzbekistan, including data protection laws, tax regulations, and lawful government requests.

Where we rely on legitimate interests, we conduct balancing tests to ensure our interests do not disproportionately affect your privacy rights.

We do not sell your personal information. We may share your data in the following circumstances:

5.1 Service Providers

We engage trusted third-party service providers who process data on our behalf to support the Platform's operations:

• Vercel: Website hosting, deployment, and analytics services
• Cloud Infrastructure Providers: Data storage and computing services
• SMS/Communication Providers: Delivery of OTP codes and notifications
• Content Delivery Networks: Efficient delivery of media content (photos, videos)

All service providers are contractually bound to process your data only as instructed by us, maintain confidentiality, and implement appropriate security measures.

5.2 Other Users

• When you create public events or memory capsules, certain information (event title, description, date, location, media) is visible to other users as determined by your privacy settings.
• When you register for an event, your name and registration status may be visible to the event organizer.
• Information in shared or family capsules is visible to invited participants.

5.3 Legal and Regulatory Disclosures

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, or legal process
• Respond to lawful requests from public authorities, including national security or law enforcement
• Protect the rights, property, or safety of MemoLink, our users, or the public
• Detect, prevent, or address fraud, security issues, or technical problems

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or other corporate transaction, your personal data may be transferred as part of the business assets. We will notify you of any such change and any choices you may have regarding your data.

Your personal data is processed and stored on secure servers. Our API infrastructure is hosted at api.memolink.io. We use industry-standard cloud infrastructure providers to ensure high availability, redundancy, and disaster recovery capabilities.

Authentication tokens are stored locally on your device using browser localStorage. These tokens are used to maintain your session and authenticate API requests. You can clear these tokens by logging out of the Platform or clearing your browser's local storage.

Media content (photos, videos, voice notes) is stored using secure cloud storage solutions with appropriate access controls and encryption.

We implement data backup procedures to protect against data loss and ensure business continuity.

We take the security of your personal data seriously and implement comprehensive technical and organizational measures to protect it:

• Encryption: We use 256-bit encryption (AES-256) for data at rest and TLS 1.2+ encryption for data in transit to protect your information from unauthorized access.
• Access Controls: Strict role-based access controls limit employee and contractor access to personal data on a need-to-know basis.
• Authentication Security: Passwords are hashed using industry-standard cryptographic algorithms. OTP-based two-step verification adds an additional layer of account security.
• Infrastructure Security: Our servers are protected by firewalls, intrusion detection systems, and regular security monitoring.
• Security Audits: We conduct regular security assessments and vulnerability testing of our systems.
• Incident Response: We maintain an incident response plan to quickly detect, respond to, and recover from security incidents. In the event of a data breach that affects your personal data, we will notify you and relevant authorities as required by applicable law.

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to implementing and maintaining robust security practices.

You have the following rights regarding your personal data, subject to applicable laws and regulations:

• Right of Access: You have the right to request a copy of the personal data we hold about you, including information about how it is processed and with whom it is shared.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data. You can update most of your information directly through your account settings.
• Right to Deletion (Right to Be Forgotten): You have the right to request deletion of your personal data. Upon receiving such a request, we will delete your data unless we are legally required or have a legitimate reason to retain it. Please note that deletion of your account will result in permanent loss of all associated memory capsules, events, and media content.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another service provider.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain circumstances, such as when you contest the accuracy of the data.
• Right to Object: You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.

To exercise any of these rights, please contact us using the information provided in the Contact section below. We will respond to your request within 30 days. We may ask you to verify your identity before fulfilling your request.

We use the following technologies to collect information and improve your experience on the Platform:

• localStorage: We use browser localStorage to store authentication tokens and user session preferences. Unlike cookies, localStorage data is not automatically sent with HTTP requests — it is accessed only by our client-side application code.
• Vercel Analytics: We use Vercel Analytics to collect anonymous, aggregated data about Platform usage, performance, and visitor behavior. Vercel Analytics is designed to be privacy-friendly and does not use cookies for tracking individual users.
• Essential Operational Data: Certain technical data is collected automatically by our hosting infrastructure for security, performance, and operational purposes.

