Privacy Policy

Scope of Application

This Privacy Policy explains how we collect, use, store, and share personal information regarding the use of Memly services (Web, iOS, and Android versions).

2.1 Information You Provide Directly

Account Information:

• Email address
• Password (encrypted)
• Display name
• Profile picture (optional)

Payment Information:

• Credit card information (processed by payment providers)
• Billing address
• Transaction history

2.2 Learning Content

• Uploaded learning materials (PDF, images, text, etc.)
• AI-generated flashcards
• Learning progress data (accuracy rates, review history, etc.)
• Learning settings and customization information

2.3 Automatically Collected Information

Technical Information:

• IP address
• Browser information
• OS and device information
• Access date and time

Usage Information:

• Page viewing history
• Feature usage patterns
• Error logs
• Performance data

3.1 Primary Uses

• Service Provision: Account management, AI flashcard generation, learning progress tracking
• Customer Support: Inquiry response, technical support
• Payment Processing: Billing, refund processing
• Service Announcements: Notices about important changes, version updates, and new features (you can stop receiving these at any time using the link in the email)

3.2 Improvement and Analysis

• Service Improvement: Feature enhancement, bug fixes, new feature development
• Usage Analysis: Usage statistics, performance analysis
• Security: Fraud prevention, security enhancement

3.3 Marketing Use (Consent-Based)

The following uses are only conducted with your explicit consent.

• Promotional and campaign information
• Learning improvement tips and advice

Consent can be withdrawn at any time.

4.1 Sharing Necessary for Service Provision

• Payment Processors: Stripe Inc. and others (credit card processing)
• Cloud Service Providers: Vercel Inc., Supabase Inc. (data storage and processing)
• AI Service Providers: OpenAI, Google, etc. (learning content you enter is sent to provide AI features)

4.2 Legal Disclosure Requirements

We may disclose personal information to the minimum extent necessary in response to legal requirements, court orders, or requests from government agencies.

5.1 Cookie Use and Consent Management

Except for essential cookies, we use cookies only after obtaining your explicit consent. A cookie consent banner is displayed on your first visit, and functional cookies are restricted if you do not consent.

• Essential Cookies (no consent required): Necessary for maintaining login status and security protection
• Functional Cookies (consent required): Saving learning settings, remembering UI preferences
• Analytics Cookies (consent required): Anonymized usage statistics for service improvement

5.2 Profiling and Automated Decision-Making

Purpose of Processing: Providing individually optimized learning experiences
Processing Logic: Spaced repetition algorithm based on forgetting curve theory
Your Rights: Right to object to profiling, right to manual setting changes

5.3 Third-Party Sharing Details

Third-party sharing of personal data is conducted only after obtaining your explicit consent, except where permitted by law. Consent is obtained specifically and individually, and can be withdrawn at any time.

Sharing Requiring Consent:

• Marketing purposes
• Statistical and analytical purposes
• Joint use for new service development

Sharing Not Requiring Consent:

• Legal requirements
• Emergency protection of life or body
• Service providers (under appropriate supervision)

5.4 Pseudonymized and Anonymized Information

We may use your learning data as pseudonymized information for service improvement and new feature development. Processing is conducted with appropriate technical measures, and matching with the original personal data is prohibited.

How We Use Processed Information:

• Learning algorithm improvement
• New learning feature development
• Statistical analysis for service quality improvement

5.5 California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA).

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to say no to the sale of personal information
• Right to delete personal information
• Right to non-discrimination for exercising your rights

Note: We do not sell your personal information.

6.1 Technical Safeguards

• SSL/TLS encrypted communication
• Database encryption
• Access control and authentication
• Regular security audits
• Intrusion detection systems

6.2 Organizational Safeguards

• Employee education and training
• Minimized access privileges
• Regular access rights review
• Incident response system
• Third-party security certification

6.3 Data Breach Response

7.1 Your Rights in Detail

• Right of Access: Right to request disclosure of personal data we hold (available from account settings)
• Right to Rectification: Right to request correction of inaccurate personal data (editable from account settings)
• Right to Erasure (Right to be Forgotten): Right to request deletion of personal data (handled through account deletion)
• Right to Data Portability: Right to request transfer of data (available through the export function)
• Right to Restriction: Right to request restriction of data processing (contact support)
• Right to Object: Right to object to data processing (contact support)

7.2 How to Exercise Your Rights

1. Self-service through account settings
2. Contact the support team (admin@memly.ai)
3. Response within 30 days after identity verification

8.1 Transfer Destinations

To provide our services, we may transfer your personal data to the following countries and regions.

• Japan: Headquarters location
• EU: Adequacy decision
• United States: Standard contractual clauses

8.2 Safeguards

For transfers to countries without adequacy decisions, we implement appropriate safeguards such as EU Standard Contractual Clauses (SCCs), approved codes of conduct, and certification mechanisms.

9.1 Active Users

• Account Information: During use
• Learning Data: During use
• Log Data: 2 years

9.2 After Account Deletion

• Account Information: Deleted after 30 days
• Learning Data: Deleted after 90 days
• Payment Records: Retained for 7 years (period required by law)

Children Under 13

We do not knowingly collect personal information from children under 13. If children under 13 use our service, parental consent is required.

11.1 Apple App Store Purchases

Subscription purchases on iOS are processed through Apple Inc.'s App Store payment system. We do not have direct access to the payment information (credit card numbers, etc.) linked to your Apple ID. Such data is processed in accordance with Apple Inc.'s Privacy Policy.

11.2 Purchase-Related Data We Collect

• Subscription type (plan name, duration)
• Purchase and renewal dates
• Subscription status (active, expired, cancelled, etc.)
• Purchase receipt information (Apple-issued verification tokens)

This information is used solely for service provision and subscription management.

11.3 Google Play Store Purchases

Purchases on Android are processed through Google LLC's payment system. As with Apple, we do not have direct access to your credit card or payment details.

12.1 App Tracking Transparency (ATT)

On iOS, Memly complies with Apple's App Tracking Transparency framework. We request your explicit permission before tracking your data across other companies' apps and websites. Declining tracking does not affect the core functionality of the service.

12.2 Advertising Identifiers (IDFA / GAID)

12.3 Analytics and Performance Measurement

We may collect anonymized app usage data for the purpose of improving service quality. This data is not used to personally identify you.

14.1 How to Delete Your Account

You have the right to request deletion of your account and associated data at any time. Account deletion can be performed through the following methods.

1. In-app deletion: Settings > Account > Delete Account
2. Email request: Send a deletion request to admin@memly.ai

14.2 Data That Will Be Deleted

• Account information (email, display name, profile picture)
• Learning data (flashcards, progress, review history)
• Personal settings and customization
• Uploaded learning materials

14.3 Important Notes

15.1 Purpose of Push Notifications

Memly may send push notifications for the following purposes.

• Study reminders (review timing notifications)
• Important service announcements
• Security alerts

15.2 Managing Notifications

Push notifications can be disabled at any time through the app settings or your device settings. Disabling notifications does not affect the core functionality of the service.

15.3 Data Collected

We collect your device's push notification token for the purpose of delivering notifications. This token is used solely for notification delivery and is not used to personally identify you.