This Privacy Notice for Rember Technologies Inc ('Company', 'we', 'us', or 'our') describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

• Visit our website at https://rember.tech, https://rember.chat, or any website of ours that links to this Privacy Notice;
• Send texts to Rember, participate in SMS conversations where Rember is included, add Rember's email address to email threads, or connect your Google account to enable communication processing;
• Engage with us in other related ways, including any sales, marketing, or events.

Summary of Key Points

This summary provides key points from our Privacy Notice. Rember is a conversational CRM that processes the content of your SMS and email communications. This is the most important thing to understand about how we handle your data.

What personal information do we process? When you share communications with the Services — by sending texts to Rember, being included in SMS conversations where Rember is present, adding Rember's email to email threads, or connecting your Google account — we access and process the content of those messages. We also access your Google Contacts and Google Calendar data when you connect your Google account. We extract contact information, relationship details, and other structured data from your communications. This means we process personal information about you and about the people you communicate with (your 'Contacts'). We also collect account information, payment information (processed by Stripe via Credit Cards, Klarna, Affirm, Apple Pay, Link, Bancontact, and EPS), and usage data. Some of this information may constitute sensitive personal information under applicable law. See Section 1.

Do we process information from third parties? Yes. When we process your communications, we extract personal data about your Contacts — people who have not signed up for Rember and have not agreed to this Privacy Notice. This includes names, email addresses, phone numbers, professional details, and relationship context derived from your messages. See Section 1.

Do we use AI to process your data? Yes. We use artificial intelligence and natural language processing to read, analyze, and extract information from your communications. Our AI providers are contractually prohibited from training their models on your data. See Section 6.

Do we share your information? We share data with service providers necessary to operate the Services, including Stripe (payments), our AI providers, our email and SMS providers, and our hosting infrastructure providers. Section 4 names every one of them and states where each is located.

Who are the Services for? Rember is offered to residents of Canada and the United States. The Services are not directed to individuals in the European Economic Area, the United Kingdom, or Switzerland, and we do not market or offer them there.

Where is your data processed? Your records and documents are stored in Canada — our database and document storage are in Montreal. Our application servers run in the United States, so your data is processed there. Email and SMS are relayed through providers in the United States, where content is held only briefly. See Section 8.

What are your privacy rights? Depending on your location, you may have rights to access, correct, delete, or port your personal information. Your Contacts may also have rights regarding their data. See Sections 10 and 11.

How do you contact us about privacy? Email privacy@getrember.com or write to Rember Technologies Inc, Vancouver, British Columbia, Canada. See Section 13.

1. What Information Do We Collect?

Information you provide directly

We collect personal information that you voluntarily provide when you register for the Services, make a purchase, contact us, or otherwise interact with us. This includes:

• Account information: name, email address, and phone number. Registration is required to use the Services. We use passwordless authentication (magic link or similar), so no password is stored;
• Payment information: billing address and payment details. We accept Credit Cards, Klarna, Affirm, Apple Pay, Link, Bancontact, and EPS. All payment transactions are processed and stored by Stripe, Inc. — we do not store full payment details on our servers. A valid payment method is required before your free trial expires; and
• Communications with us: information contained in your support requests, feedback, and other correspondence with our team.

Communication Data

When you proactively share communications with the Services — by sending texts to Rember, being included in conversations where Rember is present, adding Rember's email address to email threads, or connecting your Google account — we access and process the content of those communications ('Communication Data'). This is the core function of the Services. Communication Data includes:

• The full text content of SMS messages sent directly to Rember, and conversations where Rember's phone number is included as a participant;
• The full text content of emails in threads where Rember's email address has been included, or emails accessed through a connected Google account;
• Google Contacts data and Google Calendar data accessed through a connected Google account, including contact names, email addresses, phone numbers, calendar events, and scheduling details;
• Message metadata including sender, recipient, date, time, and subject lines;
• Attachments and embedded content (to the extent processed by the Services); and
• Communication patterns such as frequency, timing, and thread history.