We do not currently use third-party advertising cookies or tracking pixels. If we introduce such technologies in the future, we will update this Privacy Policy and, where required, obtain your consent before deploying them.

Most web browsers allow you to control cookies and localStorage through their settings. You can clear localStorage data through your browser's developer tools or settings. Please note that disabling or clearing localStorage may require you to log in again.

MemoLink is not directed at children under the age of 16. We do not knowingly collect, solicit, or maintain personal information from anyone under 16 years of age. If you are under 16, please do not attempt to register for or use the Platform, and do not provide any personal information to us.

If we learn that we have collected personal data from a child under 16 without parental consent, we will take immediate steps to delete that information from our servers.

If you are a parent or guardian and believe that your child under 16 has provided personal data to MemoLink, please contact us immediately using the information in the Contact section below, and we will take prompt action to remove the data.

For users between the ages of 16 and 18, we recommend that a parent or legal guardian review this Privacy Policy together with the user and supervise the use of the Platform.

The Platform may contain links to or integrate with third-party websites, applications, and services that are not operated or controlled by MemoLink. This Privacy Policy applies only to our Platform and does not cover third-party services.

Third-party services we currently use or integrate with include:

• Vercel: Hosting, deployment, and analytics (Vercel Privacy Policy)
• Telegram: Community communication and support
• Instagram: Social media presence and engagement

We encourage you to review the privacy policies of any third-party services you interact with through or in connection with the Platform. MemoLink is not responsible for the privacy practices, content, or security of third-party services.

MemoLink is based in the Republic of Uzbekistan. If you access the Platform from outside Uzbekistan, please be aware that your personal data may be transferred to, stored, and processed in Uzbekistan and other countries where our service providers operate.

As we expand to the CIS region and globally, your data may be processed in multiple jurisdictions. These jurisdictions may have data protection laws that differ from those in your country of residence.

When we transfer your data internationally, we take appropriate safeguards to ensure that your personal data receives an adequate level of protection, including:

• Entering into data processing agreements with service providers that include appropriate data protection clauses
• Ensuring service providers implement adequate technical and organizational security measures
• Complying with applicable cross-border data transfer regulations

By using the Platform, you consent to the transfer and processing of your personal data as described in this section.

We retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Our retention practices are as follows:

• Account Data: Retained for the duration of your account's existence. Upon account deletion, we will delete or anonymize your data within 90 days, except where retention is required by law.
• Memory Capsules and Event Data: Retained for as long as your account is active. Time-locked capsules are retained until their scheduled opening date and for a reasonable period thereafter. Deleted capsules are purged within 30 days.
• Media Content: Photos, videos, and voice notes are retained for as long as the associated capsule or event exists. Deleted media is purged from our storage systems within 30 days.
• Usage and Analytics Data: Aggregated and anonymized analytics data may be retained indefinitely for statistical and research purposes.
• Log Data: Server logs and security logs are retained for up to 12 months for security and operational purposes.
• Legal Compliance: Certain data may be retained for longer periods where required by applicable laws and regulations of the Republic of Uzbekistan, including tax, accounting, and legal compliance requirements.

When data is no longer needed, we securely delete or anonymize it using industry-standard methods.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Effective Date" at the top of this Privacy Policy.
• For material changes that significantly affect your rights or how we process your data, we will provide prominent notice through the Platform (such as an in-app notification or banner) or by sending you a notification.
• Where required by law, we will obtain your consent to material changes before they take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your information. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following channels:

• Website: memolink.io
• Telegram: @memolink_io
• Instagram: @memolink_io

We aim to respond to all inquiries and requests within 30 days. For data protection-related requests, please include sufficient information to identify your account and specify the nature of your request.

MemoLink
Republic of Uzbekistan
Website: memolink.io