LiveMemoriesAI

LiveMemoriesAI

Privacy Policy

Version 2.6 · Last updated 18 October 2026

This policy explains, in clear and complete language, how LiveMemoriesAI handles information when a family creates and shares a virtual memorial or a person creates a replica of themselves, and which data the service processes for account and paid-plan features. We comply with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD), Regulation (EU) 2024/1689 (AI Act) and Law 34/2002 (LSSI). We have designed the service for a sensitive setting: grief, family history and private conversations.

Service provider

Sergio Fernández · Avenida Gran Vía de Vicálvaro, Madrid, 28052, Spain

Privacy & rights contact

contact@livememoriesai.com

Jurisdiction

European Union and Spain

Last updated

18 October 2026

Internal legal review: 17 August 2026. Subscription information updated on 5 October 2026, Google measurement information on 12 October 2026, the jurisdiction wording on 14 October 2026, the self-replica and Google Analytics 4 information on 15 October 2026 and the memorials of living people and the vital status on 18 October 2026; external legal validation is pending.

In a few words

  • We keep what you and your family upload (writing, chats, photos and audio) only to create your memorial and make it work.
  • Each memorial is kept apart from all the others, and each relative's conversation is private.
  • If you create a replica of yourself, your materials are your personal data and you keep every GDPR right over them; the same holds for a living person whose memorial is created with their permission (section 25).
  • We do not sell data or use your memories to train external AI models. Usage measurement with Google Analytics is optional, only enabled if you accept it and never receives memorial content.
  • Some providers (for example, artificial intelligence, hosting or email delivery) process data on our behalf; sections 8 and 9 explain them.
  • You can ask for a copy of your data or for its deletion whenever you want: write to contact@livememoriesai.com.

The full text, with every legal detail, follows below.

Contents25 sections
  1. 1. Data controller and contact details
  2. 2. Categories of data subjects and data processed
  3. 3. Data of deceased persons
  4. 4. Data of invited interlocutors
  5. 5. Data of living third parties appearing in the materials
  6. 6. Purposes and legal bases of processing
  7. 7. Automated decisions and profiling (art. 22 GDPR)
  8. 8. Processors and provider categories
  9. 9. International transfers
  10. 10. Retention periods
  11. 11. Technical and organisational security measures
  12. 12. Cookies and similar technologies (LSSI)
  13. 13. Artificial intelligence: which models we use and which data go in
  14. 14. Your rights and how to exercise them
  15. 15. Security breaches and notification
  16. 16. Complaints to the supervisory authority
  17. 17. Changes to this policy
  18. 18. Minors
  19. 19. Analytics and measurement
  20. 20. Payments and tax data (Stripe)
  21. 21. Administration panel and staff access
  22. 22. Errors, telemetry and support
  23. 23. Impact assessment, records of processing and audits
  24. 24. Disclaimer on large-scale processing
  25. 25. Data of living people: self-replica and memorials with permission

Contents

  1. 1. Data controller and contact details
  2. 2. Categories of data subjects and data processed
  3. 3. Data of deceased persons
  4. 4. Data of invited interlocutors
  5. 5. Data of living third parties appearing in the materials
  6. 6. Purposes and legal bases of processing
  7. 7. Automated decisions and profiling (art. 22 GDPR)
  8. 8. Processors and provider categories
  9. 9. International transfers
  10. 10. Retention periods
  11. 11. Technical and organisational security measures
  12. 12. Cookies and similar technologies (LSSI)
  13. 13. Artificial intelligence: which models we use and which data go in
  14. 14. Your rights and how to exercise them
  15. 15. Security breaches and notification
  16. 16. Complaints to the supervisory authority
  17. 17. Changes to this policy
  18. 18. Minors
  19. 19. Analytics and measurement
  20. 20. Payments and tax data (Stripe)
  21. 21. Administration panel and staff access
  22. 22. Errors, telemetry and support
  23. 23. Impact assessment, records of processing and audits
  24. 24. Disclaimer on large-scale processing
  25. 25. Data of living people: self-replica and memorials with permission

1. Data controller and contact details

The data controller for the personal data processed through LiveMemoriesAI is:

  • Identity of the controller: Sergio Fernández
  • Address: Avenida Gran Vía de Vicálvaro, Madrid, 28052, Spain
  • Privacy and rights email: contact@livememoriesai.com
  • Website: https://www.livememoriesai.com

For any matter relating to personal data protection you can write to the address above. We have not formally appointed a Data Protection Officer (DPO) at this time because, based on our internal assessment, the circumstances of article 37.1 GDPR that would require it do not apply: the main processing is the provision of a service requested by the user and the profiling is instrumental to that provision. This assessment is reviewed periodically; if it changes, a DPO will be appointed and this section updated.