Communication Data may contain sensitive personal information as defined under applicable law, including the California Consumer Privacy Act (CCPA §1798.140(ae)). The content of private messages may include health information, financial details, political opinions, religious beliefs, or other sensitive topics depending on the nature of your communications. We apply enhanced security protections to Communication Data as described in our Terms and Conditions.

Contact Data (Third-Party Information)

When we process your Communication Data, we extract and organize information about the people you communicate with ('Contacts'). This Contact Data may include:

• Names, email addresses, and phone numbers;
• Professional titles, organizational affiliations, and roles;
• Relationship context derived from your communications (e.g., how you know them, recent interactions);
• Meeting references, action items, and commitments mentioned in communications; and
• AI-generated summaries and relationship insights.

Your Contacts have not agreed to this Privacy Notice and may not be aware that their information is being processed. You are responsible for ensuring you have the legal right to share communications involving your Contacts with the Services by adding Rember to those conversations. See our Terms and Conditions, Section 7 (Communication Processing and Consent) and Section 8 (Third-Party Data) for your obligations.

Information collected automatically

When you access the Services, we automatically collect certain technical and usage information, including:

• Log and usage data: IP address, browser type, operating system, referring URLs, pages visited, access times, and interactions with the Services;
• Device data: device type, unique device identifiers, and device settings; and
• Location data: approximate geographic location derived from your IP address.

Information from third-party platforms

We receive information from the following third-party sources:

• Google APIs: When you connect your Google account to the Services, we access email data (Gmail API), contact data (Google Contacts API / People API), and calendar data (Google Calendar API) through Google APIs in compliance with the Google API Services User Data Policy, including the Limited Use requirements. We use this data solely to provide the user-facing features of the Services and do not transfer it to third parties except as necessary to provide those features;
• Twilio: When you send texts to Rember or are included in SMS conversations where Rember is a participant, we access and process SMS message data through Twilio, Inc., our SMS infrastructure provider. Twilio's privacy policy is available at https://www.twilio.com/legal/privacy;
• Postmark: When you add Rember's email address to an email thread, email messages are processed through Postmark (ActiveCampaign, LLC), our email infrastructure provider. Postmark's privacy policy is available at https://postmarkapp.com/privacy-policy; and
• Stripe: We receive transaction confirmation and billing status information from our payment processor, Stripe, Inc. Stripe's privacy policy is available at https://stripe.com/privacy.

2. How Do We Process Your Information?

We process your personal information for the following purposes:

To provide the core Services. When you share communications with us — by sending texts to Rember, being included in conversations where Rember is present, adding Rember to email threads, or connecting your Google account — we read, analyze, and organize your Communication Data (including Google Contacts and Calendar data) to build and maintain your contact knowledge graph, extract relationship information, generate AI-powered insights and summaries, create contact records, identify action items and follow-ups, and provide notifications and reminders.

To create and manage your account. We process your account information to create, maintain, and secure your account, and to enable you to log in and use the Services.

To process payments. We share billing information with Stripe to process your subscription payments, manage refunds, and fulfil purchase obligations.

To respond to your inquiries and provide support. We process your communications with our team to respond to questions, troubleshoot issues, and provide customer support.

To send administrative communications. We process your contact information to send service-related messages including account confirmations, technical notices, security alerts, and updates to our terms or policies.

To improve and maintain the Services. We process usage data and aggregated analytics to understand how the Services are used, identify and fix technical issues, and improve functionality and performance.

To ensure security and prevent fraud. We process technical data to detect, prevent, and respond to security incidents, fraud, and abuse of the Services.

To comply with legal obligations. We process personal information as required by applicable law, regulation, legal process, or enforceable governmental request.

