Privacy policy for the app
This policy covers the memdiz app for Android and iOS. The controller is mindrevolution GmbH, Fritz-Walter-Weg 19, 70372 Stuttgart, Germany. Contact: support@memdiz.com. The website has a separate privacy policy.
For a short explanation of recordings and what parents can see, start with Privacy explained.
Account, family and school profile
We process your email address, sign-in details, chosen name, role and family membership to provide your account. Student profiles also include an age bracket, selected subjects, timetable and any school details entered: country, state, school type and grade. A profile picture is optional. These details support account access, family features and school organisation (Article 6(1)(b) GDPR). We do not process payment data.
Consent for children under 16
Before we upload and process a child's recordings or school data with AI, a parent must give consent if the child is under 16 (Articles 6(1)(a) and 8 GDPR). A recording can wait on the device until then. Students aged 16 and over can give their own consent.
We record who consented, when and how, and the privacy-policy version. Technical evidence such as IP address and browser identifier is deleted after 30 days. Consent can be withdrawn in the app. This stops future processing based on that consent without affecting the lawfulness of earlier processing.
Recordings, text and AI
Recording begins only when you start it. The app sends the audio over an encrypted connection to our server for speech recognition. We do not maintain a lasting audio archive on our servers. If upload fails or consent is missing, a recording may remain on your device until you successfully upload or discard it.
AI identifies subjects, topics, homework and assessments in the text. Study plans also use exam and school context, such as subject, date, school type and grade. We do not add your account email address or account name to these AI requests. Anything you say in a recording is part of the content transmitted, though. Please leave out unnecessary personal details about yourself or others.
The transcript is deleted after successful analysis. If analysis fails, it remains temporarily available for a retry. Automatic cleanup covers failed requests two hours after their last update and stalled requests after one hour; it runs every 15 minutes. Retrying can restart that period. The resulting school entries remain in your account, where you can check and correct them.
Processing provides the school-organisation features you request. The legal bases are consent for AI processing (Article 6(1)(a) GDPR) and Article 6(1)(b) GDPR for providing account features.
Service providers and processing locations
Our app database, website and own analytics systems are hosted in Germany. For speech recognition, analysis and study plans we use Mistral AI, an AI provider based in France, as a processor. We connect directly to the AI provider without an additional intermediary. Content sent for processing is not used to train the models.
AI processing takes place in Europe through the provider’s European endpoint. The provider describes its processing region as EU and EFTA; EFTA includes countries outside the EU. This regional commitment covers AI computation, not all of the provider’s account, billing and operational metadata. Contact us for details of our processors, applicable retention conditions and any required international-transfer safeguards.
We send service messages, such as confirmation and invitation links, through an email provider in the EU. Our support mailbox is hosted in Germany. Delivery also depends on your own email provider, whose mailbox may be outside the EU.
Optional sign-in through other providers
You can sign in with an email address and password. If you instead choose an offered Google, Microsoft or Apple sign-in option, we receive the verified provider identifier and the account details you release, such as email address and name. The chosen provider also processes sign-in under its own privacy terms, which may involve processing outside the EU. External sign-in is not required to use memdiz.
What parents can see
Parents with access to the family see aggregate recording-day, homework, assessment and study-plan status. They do not receive recordings, transcripts or personal lesson notes.
memdiz supports organisation within your family. Sharing homework, tasks or school entries with classmates or other families is not part of its functionality.
Optional weekly email overview
If you enable the weekly overview in your parent profile, we use your verified email address and saved time zone to send a Sunday email. It contains aggregate homework, assessment and study-plan information about your children, not recordings, transcripts or personal lesson notes. Each parent chooses independently. The basis is your consent (Article 6(1)(a) GDPR); you can turn sending off in your profile or via the unsubscribe link. Opens and clicks are not tracked.
Protected sending copies are deleted after acceptance by the email service, unsubscribe or expiry of the sending window. Technical delivery records are retained for at most 30 days.
Usage data and error diagnostics
To improve, stabilise and secure the app, we record a limited selection of technical events, such as opening the app or completing a recording, with time, user identifier, family identifier where applicable, platform and app version. We also collect limited technical measurements, such as upload duration, and error reports. Lesson content, recordings, transcripts and free-form text are not part of these usage events.
Analysis runs on our own systems in Germany. We use no external analytics platform or advertising identifiers. The legal basis is our legitimate interest in improvement, stability and security (Article 6(1)(f) GDPR). Detailed events remain for at most 30 days and family-level daily counts for at most 90 days. Only anonymous totals remain after that. Error reports are deleted within 30 days. You can object to this processing through our contact address.
Retention, export and deletion
Account and learning data generally remain while your account exists. Recordings, transcripts, technical evidence and usage events follow the shorter periods above. Technical IP and browser details are deleted within 30 days and sign-in tokens within 90 days.
You can export your data and delete your account in the app. Without app access, you can request account deletion. That page also explains how remaining data and any shared copies from earlier test versions are handled. Statutory retention duties remain unaffected.
Your rights
You have rights including access, rectification, erasure, restriction, portability and objection. You can withdraw consent for future processing at any time and complain to a data protection authority. For help, contact support@memdiz.com.
Version: 7 September 2026.