LiveMemoriesAI relies on external legal advice in data protection, at least every six months, to review compliance and update the measures when needed.

2. Categories of data subjects and data processed

We process data on the following categories of data subjects, each with its own regime:

  • Custodians (account holders): email, optional name, authentication metadata, preferences, memorial parameters, and billing data when they take a paid plan.
  • Collaborators (co-custodians): email, granted permissions and activity metadata within the shared replica.
  • People who create a replica of themselves: in addition to custodian data, the materials, memories and, where applicable, voice samples about themselves that they choose to provide. These are personal data of a living person, fully subject to the GDPR (§25).
  • Living people whose memorial is created with their permission (Terms §6): the materials, memories and traits provided about them. These are personal data of a living person, fully subject to the GDPR (§25).
  • Deceased persons who give rise to the replica: texts, photographs, audio, video and other materials contributed by the family. These data fall outside the scope of the GDPR (Recital 27) but are protected by the LOPDGDD (arts. 3 and 96) and by LO 1/1982.
  • Invited interlocutors: Telegram identifier, conversation metadata, fragments of their messages needed for private memory and for operating the service.
  • Living third parties that appear incidentally in the materials (relatives, friends, neighbours, professionals, etc.): names, voices, faces and mentions, anonymised by default in derived text.
  • Website visitors: IP address processed by the network servers for security and fraud prevention, and browsing data only if you accept the measurement category (§12 and §19).
  • People exercising rights: contact data and content of Opposition channel requests.
  • Platform staff: the minimum data needed for technical and security administration.

We do not process special-category data (art. 9 GDPR) as a purpose of the service. When the materials incidentally contain them, the minimisation measures described in §7 of the Terms apply. Those a person chooses to share about themselves in their self-replica follow the regime of §25.

3. Data of deceased persons

Data of deceased persons are outside the scope of the GDPR (Recital 27), but Spanish law grants them specific protection:

  • Article 3 of the LOPDGDD recognises the people connected to the deceased by family or personal ties, their heirs and the people designated or authorised by them the faculty to exercise GDPR rights over the deceased’s data.
  • Article 96 of the LOPDGDD requires the deletion, without delay, of the data of a deceased person when requested by a legitimised person, unless the deceased had expressly forbidden it or the law limits it.
  • LO 1/1982 protects honour, privacy and personal image, and these protections extend post mortem under article 4.

The channel set up for these requests is the Opposition channel, available at /opposition. The platform processes the precautionary suspension and, where appropriate, the removal without undue delay, except for records strictly necessary to evidence the request and the decision taken.

4. Data of invited interlocutors

The invited interlocutor chats with the replica from their Telegram account. To provide the service we process:

  • Telegram identifier (not the phone number: Telegram does not expose it to bots by default).
  • Messages sent and received during the conversation, stored to maintain the interlocutor’s memory and allow them to continue the conversation.
  • Technical metadata (date, time, length) required for operation.
  • Notification and channel preferences if the user configures them.

The interlocutor may request access, rectification or deletion of their data and may order the deletion of their account from the memorial by sending /borrarme to the bot or writing to contact@livememoriesai.com.

We do not process interlocutor data for advertising or for commercial profiling.

5. Data of living third parties appearing in the materials

Materials uploaded by the family may incidentally contain data of living people. By design, the service:

  • Masks the names of third parties in derived text with stable per-document labels.
  • Replaces the faces of unidentified third parties with a generic crop or omits them from messages to interlocutors who should not receive them.
  • Restricts access to the raw texts to the custodian and to internal extraction, anonymisation and maintenance processes.
  • Allows any affected third party to exercise rights through the Opposition channel without creating an account.