3. What Legal Bases Do We Rely On?

Canada (PIPEDA / PIPA)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and the British Columbia Personal Information Protection Act (PIPA), we rely on the following bases for processing your personal information:

• Consent: We obtain your express consent before accessing and processing your Communication Data. You affirmatively share data with the Services by sending texts to Rember, including Rember in SMS conversations, adding Rember's email address to email threads, or connecting your Google account. You may withdraw consent at any time by removing Rember from your conversations or disconnecting your Google account;
• Contractual necessity: We process account and payment information as necessary to perform our contractual obligations to you under our Terms and Conditions; and
• Legitimate interest: We process usage data and technical information for our legitimate interests in maintaining, improving, and securing the Services, where those interests are not overridden by your privacy rights.

Our Privacy Officer is responsible for overseeing our compliance with PIPEDA and PIPA. You may contact our Privacy Officer at privacy@getrember.com.

Quebec (Law 25)

If you are a resident of Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, applies to our processing of your personal information in addition to PIPEDA. We rely on your consent, which we obtain for a specific purpose and in clear language before you share communications with the Services. Section 8 describes the assessment and contractual protections that apply before your personal information is communicated outside Quebec, and Section 10 describes the additional rights available to you.

United States

If you are located in the United States, the information in this section applies to you in addition to any state-specific rights described in Section 11.

4. When and With Whom Do We Share Your Information?

We share personal information with the following categories of third parties:

Service Providers

Payment processing: Stripe, Inc. processes your payment transactions. Stripe receives your name, billing address, and payment card details. Stripe's privacy policy is available at https://stripe.com/privacy.

SMS processing: Twilio, Inc. provides the SMS infrastructure that enables the Services to access and process your text messages. Twilio receives the content of SMS messages sent to and from your connected phone number. Twilio's privacy policy is available at https://www.twilio.com/legal/privacy.

Email processing: Postmark (ActiveCampaign, LLC) provides the email infrastructure that enables the Services to access and process your emails. Postmark receives the content of emails sent to and from your connected email accounts. Postmark's privacy policy is available at https://postmarkapp.com/privacy-policy.

AI processing: Google LLC (Gemini Developer API), Amazon Web Services (Bedrock) and Google Cloud (Vertex AI) provide the artificial intelligence and natural language processing capabilities that power the Services. These providers receive Communication Data for the purpose of extracting structured information, generating summaries, and providing insights. Requests to Anthropic's Claude models are routed through OpenRouter to Amazon Bedrock or Google Vertex AI; requests to Google's Gemini models, including all text embeddings, are sent to the Gemini Developer API directly. See Section 6 for details on how AI providers handle your data.

AI request routing: OpenRouter, Inc. routes our requests to third-party AI models (Anthropic and OpenAI) and transmits the Communication Data included in those requests to the applicable model provider. OpenRouter's privacy policy is available at https://openrouter.ai/privacy.

AI observability: Langfuse GmbH provides tracing and observability for our AI features, hosted in the United States. In our production environment, customer content is masked before it reaches Langfuse; what remains are structural records of AI activity together with internal record identifiers. In our development and internal evaluation environments, which do not process live customer accounts, content is not masked. This masking applies to what we send Langfuse; it does not describe our application logs, which are covered separately in Section 9. Langfuse's privacy policy is available at https://langfuse.com/privacy.

Connected accounts: Scalekit, Inc. (United States) provides the secure token vault that stores the OAuth access and refresh tokens for the third-party accounts you connect, and also acts as the execution proxy for calls made to those accounts. This means Scalekit receives both the authorization tokens and the content of the requests and responses exchanged with your connected services (such as Gmail, Google Calendar, Notion, Outlook, Fireflies, and Granola). Rember does not store these tokens in its own database. Scalekit's privacy policy is available at https://www.scalekit.com/privacy.

Database and document storage: Supabase, Inc. hosts both our database and our document storage in Canada (Montreal region). Supabase stores your account information, Communication Data, Contact Data, AI-generated outputs, and the files and attachments processed by the Services. Supabase's privacy policy is available at https://supabase.com/privacy.

Server infrastructure: Railway Corp. provides our application server infrastructure in the United States. Railway processes requests, facilitates the delivery of the Services, and hosts the self-managed monitoring systems in which our application logs and performance traces are stored. Railway's privacy policy is available at https://railway.app/legal/privacy.

