memox.
Book a review

Privacy Policy

Last updated: October 22, 2026

1. Who We Are

Memox Inc. (“Memox,” “we,” “our,” or “us”) provides AI voice and chat agents for businesses. We are the data controller responsible for the personal data described in this policy. This policy explains what we collect when you visit memox.io, interact with our AI chat or voice demos, book a demo, use the Memox app (including connecting accounts such as Gmail or a Shopify store to it), or otherwise contact us, and what rights you have over that data. How we handle data from a connected Google account is described in Section 12. How we handle data from a connected Shopify store is described in Section 13.

Registered address: 43253 Brookford Sq, Ashburn, VA 20147, US. For any privacy question or request, contact us at [email protected].

2. Information We Collect

Information you give us:

  • Contact details (name, email, phone number) when you book a demo, request a call, or get in touch.
  • Business details you enter to tailor a demo (your industry and what you sell or provide).
  • The content of messages you send us, including chat conversations with our AI agent.

Chat and voice interaction data:

  • Transcripts and metadata of conversations you have with the Memox AI chat agent.
  • If you use the “Call me” feature, the phone number you provide and call-related data (including call audio and metadata) processed through our telephony provider (Telnyx) to place the call.

Information collected automatically:

  • Technical data such as IP address, browser type, device information, and approximate location.
  • Usage data such as pages viewed, referring site, links clicked, and time on page.
  • Cookies and similar technologies (see Section 4).

3. How We Use Your Information

We use personal data for the following purposes, relying on the legal bases noted (where the GDPR applies):

  • Provide and operate our website, demos, and services, performance of a contract / legitimate interests.
  • Respond to inquiries and schedule and conduct demos, legitimate interests (managing pre-sales communications).
  • Place a requested call via the “Call me” feature using the phone number you provide, your request / consent. Call audio and metadata are processed through our telephony provider (Telnyx).
  • Measure and improve site and product performance through analytics, consent (where required) / legitimate interests.
  • Market our products, including advertising and measurement on third-party platforms, consent.
  • Maintain security, prevent fraud, and comply with legal obligations, legal obligation / legitimate interests.

4. Cookies & Tracking Technologies

We use cookies and similar technologies in four categories. Under our current US-focused B2B measurement configuration, analytics may load on a first visit before you make a choice. An explicit decline records your choice and sends a denied consent update; processing completed before the decline is unaffected. Advertising storage and personalization remain disabled unless you accept them in our cookie banner. When you decline advertising cookies, some tools (including Google via Consent Mode) may still receive an anonymized or aggregated signal for measurement; no advertising identifiers are transmitted in that case.

  • Strictly necessary, required for the site to function and to remember your cookie choice.
  • Functional, used to complete a service you request, such as displaying Cal.com availability after you submit a demo or fit-review request.
  • Analytics, to understand site usage (Google Analytics) and review interaction patterns and session replays (Microsoft Clarity). Clarity may load before your first choice but does not load on later visits after an explicit decline.
  • Advertising, to measure and personalize ads (Google Ads and the Meta Pixel).

We treat the post-submission Cal.com calendar as a functional scheduling service. It may process your name, email, time-zone, availability choices, and cookies needed to complete the booking. If you have not accepted advertising cookies or have declined them, we do not send Cal.com advertising identifiers and we suppress browser and server advertising conversion events for an explicit decline.

You can change or withdraw your consent at any time by clicking the “Cookie Preferences” link in the footer of any page, which re-opens the consent banner. You can also clear your browser’s site data for memox.io, which resets your saved preference and causes the banner to reappear on your next visit. Withdrawing consent does not affect processing carried out before you withdrew it.

5. How We Share Your Information

We do not sell your personal data to third parties for their own commercial use. We do share certain data with advertising platforms (Google, Meta) for measurement and targeting, which may qualify as a “sale” or “sharing” under some U.S. state laws, see Section 8 for your opt-out rights. We share personal data with:

  • Service providers (processors) acting on our instructions, including: hosting (Hetzner, servers in Helsinki, Finland), network and backup storage (Cloudflare), AI model provider (Microsoft Azure OpenAI), error reporting (Sentry), AI request tracing (Langfuse, self-hosted by Memox), product analytics for the Memox web dashboard (PostHog), the source of store data for the Memox Shopify app (Shopify), our product backend (hub.memox.io, operated by Memox Inc.), scheduling (Cal.com), analytics and interaction measurement (Google, Microsoft Clarity), advertising and measurement (Google, Meta), telephony for the “Call me” feature (Telnyx).
  • Legal and compliance recipients where required by law, regulation, or legal process, or to protect our rights and users.
  • Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this policy.

Some advertising and analytics activity may constitute a “sale” or “sharing” of personal information for cross-context behavioral advertising under certain U.S. state laws. See Section 8 for how to opt out.

6. International Data Transfers

We and our service providers may process your personal data in the United States and other countries outside your own. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses. For transfers to the United Kingdom we rely on the UK International Data Transfer Addendum to those clauses, and for transfers involving Switzerland we rely on the Standard Contractual Clauses as recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC). You may contact us for copies of these safeguards.