6. Purposes and legal bases of processing

We process the data for the following purposes and legal bases:

  • Performance of the requested service (art. 6.1.b GDPR): authentication, account management, operation of the memorial or the self-replica (§25), export and deletion.
  • Performance of the subscription contract (art. 6.1.b GDPR): plan management, billing, failed payments and service communications.
  • Specific consent (art. 6.1.a GDPR): optional usage measurement with Google Analytics 4 (§19), voice cloning, special-category data you choose to provide about yourself in a self-replica (art. 9.2.a GDPR, §25), proactivity reception, marketing personalisation if ever enabled, and optional automated decisions that produce legal or similarly significant effects.
  • Legitimate interest (art. 6.1.f GDPR), balanced against the rights of the data subjects: security, abuse and payment fraud prevention, multi-tenant isolation, append-only audit, retention of consent proofs and aggregated service improvement.
  • Legal obligation (art. 6.1.c GDPR): retention of consent records, invoices and tax documents, responses to authority requests.
  • Vital interests (art. 6.1.d GDPR): detection of and response to risk signals (suicidal ideation, self-harm) and hand-off to professional resources.

We do not use memorial conversations, materials or memories to build advertising profiles, to train external AI models, to sell data or to build engagement rankings. Optional web measurement is limited to the sections visited and to usage events with closed values and no content under §19 and requires your separate prior consent.

7. Automated decisions and profiling (art. 22 GDPR)

The service uses artificial intelligence systems to:

  • Generate the in-character responses of the replica. The automated decision here is text production and does not produce significant legal effects for the user.
  • Suggest memory and photo classifications, style proposals, questionnaire questions and material summaries. These proposals are always subject to human review (HITL) by the custodian before being incorporated into the profile.
  • Detect risk signals and classify the level (1 to 3). At level 3 the system interrupts the character and hands off to professional resources without a real-time human in the loop.

Under art. 22 GDPR, automated decisions that produce legal effects on you or significantly affect you generally require human intervention, the ability to contest the decision or your explicit consent. Here, no automated decision of the service produces legal effects on the user outside the strictly contractual scope. Memory, photo and style proposals are always subject to custodian approval (HITL), and conversational responses do not replace professional advice.

8. Processors and provider categories

To provide the service, LiveMemoriesAI uses the following categories of processors, all under a Data Processing Agreement (DPA) that complies with art. 28 GDPR:

  • Authentication, database and storage infrastructure (Supabase / Postgres + GoTrue + Storage + pgvector).
  • Website hosting and edge functions (Cloudflare Workers, OpenNext), with global CDN distribution.
  • Natural language processing, vision and embeddings (MiniMax and OpenRouter as a gateway to third-party models). Some models may be invoked from regions outside the EEA, with the safeguards of §9.
  • Voice synthesis and cloning (MiniMax Speech). Voice samples and generated audio may be processed outside the EEA under the contractual safeguards of §9.
  • Conversational messaging (Telegram Bot API). The Telegram exchange happens from European regions; the Telegram platform itself processes messages under its own terms and policies.
  • Payments and billing (Stripe). PCI-DSS certified provider; card data are handled in tokenised form and LiveMemoriesAI does not store them (see §20).
  • Transactional email (email provider). For sign-in links by email, critical notifications, invoices and export links.

Optional web measurement uses Google Tag Manager and Google Analytics 4, services provided by Google (Google Ireland Limited for the European Economic Area and Google LLC, in the United States, as the parent company). They are only used if you accept measurement and are governed by Google’s terms applicable to those services. Their scope, data and controls are explained in §12 and §19.

The current named list of providers with their regions and transfer mechanisms is published and maintained in the technical documentation of the service. Any material change is notified to registered users at least 15 days in advance, per §16 of the Terms.

9. International transfers

When a provider processes data outside the European Economic Area (EEA), LiveMemoriesAI uses one of the mechanisms allowed by Chapter V GDPR:

  • Adequacy decision of the European Commission (for example, for providers that participate in the EU-US Data Privacy Framework, DPF).
  • Standard Contractual Clauses (SCC) adopted by the European Commission, with the corresponding impact assessment and, where applicable, supplementary technical and organisational measures.
  • Binding Corporate Rules (BCR), when the provider has them approved by the competent supervisory authority.
  • Explicit and specific consent, only in the cases foreseen by art. 49 GDPR.