Analytics: PostHog, Inc. provides product analytics to help us understand how the Services are used. PostHog receives usage data including page views, feature interactions, and anonymized behavioural data. PostHog's privacy policy is available at https://posthog.com/privacy.

Identity and authentication: WorkOS, Inc. (United States) is our identity provider and the system of record for your login. WorkOS holds your email address, authentication sessions, and the record of any step-up verification you complete. Rember stores only an opaque reference to your WorkOS identity. WorkOS's privacy policy is available at https://workos.com/privacy.

Google account access: Google LLC (United States) provides the Calendar and Contacts APIs that the Services call on your behalf when you connect a Google account. This is separate from Google's role as an AI provider described above. Google's privacy policy is available at https://policies.google.com/privacy.

Microsoft account access: Microsoft Corporation (United States) provides the Microsoft Graph API that the Services call on your behalf when you connect an Outlook account. Microsoft's privacy statement is available at https://privacy.microsoft.com/privacystatement.

Usage metering: Metronome, Inc. (United States) meters your usage of the Services for billing purposes and receives your name, email address, and records of billable activity. Metronome does not receive Communication Data or Contact Data. Metronome's privacy policy is available at https://metronome.com/privacy.

Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. We will notify you before your personal information is transferred and becomes subject to a different privacy notice.

Legal Requirements

We may disclose your information where we are legally required to do so, including to comply with applicable law, governmental requests, judicial proceedings, court orders, or legal processes. We may also disclose information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our Terms and Conditions, suspected fraud, situations involving potential threats to the safety of any person, or as evidence in litigation in which we are involved.

Data We Do Not Sell or Share for Advertising

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioural advertising or targeted advertising purposes. We do not use Communication Data or Contact Data for advertising of any kind. We will not share mobile opt-in information, including phone numbers obtained through SMS consent, with third parties or affiliates for marketing or promotional purposes.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Services.

Strictly necessary cookies: Required for the Services to function, including authentication, session management, and security. These cannot be disabled.

Functional cookies: Used to remember your preferences and settings, such as language and display preferences.

Analytics cookies: Used to understand how the Services are used, which pages are visited, and how we can improve performance. We use PostHog for product analytics. PostHog's privacy policy is available at https://posthog.com/privacy.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Disabling certain cookies may affect the functionality of the Services.

We do not use advertising cookies, retargeting pixels, or third-party tracking for advertising purposes.

6. AI and Automated Processing

How We Use AI

The Services use artificial intelligence and natural language processing to provide their core functionality. Our AI capabilities are provided by the following third-party AI Service Providers:

• Google — Gemini Developer API. Carries our Gemini model requests and all text embeddings. Requests go to Google directly. Gemini API terms;
• Anthropic's Claude models, served through Amazon Bedrock and Google Vertex AI. We route these requests through OpenRouter, Inc., which forwards them to Amazon Web Services or Google Cloud. We do not send them to Anthropic directly. OpenRouter's privacy policy.

What Data Is Shared with AI Providers

To provide the Services, we transmit the following data to our AI Service Providers:

• The text content of your SMS and email messages (Communication Data);
• Contextual information needed for accurate extraction and analysis; and
• Prompts and instructions generated by the Services to guide the AI processing.

Our position on how that data may be used is enforced in our own code, not merely stated here:

• Rember does not use your Communication Data — including any data derived from Google APIs — to develop, train, fine-tune, or improve any generalized or foundational AI/ML model;
• Your Communication Data is transmitted to these providers only to provide the Services to you;
• Under the providers' terms, data submitted through their APIs is not used to train their general-purpose models. Our routing configuration pins requests to a fixed list of permitted providers and refuses data collection on every request, so an individual feature cannot weaken that setting; and
• One distinction we would rather draw than blur: not training and not retaining are different guarantees. Our Claude routes are configured for zero data retention. Google's Gemini API does not train on our data, but it does log prompts and responses for a limited period to detect abuse and to meet its own legal obligations, so it is not zero-retention.

