MemoritiAI

Privacy policy

Last updated: 24 August 2026

1. Data controller

The controller of your personal data is the operator of MemoritiAI (formerly Fiszki AI), available at https://memoritiai.com.

We have not appointed a data protection officer. For privacy matters, email support@memoritiai.com.

2. What data we process

Depending on how you use the Service, we may process:

  • account data: email address, password hash, Google ID (if you sign in with Google), verification and activity status, plan, flashcard limits, Stripe customer ID, account-creation consent timestamp, account creation date;
  • content you create or upload: prompt, deck and flashcard names and content, study progress, PDF/DOCX files (name, type, size, extracted text), generation job history (including prompt text, status, language, error information) and PDF export files;
  • payment data: subscription and payment status information provided by Stripe; we do not store card numbers — Stripe handles those;
  • technical data: IP address (including for rate limiting and abuse prevention), standard server logs, the session refresh cookie (`refresh_token`);
  • cookie consent: accept/reject status for analytics and advertising cookies stored locally in your browser (key `fiszki_cookie_consent`).

We do not require your name or home address to create an account.

We process data only for specified purposes:

  • providing the service (account, flashcard generation, decks, slideshow, sharing, PDF export, plan limits) — Article 6(1)(b) GDPR (performance of a contract);
  • payments and subscriptions — Article 6(1)(b) GDPR and Article 6(1)(c) GDPR (accounting and tax duties);
  • email verification, password reset, service messages — Article 6(1)(b) GDPR;
  • Google sign-in — Article 6(1)(b) GDPR (contract at your request);
  • security, abuse prevention, logs — Article 6(1)(f) GDPR (legitimate interests);
  • Google Analytics 4 (traffic and conversion measurement, including sign-up, checkout, purchase and starting flashcard generation) — Article 6(1)(a) GDPR (consent); Google does not receive your email address or account ID as a User-ID, and IP addresses are anonymised in GA4;
  • Google AdSense or Adsterra ads and related cookies — Article 6(1)(a) GDPR (consent) and e-privacy rules; consent is not required to use an account;
  • complaints, establishing or defending legal claims — Article 6(1)(f) GDPR, and Article 6(1)(c) where required by law.

Your email and password (or Google sign-in) are required to enter into the service contract. Without them we cannot create an account. Analytics- and advertising-cookie consent is voluntary and is not a condition of using the Service.

4. Recipients

Data may be disclosed to trusted parties that process it on our behalf or as independent controllers for their own services:

  • Stripe — payments and the billing portal (Stripe privacy);
  • Google — OAuth sign-in and, after your consent, Google Analytics and (when the AdSense network is enabled) AdSense ads (Google privacy, Google ads);
  • Adsterra — when that ad network is enabled: banners and, optionally, Social Bar and popunder after your consent (Adsterra privacy);
  • Anthropic and/or OpenAI — language models used solely to generate flashcards from your prompt or document; content is sent for that purpose, not to train our own models;
  • SMTP email provider — verification and password-reset messages;
  • hosting and infrastructure providers — the application server, PostgreSQL and Redis we use to run the Service.

We do not sell your personal data.

5. Transfers outside the EEA

Some recipients (in particular Stripe, Google, Adsterra, OpenAI, Anthropic) may process data in countries outside the European Economic Area, including the United States. In those cases we rely on GDPR-compliant safeguards, primarily the European Commission’s standard contractual clauses and — where applicable — an adequacy decision (for example the EU-US Data Privacy Framework for certified organisations).

6. Retention

  • account and user content — until you delete the account or the data are no longer needed to provide the service;
  • data required by accounting and tax law (including transaction information) — for the statutory period, typically up to 5 years from the end of the tax year;
  • technical logs and IPs used for rate limiting — for as long as needed for security and abuse handling;
  • `refresh_token` cookie — up to 30 days or until you sign out;
  • cookie consent in the browser — until you change it or clear local storage;
  • public deck links — until you disable sharing or delete the account.

When you delete your account we remove associated decks, prompts, sources and study progress and cancel an active Stripe subscription, except data we must keep by law (for example billing records).

7. Your rights

You have the right to:

  • access your data and obtain a copy;
  • rectify (correct) your data;
  • erase data (“right to be forgotten”) in the cases set out in the GDPR;
  • restrict processing;
  • data portability for data you provided to us on the basis of a contract or consent, in a structured, commonly used format;
  • object to processing based on legitimate interests;
  • withdraw consent at any time (withdrawal does not affect processing before withdrawal);
  • lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with your local supervisory authority in the EU/EEA.

You can exercise GDPR rights by emailing support@memoritiai.com. You can also delete your account and data yourself in account settings (privacy / GDPR section).

8. Cookies and similar technologies

Essential

We use a `refresh_token` cookie to keep you signed in (HttpOnly, SameSite=Lax, and Secure in production). This cookie is strictly necessary to provide the service you request and does not require consent.

Advertising (consent)

On public pages and the Free plan we may show ads from one network at a time: Google AdSense or Adsterra. Pro and Expert are ad-free. Rejecting consent does not block your account; ad scripts are not loaded.

AdSense. In the EEA, UK and Switzerland, consent is collected by Google Privacy & messaging, a certified CMP (IAB TCF, Google LLC CMP). Google and partners may use cookies and device identifiers for ads, including personalised ads — only after you consent in that message (Consent Mode v2). Google’s message lets you choose purposes and vendors (Consent / Manage options / Do not consent).

Adsterra. Consent is collected by the cookie banner in the Service (stored in your browser, key `fiszki_cookie_consent`). After you accept we may load banners and — if configured — Social Bar and popunder (an extra window behind the current tab). Adsterra and its partners may set cookies and identifiers for advertising. This is not an IAB TCF mechanism. Adsterra privacy: adsterra.com/privacy.

You can change consent later with Manage cookie consent in the site footer.

Analytics (consent)

We use Google Analytics 4 to measure traffic (page views) and conversions (including sign-up, starting checkout, purchase and starting flashcard generation). The gtag script loads with Consent Mode v2: until you accept, `analytics_storage` is denied (cookieless pings only); after consent Google may set analytics cookies (for example `_ga`). We do not send Google your email address or a User-ID; GA4 anonymises IP addresses. When AdSense is on, analytics follow the same CMP message; when Adsterra or analytics-only is on, we show a simple accept/reject banner. Rejecting consent does not block use of the Service.

Google ad settings: adssettings.google.com. Google Analytics opt-out: tools.google.com/dlpage/gaoptout.

9. Content sent to AI models

When you generate flashcards, the prompt and — for files — extracted document text are sent to the model provider (Anthropic and/or OpenAI) solely to fulfil that request. We do not use that content to train our own models. The provider’s processing is governed by its terms and privacy policy. Do not submit data you do not want processed that way (for example special-category personal data or trade secrets).

10. Sharing content

If you enable a public deck link or mark a prompt template as public, that content may be available to anyone who has the link or browses the template library — including without signing in. Do not include other people’s personal data in such content without a legal basis.

11. Children

The Service is intended for people aged 16 or over. An account requires an age confirmation. We do not direct the service at children under that age. If we learn that an account belongs to a younger person, we will delete it.

12. Automated decision-making

We do not make decisions producing legal effects solely by automated means. Ad personalisation — if you consent — is carried out by Google (AdSense) or Adsterra under the chosen network’s rules.

13. Changes

We may update this policy when the Service, recipients or the law change. The new version applies from the date it is published on this page. We will notify you in the Service or by email of material changes where appropriate.

Questions: support@memoritiai.com.