Privacy Notice

Last updated: 13 August 2026

This notice explains what personal data Mimory (mimory.space) collects, why, and how it is protected. We aim to keep it short and plain.

1. Who we are

Mimory is an online English-learning platform operated by its founders. Contact: privacy@mimory.space

2. Data we collect

Data	Why
First name, last name, email	Account creation and communication
Hashed password	Authentication — the original is never stored
Lesson schedule, progress, grades	Core service delivery
Payment information (IBAN, amount)	Credit top-ups and receipts
Homework you submit for AI checking	Grading and feedback; not used for model training

3. Cookies and local storage

Two kinds of cookies exist here. Strictly necessary ones make the site work at all and are always set. Analytics and advertising cookies are set only if you accept them — and today none are configured, so in practice nothing beyond the table below is stored.

Cookie	Purpose	Expires
access_token	Keeps you logged in (JWT)	30 minutes
refresh_token	Renews your session automatically	14 days
NEXT_LOCALE	Remembers your language preference	Session

On your first visit a banner asks for your decision. Pressing OK is your consent, including to analytics and advertising cookies; pressing Reject refuses everything that is not strictly necessary. We record the choice and the date it was made. Refusal is enforced, not just noted: no advertising script is loaded, and until you accept, none is requested at all. Undecided counts as refusal. You can change your mind at any time with the button below.

4. Local storage

Your browser also keeps a few small values locally. They never leave your device and are not sent to our servers — you can clear them at any time in your browser settings.

Key	Purpose
mimory_cookies_consent	Your cookie decision and its date, so the banner appears once
Placement-test progress	Lets you resume the level test where you left it

5. Legal basis (GDPR)

Processing is based on contract performance (Art. 6(1)(b) GDPR) for account and lesson data, and legitimate interests (Art. 6(1)(f)) for security logging. Payment data is processed to fulfil a contractual obligation.

6. Data sharing

We do not sell your data. We share it only with sub-processors required to run the service: cloud hosting (EU region), transactional email (Resend), and AI responses (Anthropic API — your messages are processed per their data-processing agreement and are not used to train models).

7. Retention

Account data is kept while your account is active and deleted within 30 days of a verified deletion request. Payment records are retained for 5 years to satisfy legal obligations.

8. Your rights

Under GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing. To exercise any right, email privacy@mimory.space. We respond within 30 days.

9. Changes

If we make material changes, we will notify registered users by email at least 14 days in advance.