Google API Data

Rember's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

For data obtained through Google APIs (including Gmail, Google Contacts, and Google Calendar), this means:

• We use Google API data only to provide the user-facing features of the Services;
• We do not transfer Google API data to others except as necessary to provide those user-facing features (including to the service providers listed in Section 4), as required by law, or in connection with a merger or acquisition;
• We do not use Google API data — or data derived from it — to develop, train, or improve generalized or foundational AI/ML models;
• We do not use Google API data for advertising, market research, or email campaign purposes;
• Human access to Google API data is limited to (a) what is necessary for security purposes; (b) to comply with applicable law; or (c) where the data has been aggregated and anonymized; and
• We review our use of Google API data as part of our ongoing compliance work.

Google API Scopes and Why We Request Them

We request only the Google API scopes necessary to provide the user-facing features of the Services. Each scope and its specific purpose is described below:

• Gmail — read message content (gmail.readonly, a restricted scope): to extract relationship context — contacts, commitments, action items, and follow-ups — from your email and turn it into memories and tasks in your contact knowledge graph;
• Gmail — create and send messages (gmail.compose, a restricted scope): to draft and send the follow-up emails you ask Rember to write on your behalf;
• Google Calendar (a sensitive scope): to read scheduling context and provide calendar-related features; and
• Google Contacts / People (a sensitive scope): to enrich and reconcile the contact records in your knowledge graph.

Google OAuth access and refresh tokens for your connected account are held in a dedicated third-party token vault operated by Scalekit, Inc. (see Section 4); Rember does not store your Google OAuth tokens in its own database. You can revoke Rember's access at any time by disconnecting your Google account through the Services or through your Google Account permissions.

Automated Decision-Making and Profiling

The Services perform automated processing of your Communication Data to generate contact profiles, relationship insights, and AI-powered summaries. Specifically, the Services:

• Automatically categorize and organize your contacts based on communication patterns;
• Generate relationship summaries and interaction histories;
• Identify action items, follow-ups, and scheduling information from your messages; and
• Produce AI-generated insights and recommendations about your professional relationships.

These outputs are informational tools presented to you for your own use. They do not decide anything about you: no eligibility, pricing, access, or account outcome is determined by them. You can review, modify, or delete any AI-generated information through the Services' user interface.

If a decision affecting you were ever made exclusively by automated processing, you have the right to be told so, to be told which of your personal information was used and the principal factors involved, and to submit observations to a member of our personnel who can review the decision. To exercise that right, or if you believe an automated output is inaccurate or unfair, contact us at privacy@getrember.com.

7. How Do We Handle Authentication and Social Logins?

The Services use passwordless authentication. When you register or log in, you receive a magic link, OTP or similar credential sent to your email address or phone number — no password is created or stored.

If you choose to connect your Google account to the Services, we receive certain profile information from Google, including your name, email address, and profile picture. We use this information for authentication and to enable the Services' communication processing features, including access to Gmail, Google Contacts, and Google Calendar data. We access only the Google API scopes necessary to provide the user-facing features of the Services, in compliance with the Google API Services User Data Policy.

8. Where Your Data Lives and How We Protect It

Rember Technologies Inc is headquartered in Vancouver, British Columbia, Canada. This section explains exactly where your information sits and where it is worked on, because those are two different questions and we think you are entitled to a clear answer to both.

Where Your Information Is Stored and Processed

• At rest, in Canada. Your account records, Communication Data, Contact Data, AI-generated outputs, and the documents and attachments you send us are stored in Canada, in the Montreal region, with Supabase;
• In processing, in the United States. Our application servers run in the United States with Railway. Your information is decrypted in memory there while the Services operate on it. Our AI providers and our identity, billing, analytics, and monitoring providers are also located in the United States; and
• In transit, through the United States. Email and SMS reach us through Postmark and Twilio, which are located in the United States. Content passes through and is held there only briefly before being deleted at source.

We want to be direct about one point that is often glossed over. Storing data in Canada does not place it beyond the reach of United States law. Our Canadian-region providers are American companies, and American companies can be compelled to produce data they hold regardless of which country the servers sit in. We disclose this rather than let the phrase "data residency" imply a protection it does not give.

