Privacy policy

1. Controller and contact

Simplex.lat operates MemHub from its legal domicile in Quito, Ecuador. Privacy and support requests can be sent to info@simplex.lat.

2. Data we process

We process account identifiers, organization membership, project configuration, API-key metadata, device and security events, billing status, support messages, and memories intentionally synchronized by users. Passwords and API-key secrets are stored as cryptographic hashes. Payment-card details are collected by Dodo Payments and are not stored by MemHub.

3. Strict purpose limitation

Private project data is processed only for customer-directed storage, authorized synchronization, search, export, security, support, and recovery. Simplex.lat does not sell, advertise against, profile, mine for unrelated purposes, publish, or use private memories to train or improve general-purpose or third-party AI models. We do not inspect private content except when technically necessary for customer-authorized support, service security, or a valid legal obligation.

4. Other purposes and legal bases

Account, security, and billing metadata is used to perform the contract, authenticate users, enforce plan limits, provide support and billing, prevent abuse, comply with law, and improve reliability. Optional analytics or marketing requires consent and does not include private project-memory bodies.

5. Workspace roles

The customer organization determines the purpose of processing for workspace content, and Simplex.lat generally acts as its service provider or processor. Organization administrators manage members, projects, credentials, retention, access, and exports. Organization owners control deletion requests.

6. Export and portability

An organization administrator can download a structured JSON export from Data controls. It includes projects, memories and versions, members, device metadata, API-key metadata without secrets, synchronization events, and audit history. Customers should export before closure.

7. Deletion requests

An organization owner may submit a permanent-deletion request from Data controls. Simplex.lat reviews identity, authority, active billing, fraud, disputes, and mandatory retention before accepting it. Once approved, active organization data—including projects, memories, versions, devices, and credentials—is permanently removed. Encrypted backups expire within 90 days through normal rotation. Limited billing, security, request, or legal records may be retained when required and remain access-restricted.

8. Recipients and transfers

Production application and database data is hosted on a private server in Frankfurt, Germany. Dodo Payments processes billing as Merchant of Record and, depending on the activity, as an independent controller or processor. Transfers outside Ecuador use appropriate contractual and technical safeguards. Current recipients appear on the subprocessors page.

9. Retention

Active data is retained while the service is provided. After an approved deletion request or closure, active data is removed without undue delay and ordinarily within 30 days. Encrypted backups may remain for up to 90 days. Security and billing records may be retained for up to seven years where necessary for legal, tax, fraud-prevention, dispute, or evidentiary obligations.

10. Your rights

Subject to Ecuadorian law, you may request information, access, rectification, updating, deletion, objection, portability, suspension, and review of qualifying automated decisions. You may withdraw consent and complain to Ecuador’s Superintendencia de Protección de Datos Personales.

11. Security and children

We apply tenant isolation, encryption in transit, least privilege, audit logging, scoped credentials, and backup controls. MemHub is intended for professional users and is not directed to children.

12. Requests

Use the authenticated Data controls page or email info@simplex.lat. We verify identity and authority before deletion.