Privacy policy
Written to match exactly what this website and the Agentu Memory service do. Last updated 1 October 2026.
Who we are
Agentu Memory and this website are operated by [Legal entity name], [registered address], [jurisdiction] ("Agentu", "we"). We are the data controller for the personal data described here. Contact: privacy@agentu.com.
This website
The website sets no cookies, uses no analytics or advertising trackers, and loads nothing from third parties (fonts, scripts and images are served from agentu.com). Our hosting provider records standard web-server logs (IP address, time, page requested, browser type) for security and troubleshooting; we keep them for no longer than 30 days.
Creating a memory
Signing up asks for no e-mail address and no password. Your browser solves a computational puzzle; the memory service keeps a random challenge identifier for fifteen minutes and counts signups per network address for one hour to prevent abuse. Neither is linked to you afterwards. You may enter an optional display name, which is stored with your account.
Your memory
Memories you or your connected models store are encrypted before they are written to our systems, with the key held the way you chose: managed by Agentu by default (opened by our platform only to answer your AI, with every open logged), held only on your own devices if you press "Hold my own keys", or Agentu Sealed (in build; sealed to your biometric), as described on our security page. We store: the encrypted content; a header with category, time, size, key version and provenance (which app and model wrote the entry); the hash chain and signatures; the hashed form of your keys; and an audit log of key activity (for example "key X recalled from category Work at time T") that never contains content.
We decrypt memory content only inside a request you or a key you issued has authorised (for example recall or export), for the duration of that request. We do not use memory content to train models, for advertising, or for any purpose other than serving your requests. We cannot recover your key.
Legal bases
Providing the service you asked for (performance of a contract, GDPR art. 6(1)(b)); preventing abuse and keeping the service secure (legitimate interests, art. 6(1)(f)); and complying with legal obligations (art. 6(1)(c)). Where memory content includes special categories of data, you decide what to store and which keys can read it; we process it only as your processor-like technical intermediary under your instructions.
Where data is stored
The managed service runs in Switzerland (AWS, Zurich region). Backups and encryption keys stay in Switzerland, and we do not transfer memory content outside Switzerland for storage or processing. Switzerland holds an EU adequacy decision and is on the UK adequacy list. Sign-up from this website happens on memory.agentu.com, the Swiss service. Regional homes in the United States and Singapore are in build for organisations whose rules require in-country storage; when one is live your organisation chooses it, and your memory, backups and keys stay inside it. The current state is always on the data residency page.
Business customers
Where an organisation uses Agentu for its people, the organisation is the controller and Agentu its processor under a data-processing agreement; the organisation's administrators control categories, keys and retention. Models an organisation connects receive only what the relevant key allows, under the provider's business terms, which prohibit training on the data.
How long
Your memory is kept until you delete it. Forgetting an entry removes its content immediately and keeps a verifiable tombstone. Deleting a category or your whole memory schedules key destruction after a grace period (during which you can cancel); after that the data is unreadable everywhere, including backups. Audit logs and web-server logs are kept for no longer than 30 days beyond their operational need.
Who else sees data
Our infrastructure provider (Amazon Web Services, in Switzerland) hosts encrypted data under a data-processing agreement. Models and apps you connect receive whatever the key you gave them allows — that is the product — and are governed by their own privacy terms; what each provider may keep is set out on the security page. We never use memory content to train models, never sell or share personal data with anyone else, and use no advertising partners.
Your rights
Under the GDPR and UK GDPR you can access, correct, export, restrict and delete your data, and object to processing. Most of this you can do yourself: list and export your memory, forget entries, delete categories or your whole memory, revoke keys. For anything else, or to complain, write to privacy@agentu.com; you may also complain to your supervisory authority. Because we hold no e-mail address for you, requests about a memory need to be made with a key that can manage it.
Children
The service is not directed at children under 16. We do not knowingly create memories for them.
Changes
We will post changes here with a new date. Material changes are announced in the community channels before they take effect.