Cross-Border Transfers Under Canadian Law

PIPEDA. Canadian federal privacy law does not require that personal information stay in Canada. It permits transfers to another country provided the organization is transparent about them, obtains a comparable level of protection by contract, and remains accountable for the information throughout. That is our position: the transfers described above are disclosed here, they are governed by our agreements with each provider, and Rember remains accountable to you for your personal information while it is in a service provider's hands.

Quebec (Law 25). If you are a resident of Quebec, before communicating your personal information outside the province we assess whether it will receive protection that is adequate in light of, among other things, the sensitivity of the information, the purposes for which it will be used, the protections it will receive, and the legal framework of the destination. Where the assessment supports the transfer, it is carried out under a written agreement that takes the result of that assessment into account. This section is the notice of those transfers. You may ask us for further information about a specific transfer by writing to privacy@getrember.com.

Who the Services Are Offered To

The Services are offered to residents of Canada and the United States. They are not directed to individuals in the European Economic Area, the United Kingdom, or Switzerland, and we do not market, offer, or monitor behaviour in those regions.

How Your Information Is Protected

Information is encrypted in transit using Transport Layer Security. On top of the encryption our hosting provider applies to its own storage, Rember separately encrypts the most sensitive categories of your information — the content of your messages, the text extracted from your documents, the summaries generated from them, and the access tokens for your connected accounts — using AES-256-GCM. The key for that encryption is held outside the database, so possession of the database alone does not yield your content.

One scope note, because we would rather state it than let it be assumed: the original document files themselves are protected by the encryption our storage provider applies at rest, not by this additional layer. The text we extract from those documents is covered by it.

We also limit access to personal information to personnel who need it, maintain incident response procedures, and require our service providers to protect the information they hold for us.

If There Is a Breach

If a breach of security safeguards involving your personal information occurs and it creates a real risk of significant harm to you, we will notify you and the applicable privacy regulators without undue delay, and in any event within seventy-two (72) hours of becoming aware of it, to the extent we can identify the individuals affected. Our notice will describe what happened, what categories of information were involved, the likely consequences, and what we are doing about it. We maintain a register of confidentiality incidents as required by applicable Canadian law.

9. How Long Do We Keep Your Information?

We retain your personal information for as long as necessary to fulfil the purposes described in this Privacy Notice, unless a longer retention period is required by law. Specific retention periods are as follows:

When your account is cancelled, we retain your data for thirty (30) days to allow for reactivation. After this window, your personal information, Communication Data, and Contact Data are deleted or anonymized following account closure or upon a verified deletion request (see Section 14), except where a longer retention period is required by law. Where deletion is not technically feasible or where data is needed in aggregate form, we will anonymize the data so that it can no longer be associated with you. Data subject to legal retention requirements (such as billing records) will be retained for the required period and then deleted or anonymized.

10. Your Privacy Rights (Canada)

Under PIPEDA and PIPA, you have the following rights:

• Right of access: You may request access to the personal information we hold about you, including Communication Data and Contact Data processed through your account;
• Right of correction: You may request correction of any inaccurate or incomplete personal information;
• Right to withdraw consent: You may withdraw your consent to the processing of your Communication Data at any time by ceasing to send texts to Rember, removing Rember from SMS conversations, removing Rember's email from your threads, or disconnecting your Google account through the Services. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal;
• Right to portability: You may request a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format. You can generate this yourself at any time from your account settings; see Section 14;
• Right to deletion: You may delete your account and the personal information associated with it. See Section 14 for how deletion works and what it reaches; and
• Right to complain: You may file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (www.oipc.bc.ca) if you believe your privacy rights have been violated.

To exercise your rights, contact our Privacy Officer at privacy@getrember.com. We will respond to your request within thirty (30) days. Where applicable law permits us to extend that period — for example, where meeting it would unreasonably interfere with our operations, or where we need additional time to consult — we will notify you before the thirty days have elapsed, give you the reason and the new date, and tell you how to complain to the applicable privacy regulator if you disagree.