If you accept web measurement, your browser connects to Google. Google may process technical connection and measurement data outside the EEA, including the United States. Those transfers rely on the mechanisms of this section provided for in Google’s terms, such as the EU-US Data Privacy Framework, in which Google LLC participates, or the Standard Contractual Clauses (https://policies.google.com/privacy). This option does not authorise sending memorial content to Google.

In particular, voice synthesis (MiniMax), processing by some large models and the delivery of certain transactional emails may rely on services outside the EEA. In all these cases the contractual agreement includes the SCCs and, when the provider participates in the EU-US DPF, it is considered covered by adequacy decision.

When a paid plan is contracted, Stripe may process billing data outside the EEA (for example, in the United States) under the SCCs and, where applicable, the EU-US DPF. Card data never reach LiveMemoriesAI’s servers.

The category, country and specific mechanism of each transfer are documented and updated when providers or regions change.

10. Retention periods

Retention periods are defined per category:

  • Custodian account: while the account is active. After cancellation, identifying data are deleted from the operational environment within 72 hours.
  • Materials and replicas: while the account and replica are active, or while the replica is archived. Deletion is executed within 72 hours of a valid request, except for the technical rotation windows of backups, which may extend up to 30 days.
  • Consent records (append-only): for the limitation period of the derived actions (indicatively 6 years), on the legal basis of legitimate interest for legal defence.
  • Access audit and security events: for the minimum time needed to evidence compliance, no more than 5 years.
  • Conversations of invited interlocutors: while the replica is active or until the interlocutor requests deletion. After /borrarme, data are deleted from the operational environment within 72 hours, subject to the technical windows of §18 of the Terms.
  • Billing and payment data: for the duration of the contractual relationship and afterwards for the period required by applicable tax and corporate law (in Spain, indicatively 4 years for tax purposes and up to 6 years for the limitation of commercial obligations).
  • Technical logs and error records: kept between 30 and 180 days depending on their operational purpose, and pseudonymised wherever possible.
  • Opposition and rights requests: for the time necessary to manage the request, document it and defend the decision; indicatively, 6 years.
  • Support messages: for the time needed to resolve the query and, afterwards, up to 2 years for service quality purposes.
  • Measurement data in Google Analytics: the property is configured to retain event-level and user-level data for 14 months, without extending the period on activity. The measurement choice is remembered for 180 days (§12).

11. Technical and organisational security measures

We apply technical and organisational measures appropriate to the risk, under art. 32 GDPR:

  • Encryption in transit (TLS 1.2 or higher) between every component.
  • Encryption at rest of backups and of files in object storage.
  • Verified multi-tenant isolation with automated tests in continuous integration.
  • Append-only audit of consents, administrative accesses and security events.
  • Role-based access control with least privilege for staff.
  • Encrypted backups with automatic rotation; restoration tested periodically.
  • Secrets managed in a dedicated service, never in the code or the web bundle.
  • Monitoring of health, errors and operational metrics; alerts on anomalies.
  • Internal training policy on data protection and confidentiality.

12. Cookies and similar technologies (LSSI)

We use necessary service cookies and offer optional measurement with Google separately. Measurement tools are not loaded until you accept that option in the cookie notice:

  • Session and sign-in (sb-…-auth-token, from Supabase Auth): keeps you signed in after you enter your account. It only exists if you sign in.
  • Language (lm_locale) and appearance (lm_theme): remember the language and the light or dark theme you choose. They are kept for 12 months.
  • Measurement preference (lm_analytics_v1): remembers your acceptance or rejection for 180 days in this browser. The former lm_cookie_notice only recorded that an informational notice had been seen and does not authorise measurement.
  • Google Analytics cookies (_ga and _ga_2GY3C5NZ5G): only created after you accept measurement. They pseudonymously distinguish browsers and sessions to produce aggregated statistics. Their duration is determined by Google Analytics according to the property configuration.
  • Browser session storage: after you accept measurement, we store technical markers so the same event is not sent twice. They disappear when you close the tab.

The general cookie notice offers Accept and Reject. Both choices let you keep using the service. Accept enables the optional analytics described here. We do not connect to Google Tag Manager before acceptance or if you reject. We use Google consent mode with measurement and advertising denied by default. Accepting only grants measurement (analytics_storage); advertising permissions (ad_storage, ad_user_data and ad_personalization) remain denied.

