Privacy Policy
Last updated: November 2026 · GDPR compliant
This is a courtesy translation. In case of discrepancy, the French version prevails.
Our commitment: Your memories belong to you. We never sell your data, never share it with advertisers, and give you full control over your digital grimoire.
1. Controller
The controller of your personal data is Abecedia (Pierre Haegeli), a business registered in Belgium (company number BCE 0834.573.350, 6780 Messancy), reachable at: info@grimzoo.com
2. Data collected
We collect the data you provide to us directly when you sign up (email address, first name or nickname) and when you use the service (memories, grimoires, conversations with your AI clone). We also collect anonymous technical data (session cookies, access logs) to improve the service.
3. Purposes of the processing
Your data is used to: provide and personalise the service (grimoire, AI clone, life memory), generate semantic vectors (embeddings) that make it possible to search your memories, ensure the security and proper operation of the service, and contact you if necessary about your account. Photos attached to your memories are analysed by our AI processor (Anthropic) to generate a textual description that lets your clone talk about them, in the same way as the text of your memories. This analysis is never used to identify people. We never use your data for advertising purposes.
4. Legal basis
The processing of your data is based on your consent (Article 6(1)(a) GDPR), given when you create your account and use the service. You can withdraw your consent at any time. Your memories may contain so-called sensitive data within the meaning of Article 9 GDPR (health, religious or philosophical beliefs, political opinions, sex life…). Their processing is based on your explicit consent (Article 9(2)(a) GDPR), given when your account is created (a checkbox when signing up on the website, an explicit statement before the sign-in code is sent, on the website and in the app). You can withdraw it at any time by deleting the memories concerned or your account.
5. Data sharing
Your memories and conversations are never sold or shared with third parties. If you import a Facebook or Instagram archive, it is read “locally” in your browser: the archive itself is never sent to our servers, and only the posts you choose to keep (and their photos) are stored, encrypted. Comments and third-party content in the archive are never imported. The only processors with technical access are: Supabase (database hosting, authentication — EU), Hetzner (server hosting — Finland, EU), Anthropic / Claude API (AI processing for the clone and the Fireside, automatic classification of your memories by theme, feeling and place, description of the visual content of your photos, splitting into memories of the notebooks and PDFs you import, as well as of the transcripts of the audio recordings you import, which it splits and tidies up, and writing of the visual scene when you ask to illustrate a memory; when Grimzoo asks you questions (“Tailored” questions, opening a Fireside without a topic or from a photo), your year of birth and, if you have written it, your “Who I am” introduction are sent to it in order to place the questions within your life; when it automatically classifies a memory or your clone answers you, only your year of birth goes with it, to date what you tell; when your shared grimoire's Clone answers a visitor (if you turned it on), it receives your first name, never your year of birth; your “Who I am” introduction never appears in a shared grimoire and is never used to write a memory on your behalf; data not used to train models; contract concluded with Anthropic Ireland Limited — Ireland, with processing in the United States, see section 6), OpenAI (generation of semantic vectors for search, generation of the image when you ask to illustrate a memory, spelling correction of your text when you request it, transcription of the audio recordings you import, and, in a Fireside told out loud, reading Grimzoo's questions aloud and transcribing your spoken answers (the sound is not kept); data not used to train models; contract concluded with OpenAI Ireland Ltd. — Ireland, with processing in the United States, see section 6), Resend (sending of transactional emails: login codes, reminders and notifications — United States, see section 6), and Sentry (monitoring of technical errors — hosted in the European Union, Germany; receives only anonymised error reports, never the content of your memories, your photos or your credentials). Outside the Fireside told out loud, dictation (the microphone button) and reading aloud (the “Listen” button) rely on your browser's or device's voice service, not on Grimzoo or its processors: depending on the browser, your voice or the text being read may be processed by its publisher, for example Google for Chrome or Apple for Safari, under its own terms. Grimzoo only receives the dictated text, which you review before saving it; for reading aloud, Grimzoo picks a voice installed on your device, which sends nothing, when one is available.