Additional Rights for Quebec Residents (Law 25)

If you are a resident of Quebec, you have the following additional rights under the Act respecting the protection of personal information in the private sector:

• Right to be informed of automated processing: Where a decision about you is based exclusively on automated processing of your personal information, you have the right to be informed of it, to be told which personal information was used and the principal factors that led to the decision, and to submit observations to a member of our personnel who can review it. See Section 6, which describes the automated processing the Services perform;
• Right to cessation of dissemination and de-indexing: You may require us to cease disseminating your personal information, or to de-index any hyperlink that provides access to it, where the dissemination contravenes the law or a court order, or where it causes you serious injury in relation to your right to reputation or privacy and ceasing it would not be outweighed by the public interest;
• Right to notice of transfers outside Quebec: Section 8 sets out where your information is stored and processed, and the assessment and contractual protections that apply before it is communicated outside Quebec; and
• Right to complain: You may file a complaint with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).

Commercial Electronic Messages (CASL)

Canada's Anti-Spam Legislation governs commercial electronic messages sent to Canadian recipients. Most of what the Services send you is not a commercial electronic message — one-time passcodes, security alerts, billing and account notices, and the agent's replies to messages you initiated are sent to operate the Services you have asked for.

Where we do send a commercial electronic message, we send it on the basis of consent. You give express consent by opting in at signup, in your account settings, or by replying to a message asking for it. Every commercial message we send identifies Rember, gives our contact information, and includes a working unsubscribe mechanism. You may withdraw consent at any time by replying STOP to any SMS message, using the unsubscribe link in any email, or writing to privacy@getrember.com. Withdrawal takes effect without charge.

Messages you send to your own Contacts through the Services are sent by you, not by us. You are responsible for having the consent those messages require.

Social Insurance Numbers and Government Identifiers

Rember never asks for a Social Insurance Number, and a SIN is never required to use the Services. We are aware that documents customers forward to the Services — Notices of Assessment, T4 slips, and similar tax records — can contain a SIN or other government identifier, and that this happens without anyone choosing it.

Where such an identifier arrives inside a document, we do not use it to identify you, we do not index or search on it, we do not use it as an account key, and we never disclose it to a third party for any purpose beyond providing the Services. Text extracted from your documents is encrypted as described in Section 8 and is deleted with the rest of your data when you delete your account. If you would prefer a document containing a government identifier not be retained, you may delete it individually through the Services or ask us at privacy@getrember.com.

If Your Information Is in Rember and You Are Not a User

The Services process personal information about people who communicate with our users but who have not themselves signed up. Rember is a system of record for our users' own relationships, and the information we hold about you reached us through the account of someone you communicate with. Consent to that processing is yours to give and yours to withdraw; the user is responsible for having obtained it before bringing your information into the Services.

You may write to us at privacy@getrember.com. We will acknowledge your request and respond within thirty (30) days. Because your information sits within a user's account, answering an access, correction, or deletion request will usually mean working with that user, who can view, correct, and delete the records concerning you directly. Where a request concerns information the Services generated rather than information the user supplied, or where applicable law requires us to answer you directly, we will. Where applicable law permits us to extend the thirty days, we will notify you before they have elapsed, give you the reason and the new date, and tell you how to complain to the applicable privacy regulator.

These rights reach the information we hold in our own systems. They do not reach a user's own email, calendar, or other accounts, which we do not control, and they are subject to the limited exceptions applicable law provides — for example, where responding would reveal personal information about another individual, or where we are required to retain the information.

11. Your Privacy Rights (United States)

Several US states have enacted privacy laws that grant residents specific rights regarding their personal information. This section applies to residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with applicable privacy legislation.

