Privacy Policy
This policy explains how Softriq Ltd ("Softriq", "we", "us") handles personal data in Memlira: the website, the web dashboard, the mobile apps and related services.
1. Who we are, and our role
Softriq Ltd, a company registered in England and Wales (company number 16217315), 128 City Road, London, EC1V 2NX, United Kingdom. For any privacy question, contact [email protected]. We are not required to appoint a data protection officer, and have not done so.
| Whose data | Our role |
|---|---|
| Members of a workspace (owners, admins, members), and visitors to our website | Controller |
| People who appear in a business's own data (for example its customers in orders or invoices) | Processor for the business, which is the controller. The Data Processing Agreement applies |
Where the data comes from: account details come from you, or from the workspace that invites you. Business data comes from the systems your business connects (its store, our plugin, Memlira Connect or uploaded files). Security information comes from your device when you sign in.
What you must give us: an email address and a password are needed to create an account. Without them we cannot provide the Service.
Memlira is for businesses and is not intended for anyone under 18. We do not knowingly collect data about children.
2. What we collect
Account: name, email address, password (stored only as a one-way hash), two-step verification settings, role and permissions, and the workspaces you belong to.
Questions and answers: the text of your questions, including text transcribed from voice, the answers, and how each answer was calculated (the plan, the records used and the time).
Voice: when you tap the microphone, your recording is sent to our transcription provider, transcribed, and deleted immediately. We do not store recordings. Only the text becomes part of your question, and you can edit it before you send it.
Data from your business's systems: the records your business connects from its store or systems (for example orders, order lines and stages, customers, products and items, stock levels where the source has them, and invoices). For a store platform, we read only what the connection needs, with read-only access, and keep the access token encrypted. We process these for your business, as its processor.
Security information: when you sign in, we keep a shortened IP address (the network prefix only), your device and browser type, and the time. We use a database stored on our own servers to estimate an approximate city from it, and we include it in security emails ("approximately"). We do not use any outside location service.
Diagnostics: technical error reports from the app and the dashboard, with personal information removed and without the text of questions or answers.
Billing: for paid plans, your plan, subscription status and invoices. Card details are entered on our payment provider's page and never reach our servers. Where a store platform bills you, the platform handles payment.
Push notifications: if you allow notifications, a device token so we can send them. Lock-screen notifications contain no figures, customer names, sources or workspace names.
Website: our public pages set no cookies, and we do not use analytics, advertising or tracking. The site remembers two display choices in your browser (the language banner and the currency). Details are in our Cookie Policy.
3. Why we use it, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service: sign-in, answers, pinned answers, notifications | Account, questions, business data, device token | Contract |
| Billing: trials, subscriptions, reminders before charges, invoices and tax | Account, billing | Contract; legal obligation for tax records |
| Security: protect accounts, detect misuse, send security emails | Security information | Legitimate interests |
| Fix errors and keep answers accurate (quality review, below) | Questions and answers, with names and numbers hidden | Legitimate interests |
| Diagnose technical problems | Diagnostics | Legitimate interests |
| Communicate about the Service | Contract / legitimate interests |
Our legitimate interests are keeping accounts and the Service secure, finding and fixing errors, and keeping answers accurate. You can object to processing based on legitimate interests (section 10).
4. How answers are made, and what AI providers see
- The AI model never sees the values in your business data. It receives your question, the names of the data types and fields available to you, metric definitions and company terms. Our software then queries your data and fills in every number and name in the answer.
- One exception, when you map an Excel file: to suggest which column is which, the model receives the column headers and the format of a few values in each column (for example "a date" or "a 10-digit number"), never the values themselves. A header that is itself data (for example a customer's name, a date or a phone number) is replaced with a placeholder before it is sent.
- Earlier questions in your conversation (and the plans used to answer them) can be sent as context. Earlier answers are not.
- Our AI providers are listed in the Subprocessors list. Under their business terms, they do not use the data we send to train their models, and keep it only for a limited period for security and abuse monitoring.
- No automated decisions about people. Answers are information for your team. We do not make decisions with legal or similarly significant effects on anyone by automated means alone.
5. Quality review
To keep answers accurate and correct mistakes, our quality team may review questions and answers with names and numbers hidden. We never use your data to train any AI model, and we never share it.
Names and numbers stay hidden by default. A member of our team can see full values only with a written reason, for a limited time (60 minutes by default), and every such access is logged. Each workspace owner can see changes our team makes in their workspace in its activity log.
6. Who we share it with
- Subprocessors that help us run the Service (hosting, network, AI models and transcription, email, diagnostics, push notifications). See the Subprocessors list.
- Within your workspace: each member sees only their own questions. Owners and admins see how many questions each member asked, not the text.
- When the law requires it.
We do not sell personal data, and we do not share it for advertising.
7. International transfers
Our servers are in Germany (European Union). Our AI model and transcription providers process data in the United States. Where the law requires it, these transfers are covered by safeguards recognised by UK and EU law, such as the European Commission's standard contractual clauses with the UK International Data Transfer Addendum, in our agreements with those providers. You can ask for a copy of these safeguards at [email protected].
8. How long we keep it
| Data | How long |
|---|---|
| Account | While the account exists |
| Question history (question, answer, how it was calculated) | 12 months |
| A question you delete | Removed everywhere within 24 hours. Only the usage count remains, without text |
| Anonymised quality cases (no names or numbers) | Kept to keep answers accurate |
| Voice recordings | Not stored |
| Previous versions of an uploaded Excel file | 30 days |
| Data from a source you disconnect | Deleted when you disconnect it |
| A deleted workspace | Deleted after 30 days |
| Security information | 12 months |
| Diagnostics | 30 days |
| Billing records | As long as tax and accounting law requires (in the UK, generally 6 years) |
| Backups | Encrypted. 14 days on our server, and up to 30 days in separate encrypted copies that Softriq controls and our server cannot reach |
9. Deleting your account
You can delete your account in the app or on the web, under Account > Delete account. We ask for your password again (and your two-step code, if you use one), then delete your account, your question history and your memberships, and send you a confirmation email. A workspace owner first transfers ownership or deletes the workspace. Data your business connected stays with the business's workspace.
10. Your rights
Depending on where you live, you have rights over your personal data: to access it, correct it, delete it, restrict its processing, and receive it in a portable form. To use them, email [email protected]. We reply within one month.
Your right to object. You can object at any time to processing we base on legitimate interests (security, fixing errors and quality review). We will stop, unless we have compelling legitimate grounds or need the data for legal claims.
Complaints. You can complain to a data protection authority. In the UK, this is the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live elsewhere, you can complain to the authority in your country. We would welcome the chance to deal with your concern first.
If you are in a business's data (for example its customer), please contact that business first. We will help it respond.
11. Security
We protect data with access control enforced by the database, encryption, two-step verification for owners and admins, least-privilege access for our team, and logging of administrative access. More detail is on our Security page.
12. Changes
Each version shows its version number and effective date. We post changes here, and email workspace owners at least 30 days before a material change takes effect.
13. Contact
[email protected] · Softriq Ltd, 128 City Road, London, EC1V 2NX, United Kingdom