7. Data Retention

We keep personal data only for as long as necessary for the purposes set out in this policy, including to provide our services, comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we delete or anonymize it.

Indicative retention periods: demo/contact inquiry data, up to 24 months after last interaction; chat transcripts, up to 12 months; call audio and metadata, up to 90 days unless a longer period is needed to resolve a dispute; analytics data, per provider defaults (Google Analytics ~14 months). You may request erasure at any time.

Other retention periods:

  • Database backups: 35 days.
  • AI request traces: 90 days.
  • Access log of reads of Shopify customer personal data: 365 days.
  • Shopify store data: deleted when you uninstall the app or when Shopify sends an erasure request. See Section 13.

8. Your Privacy Rights

EEA, UK, and Switzerland (GDPR / UK GDPR): You have the right to access, rectify, erase, restrict, or object to the processing of your personal data; the right to data portability; and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority. For example: in Germany, your state authority or the BfDI (bfdi.bund.de); in Austria, the Datenschutzbehörde (dsb.gv.at); in the UK, the ICO (ico.org.uk). A full list of EEA authorities is at edpb.europa.eu.

California (CCPA / CPRA): You have the right to know, access, correct, and delete your personal information; the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising your rights. To opt out of sale or sharing, or to make any request, contact us at [email protected].

Virginia (VCDPA): If you are a Virginia resident, you have the right to access, correct, delete, and obtain a portable copy of your personal data; to opt out of targeted advertising and profiling; and to appeal a refusal of your request. To exercise these rights, contact us at [email protected].

To exercise any right, email us at [email protected]. If you are in the EEA, UK, or Switzerland, we will respond within one month of receiving your request; we may extend this by up to two further months for complex or multiple requests and will notify you within the first month. If you are in California or Virginia, we will respond within 45 days, extendable by a further 45 days with notice. We may need to verify your identity before acting on a request.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

  • Data is encrypted in transit (TLS) and at rest.
  • Access to production data is limited to the Memox founders.

10. Children’s Privacy

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page and revise the “Last updated” date above. Material changes will be communicated where required by law.

12. Google User Data

The Memox app lets you connect your own Google account. This section explains what Google user data we access, how we use, store and share it, and how you can remove it.

What we access, and why:

  • Your Google account email address, to identify which account you connected.
  • Gmail messages and settings (read only). When you ask the Memox assistant a question about your email, it searches your mailbox and opens the relevant messages to answer you. It reads your mail only to carry out what you asked.
  • Gmail drafts and sending. When you ask the assistant to write an email, it creates a draft in your own Gmail Drafts folder. It sends an email only after you review and approve that exact message in the app. It never sends on its own.
  • Google Calendar, if your organization connects it to a Memox agent: reading your availability and creating the events you or your customers book.

How we store it:

  • The access tokens Google issues to Memox are encrypted at rest.
  • We do not copy your mailbox. We store only the emails the assistant opened to answer one of your requests, so it can cite them later, and we keep them within your workspace.
  • When you disconnect Gmail in the app, we delete the stored tokens and the stored emails. You can also remove Memox’s access at any time from your Google Account permissions page.

How we share it:

  • To produce the assistant’s answers and drafts, the relevant email content is processed by our AI model provider, Microsoft Azure OpenAI Service, acting as our processor. Microsoft does not use this data to train its models.
  • Our hosting and infrastructure providers store and process it on our behalf, under the same obligations.
  • We do not sell Google user data, use it for advertising, or transfer it to data brokers or information resellers.
  • We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
  • People at Memox do not read your Google user data unless you ask us to (for example, for support), it is needed for security purposes such as investigating abuse, it is required to comply with applicable law, or it has been aggregated and anonymized for internal operations.

Memox’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Shopify Stores

This section applies when a merchant installs the Memox app on a Shopify store. For the personal data of a merchant’s customers, Memox acts as the merchant’s processor and the merchant is the controller.

What we read:

  • Products, inventory, orders, discounts and locations. This access is read only.
  • When the store owner looks up a customer or abandoned checkouts, we also read that customer’s name, email and phone number. We do not read addresses.
  • We read data only when the owner asks a question, or when a task the owner set up runs.

How we use and protect it:

  • We use it only to answer the store owner.
  • Memox never changes the store.
  • Store access tokens are encrypted.
  • Every read of a customer’s personal data is logged. Only Memox staff can see this log. We keep it for 365 days.

Deletion and requests:

  • When a merchant uninstalls the app, or when Shopify sends us a customer or shop erasure request, we delete the store connection. Within 30 days we also remove that customer’s details from conversations, documents and task records.
  • A merchant can ask what data we hold about a customer. We answer within 30 days. Contact us at [email protected].

To answer the owner, the relevant store data is processed by our AI model provider, Microsoft Azure OpenAI Service, and by the other providers listed in Section 5.

14. Contact Us

For questions about this policy or your personal data, or to exercise your rights, contact:

Privacy Policy | Memox