You can change or withdraw your choice through Cookie preferences on this page or in your account Settings. Withdrawing active consent reloads the page to stop loaded tags; you can remove previous measurement cookies in your browser. Necessary cookies continue working and do not depend on accepting measurement.

To configure cookies in your browser, please consult its help section. Blocking strictly necessary cookies may prevent the service from working.

13. Artificial intelligence: which models we use and which data go in

The service uses several types of artificial intelligence systems, each with a different data flow:

  • Conversational model (text): generates the replica’s in-character responses. Inputs are the replica-specific system prompt (profile, memory, configuration), the recent conversation history and the memory fragments retrieved by hybrid search filtered by replica_id and by the inter-interlocutor privacy rules.
  • Vision model (VLM): classifies and describes photographs from the family archive. Inputs are the images sent for cataloguing and labelling; they are not used to identify living people outside the memorial.
  • Embeddings: convert texts and images into vectors for semantic search within the replica. The vectors do not contain the original text and cannot reconstruct it.
  • Voice synthesis: generates the replica’s audio from the text to be synthesised and the authorised clone. See safeguards in §11 of the Terms.
  • Local audio transcription: converting audio to text runs on LiveMemoriesAI’s own infrastructure; intimate audio is not sent to external providers for this task.
  • Risk-signal classifier: analyses incoming messages to detect signs of acute grief, dependency or ideation and to trigger the hand-off protocol. It operates on the message text and keeps no additional profiles.

Materials uploaded by the family and the conversations are not used to train external AI models. The platform uses the models as processors and applies the safeguards of §8 and §9.

When a model is invoked from regions outside the EEA, the mechanisms of §9 apply and calls are anonymised and pseudonymised where possible (avoiding unnecessary identifiers of the custodian or interlocutors in the prompt sent to the AI).

Generated audio carries machine-readable marking under art. 50.2 of the AI Act; the synthetic nature of the voice is additionally communicated audibly and in text.

14. Your rights and how to exercise them

You may exercise the rights recognised by the GDPR and the LOPDGDD:

  • Access: know what data we process and obtain a copy in a structured, commonly used format.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: request deletion of your data when no longer necessary or when you withdraw consent.
  • Restriction: request that we limit processing in certain circumstances (for example, while accuracy is being verified).
  • Objection: object to processing based on legitimate interest on grounds relating to your particular situation.
  • Portability: receive the data you have provided in a structured, commonly used and machine-readable format, and transmit them to another controller.
  • Withdrawal of consent: withdraw any previously given consent at any time (for example, for voice cloning or measurement), without affecting the lawfulness of prior processing.

To exercise them, write to contact@livememoriesai.com, use the controls in your account (settings, export, deletion) or use the Opposition channel (/opposition) if you do not have an account. Telegram interlocutors can use the /identidad and /borrarme commands. We will respond within a maximum of one month (art. 12.3 GDPR), extendable to two months when the request is complex, with prior notice.

We may ask for proportionate identity or relationship verification to avoid disclosing information to the wrong person. This verification is strictly the minimum necessary and is documented.

15. Security breaches and notification

In the event of a security breach affecting personal data:

  • We will notify the competent supervisory authority within a maximum of 72 hours of becoming aware, unless the breach is unlikely to entail a risk to the rights and freedoms of individuals.
  • If the breach entails a high risk to your rights and freedoms, we will communicate it to you without undue delay.
  • The communication will include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences and the measures taken or proposed.
  • We will document every breach with its impact assessment and the measures taken, under art. 33.5 GDPR.

16. Complaints to the supervisory authority

If you believe the processing of your personal data infringes the law, you may lodge a complaint with the competent supervisory authority. In Spain:

  • Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).
  • C/ Jorge Juan, 6 · 28001 Madrid · Spain.
  • Website: https://www.aepd.es · Electronic office: https://sedeagpd.gob.es

If you reside in another EEA country, you may complain to the supervisory authority of your country of habitual residence. In cross-border consumer disputes the European Commission ODR platform can facilitate out-of-court resolution (https://ec.europa.eu/consumers/odr).

Before complaining to an authority, we invite you to write to us so we can try to resolve the issue. Most incidents are resolved without administrative intervention.