Categories of Personal Information Collected

The following table describes the categories of personal information we collect, using the CCPA's category definitions:

Disclosure of Personal Information

In the preceding twelve (12) months, we have disclosed the following categories of personal information to service providers for business purposes:

• Categories A, B, D (identifiers, personal information, commercial information) — shared with Stripe for payment processing;
• Categories A, H, L (identifiers, sensory data, sensitive PI) — shared with Twilio for SMS processing and Postmark for email processing;
• Categories A, H, K, L (identifiers, sensory data, inferences, sensitive PI) — shared with our AI providers (the Google Gemini Developer API, and Anthropic's Claude models served through Amazon Bedrock and Google Vertex AI), with OpenRouter for AI request routing, and with Langfuse for AI observability;
• Categories A, H, K, L (identifiers, sensory data, inferences, sensitive PI) — stored with Supabase, which holds both our database and our document storage in Canada;
• Categories A, H, L (sensitive PI — connected-account authentication tokens, and the content of requests and responses exchanged with your connected accounts) — shared with Scalekit;
• Categories A, H (identifiers, sensory data) — shared with Google and Microsoft when you connect a Google or Outlook account, in order to make the calls you have authorized;
• Categories A, B, D (identifiers, personal information, commercial information) — shared with WorkOS for identity and authentication, and with Metronome for usage metering; and
• Categories A, F (identifiers, internet activity) — shared with Railway (server infrastructure and self-managed monitoring) and PostHog (analytics).

We have not sold personal information to any third party. We have not shared personal information with third parties for cross-context behavioural advertising.

Your California Privacy Rights

As a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and sell;
• Request deletion or anonymization of your personal information;
• Request correction of inaccurate personal information;
• Opt out of the sale or sharing of your personal information (we do not sell or share PI for advertising);
• Limit the use and disclosure of your sensitive personal information to what is necessary to perform the Services; and
• Not be discriminated against for exercising your privacy rights.

To exercise these rights, contact us at privacy@getrember.com or call +1 (825) 793-2327. We will verify your identity before processing your request. We will respond within forty-five (45) calendar days, extendable by an additional forty-five (45) days with notice.

12. Do-Not-Track and Global Privacy Control

Most web browsers include a Do-Not-Track ('DNT') feature that signals to websites that you do not want to be tracked. Because no uniform standard for DNT signals has been adopted, we do not currently respond to DNT signals.

However, we honour the Global Privacy Control (GPC) signal as required by applicable law. If your browser or device sends a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of personal information under the CCPA/CPRA and equivalent state laws. You can learn more about GPC at https://globalprivacycontrol.org.

13. How Can You Contact Us?

If you have questions about this Privacy Notice or wish to exercise your privacy rights, you may contact us:

14. How Can You Review, Update, or Delete Your Data?

You have the right to request access to, correction of, deletion of, or anonymization of your personal information. Depending on your location, you may have additional rights as described in Sections 10 and 11.

You can manage much of your data directly through the Services:

• Account settings: Update your name, email, and phone number;
• Connected accounts: Connect or disconnect your Google account at any time; add or remove Rember from SMS group conversations and email threads;
• Contact records: View, edit, or delete individual contact records and AI-generated information;
• Data export: Generate a downloadable copy of your data yourself from your account settings. The export covers your contacts, conversations, messages, memories, tasks, consent records, and your original document files, together with a manifest. It does not include your subscription and billing records or the technical headers of your email messages. You can request one export per twenty-four hours, and each export link expires after seven days; and
• Account deletion: Delete your account and its data from your account settings. Deletion is permanent, is confirmed to you by email, and requires you to reauthenticate first so that nobody else can trigger it. If you would rather we did it for you, or you cannot access your account, contact support@getrember.com.

What deletion reaches. Deleting your account removes your account record, your messages and the information extracted from them, your contacts and memories, your tasks, and your stored documents from our systems, and instructs our service providers to delete the copies they hold. Some records survive deletion because the law requires it — billing and tax records are the main example, and Section 9 gives the periods. Content that has already passed through our email and SMS providers is deleted on those providers' own schedules, also given in Section 9.

For any requests that cannot be handled through the Services, or to exercise rights under applicable privacy legislation, contact us at privacy@getrember.com.