6. International data transfers
Some of your data is processed outside the European Union, in the United States. For processing by artificial intelligence, your contractual counterparty is established in the European Union — Anthropic Ireland Limited and OpenAI Ireland Ltd. — and it is that entity which then transfers the data to its affiliates in the United States. Transactional emails (login codes, reminders, notifications) are sent by Resend (Plus Five Five, Inc.), established in the United States, which processes the data there directly. These transfers are governed by the standard contractual clauses adopted by the European Commission (Article 46 GDPR), incorporated into the data processing agreements concluded with each of these providers; a copy of these safeguards can be obtained on request at info@grimzoo.com. Your data is never used to train these providers' models. The hosting of your grimoire — database, server, files, backups and technical monitoring — remains, for its part, located in the European Union. Finally, for the sake of transparency: the encryption of your memories protects their storage on our servers; the content needed for a given processing operation (the text of a memory, a photo) is decrypted for the duration of the call to the provider concerned.
7. Retention period
Your personal data is kept for as long as your account is active. If you delete your account, all of your data (profile, memories, conversations, embeddings) is deleted within 30 days.
8. Your rights (GDPR)
In accordance with the GDPR, you have the following rights: the right of access (to obtain a copy of your data), the right to rectification, the right to erasure (“right to be forgotten”), the right to data portability (JSON export available in Settings), the right to object, and the right to restriction of processing. To exercise these rights, contact us at: info@grimzoo.com
9. Testimonies from someone close to you
You can ask someone close to you to complete one of your memories by sending them a link yourself: Grimzoo never writes to that person and does not know their address. The only data concerning them is the first name you entered to recognise them — it is not verified — and the text they write, stored encrypted like your memories. They have no account, and none is ever created for them. Before sending, they are told that you will be able to quote their words by name, including if the memory is shared or printed: sending constitutes agreement, and the version of that information and its date are kept. You can then integrate it into your memory — quoted in quotation marks and under their name, or blended into your text after review by an artificial intelligence (Anthropic, see sections 5 and 6); it then follows the fate of your memory and may therefore appear in a shared grimoire or in a printed book. An unused link expires after 30 days and can be revoked at any time; a reply received can be erased as long as you have not integrated it. Once integrated, the record of their agreement is kept for as long as the memory: it is what attests who said what, and it disappears with the memory or with your account. This text is included in the export of your data. To exercise their rights (access, rectification, erasure), this person can contact you, or write to info@grimzoo.com stating who sent them the link: nothing in our databases makes it possible to find them otherwise. If this relative dictates their answer with the microphone, their voice is turned into text by their browser's voice service (see section 5).
10. Shared memories and the people they mention
Your memories often speak about other people: your family, your friends, your colleagues. As long as they stay private, they fall within your personal use. When you share them through an open link (shared grimoire or shared memory), anyone who receives that link can read them. These pages are not indexed by search engines, but you decide who you send the link to, and you are responsible for the information you make accessible in this way about other people, especially information relating to their health, their beliefs or their private life. The “Invited people” mode limits access to the email addresses you designate. A person who recognises themselves in a shared memory and wants it removed can ask you directly, or write to info@grimzoo.com with the link concerned: we will pass their request on to you and may, where appropriate, deactivate the share.
11. Security
We implement appropriate technical and organisational measures: encryption of data in transit (HTTPS/TLS), passwordless authentication by 6-digit OTP code, row-level security policies on the database, and restricted access to production data.
12. Cookies
Grimzoo uses only cookies strictly necessary for the operation of the service (session, authentication). Audience measurement is provided by Umami, a self-hosted, cookie-free solution that collects no personal data and no individual identifier. We do not use advertising or third-party tracking cookies. You can configure your browser to refuse cookies, but this may affect the operation of the service.
13. Complaints
If you consider that the processing of your data is not compliant, you can lodge a complaint with the competent supervisory authority: in Belgium, the APD (Autorité de protection des données) — www.autoriteprotectiondonnees.be; in France, the CNIL (Commission Nationale de l'Informatique et des Libertés) — www.cnil.fr
14. Contact
For any question about this policy, write to: info@grimzoo.com
To exercise your GDPR rights, contact us at info@grimzoo.com