17. Changes to this policy

When we update this policy for a legal, technical or operational change:

  • We will publish the new “Last updated” date at the top of the document.
  • If the change is material, we will notify you at least 15 days in advance by email or by a prominent in-product notice.
  • Where appropriate, we will ask you to accept the document again (renewed consent) to keep using the service.

18. Minors

Processing of minors’ data follows specific rules:

  • Minors aged 14 to 17 only act as invited interlocutors under the supervision of an adult custodian; they cannot open accounts or act as custodians.
  • We do not knowingly collect data of minors under 14. If we detect that a minor under 14 has interacted with the service, their data are deleted.
  • When the deceased person was a minor, their materials and replica are processed with additional access and anonymisation restrictions (see §21 of the Terms).
  • The legal basis for data of minors aged 14 to 17 as interlocutors is the consent given by the minor, collected through the adult who invites and supervises them.

19. Analytics and measurement

With your prior consent we load Google Tag Manager (container GTM-T2MNF9V2), which activates Google Analytics 4 (measurement ID G-2GY3C5NZ5G). We use it to obtain aggregated usage statistics and improve the clarity and operation of the website. This includes public pages, memorial pages, settings and plans. Without your acceptance, the browser does not connect to Google.

  • Page views contain only the visited section template and a generic title. We replace memorial and account identifiers with :id and exclude URL parameters, fragments, names, emails and form or conversation content.
  • We also measure a closed list of usage actions: sign-up and sign-in, viewing and choosing plans, starting and completing a subscription (plan, period, amount, currency, whether a discount was applied and a technical transaction identifier to avoid duplicates), plan change, cancellation or resumption, creating, activating, archiving or deleting a memorial, setup steps (materials as counts and size ranges, questionnaire, photos, people, review, voice, invitations and consents), preferences and export. Each action only accepts predefined values; any other value is discarded.
  • Each event also states the language, the area of the website (public, memorial, account or administration) and whether a session is signed in, without identifying the account.
  • Google receives at least the technical data necessary for the connection, such as the IP address and browser information. We do not describe this measurement as anonymous or as individual real-time tracking.
  • We do not send memorial materials, memories or messages through our measurement events, or use this measurement for engagement rankings or advertising profiles.
  • Google Analytics enhanced measurement and automatic page views are disabled: only the events described here are sent. We do not use Google Analytics for advertising or remarketing. Cookies and retention are described in §12 and §10; any broader purpose requires appropriate information and consent.

Accepting the terms or privacy policy does not authorise measurement: a separate choice is requested in the cookie notice. You can reject or withdraw it without losing access to the service through Cookie preferences, on this page or in Settings › Preferences (§12). Your choice is remembered for 180 days; our own technical logs retain the periods in §10.

20. Payments and tax data (Stripe)

Paid plans are managed through Stripe, which acts as a data processor for payment data. The flow is as follows:

  • Card details are entered in Stripe’s secure elements; they never pass through LiveMemoriesAI’s servers.
  • LiveMemoriesAI receives a customer and subscription identifier (tokens) from Stripe, along with payment status, without access to the card number (PAN).
  • Billing data (name, email, tax address, amounts, VAT) are kept according to the tax and corporate periods of §10.
  • Stripe may process data in the United States and the European Union under the SCCs and, where applicable, the EU-US DPF (see §9).
  • To prevent fraud, Stripe may assess the transaction risk; this assessment is not used to make decisions about you beyond the specific payment.
  • You can request a copy of your invoices, correction of your billing data and deletion of the payment account from the panel or by writing to contact@livememoriesai.com.

21. Administration panel and staff access

LiveMemoriesAI operates an internal administration panel to run the platform. Access follows strict rules:

  • Roles and least privilege: each staff member only accesses what their function requires (support, operations, security).
  • Administrative accesses are recorded in the system audit trail.
  • The panel does not display the content of replica messages or materials; it shows statuses, operational metrics and errors.
  • Exceptionally, on a well-founded suspicion of abuse or due to a legal request, specific content may be accessed through a motivated, recorded protocol.
  • Staff sign confidentiality commitments and receive data protection training.

22. Errors, telemetry and support

To keep the service quality high we process a minimum amount of technical data:

  • Browser errors: when the website fails, your browser may send us an anonymous report with the error type and the page, without conversation content or personal data.
  • Operational telemetry: performance metrics, queue usage and per-replica AI consumption, without message content.
  • Support: when you write to us, we process your email, subject and query for the periods indicated in §10.
  • Logs never include message content or personal data; only metadata are recorded.

23. Impact assessment, records of processing and audits

LiveMemoriesAI maintains the following documentary compliance safeguards:

  • Records of processing activities (art. 30 GDPR): an updated inventory of processing operations, purposes, legal bases, periods and processors.
  • Data Protection Impact Assessment (art. 35 GDPR): carried out and reviewed periodically, covering at least the risks of emotional vulnerability of users, the processing of third-party materials, voice cloning and minors’ data.
  • Audits: continuous internal review and external data protection advice at least every six months.
  • Automated isolation and security tests: executed as a merge gate in continuous integration.
  • Provider documentation: signed DPAs archived with every processor, and a register of international transfers with their mechanism.

24. Disclaimer on large-scale processing

LiveMemoriesAI processes sensitive materials (conversations, photographs, audio, data of deceased persons) and applies reinforced measures to minimise risk. Nevertheless:

  • The volume and heterogeneity of family materials make it impossible to guarantee perfect anonymisation of every living third party. We therefore recommend reviewing uploaded photographs and conversations and using the anonymisation tools available in the materials panel.
  • No AI system is error-free. If you detect an anonymisation issue, please report it to contact@livememoriesai.com so it can be corrected and, where appropriate, removed.
  • Affected persons have the right to object and request the removal of data concerning them (§5 of the Terms and §3 of this policy).
  • Audio already delivered to another person’s device is outside the technical control of the service: we cannot recover or delete it from the platform. That is why we ask for caution when activating cloned voice.

25. Data of living people: self-replica and memorials with permission

When you create a replica of yourself (Terms §27), your materials, memories, traits and, where applicable, voice samples are personal data of a living person. The GDPR applies in full, not only the post-mortem protection of §3:

  • Legal basis: performance of the service you request (art. 6.1.b GDPR) to create, maintain and serve your replica, and your specific consent (art. 6.1.a GDPR) for optional features such as the cloned voice.
  • Special categories: if you decide to share data about your health, beliefs, sexual orientation or other data under art. 9 GDPR, do so only if you expressly want them to be part of your replica. Their processing relies on your explicit consent (art. 9.2.a GDPR), which you can withdraw at any time by deleting those materials or memories. The minimisation of §7 of the Terms still applies.
  • Your rights: access, rectification (by editing your profile and memories or by writing to us), erasure, restriction, objection, portability through the memorial export (Terms §18) and withdrawal of consent, under §14.
  • Other people: those who appear in your materials remain protected by §5 and may exercise their rights through the Opposition channel. The people you invite chat under the conditions of §4 and their private memory is not shared with you.
  • Retention: while you keep the replica active or archived, with the deletion periods of §10.

After your death, your data fall outside the scope of the GDPR (Recital 27) and move to the regime of §3: the people legitimised under art. 3 LOPDGDD may exercise the corresponding rights and request deletion (art. 96 LOPDGDD), unless you expressly forbade it in accordance with the law. The service does not offer posthumous activation or the designation of heirs within the platform. If a collaborator records your death in the memorial, it starts speaking of you in the past and keeps saying that you created it in life; the change is registered with the declaration of whoever makes it (Terms §4 and §27).

Memorial of another living person (Terms §6): their data are processed with their consent (art. 6.1.a GDPR), which the creator of the memorial declares to have obtained and which the person may withdraw at any time, also through the Opposition channel and without an account. After the withdrawal we suspend the memorial and remove it without undue delay. That person keeps every right of §14; if they die, their data move to the regime of §3.

Internal legal review: 17 August 2026. Subscription information updated on 5 October 2026, Google measurement information on 12 October 2026, the jurisdiction wording on 14 October 2026, the self-replica and Google Analytics 4 information on 15 October 2026 and the memorials of living people and the vital status on 18 October 2026; external legal validation is pending.

18 October 2026

Back to top
LiveMemoriesAI

Memory and legacy, not resurrection.

TermsPrivacyCan I create one?Opposition channelGo to AI disclaimer (§10)