Privacy Policy
Last updated: September 2026 · GDPR compliant
This is a courtesy translation. In case of discrepancy, the French version prevails.
Our commitment: Your memories belong to you. We never sell your data, never share it with advertisers, and give you full control over your digital grimoire.
1. Controller
The controller of your personal data is Abecedia (Pierre Haegeli), a business registered in Belgium (company number BCE 0834.573.350, 6780 Messancy), reachable at: [email protected]
2. Data collected
We collect the data you provide to us directly when you sign up (email address, first name or nickname) and when you use the service (memories, grimoires, conversations with your AI clone). We also collect anonymous technical data (session cookies, access logs) to improve the service.
3. Purposes of the processing
Your data is used to: provide and personalise the service (grimoire, AI clone, life memory), generate semantic vectors (embeddings) that make it possible to search your memories, ensure the security and proper operation of the service, and contact you if necessary about your account. Photos attached to your memories are analysed by our AI processor (Anthropic) to generate a textual description that lets your clone talk about them, in the same way as the text of your memories. This analysis is never used to identify people. We never use your data for advertising purposes.
4. Legal basis
The processing of your data is based on your consent (Article 6(1)(a) GDPR), given when you create your account and use the service. You can withdraw your consent at any time.
5. Data sharing
Your memories and conversations are never sold or shared with third parties. If you import a Facebook or Instagram archive, it is read “locally” in your browser: the archive itself is never sent to our servers, and only the posts you choose to keep (and their photos) are stored, encrypted. Comments and third-party content in the archive are never imported. The only processors with technical access are: Supabase (database hosting, authentication — EU), Hetzner (server hosting — Germany, EU), Anthropic / Claude API (AI processing for the clone and the Fireside, automatic classification of your memories by theme, feeling and place, description of the visual content of your photos, splitting into memories of the notebooks and PDFs you import, and writing of the visual scene when you ask to illustrate a memory; when Grimzoo asks you questions (“Tailored” questions, opening a Fireside from a photo) or automatically classifies a memory, your year of birth and, if you have written it, your “Who I am” introduction are sent to it in order to place questions and memories within your life; this text never appears in a shared grimoire and is never used to write a memory on your behalf; data not used to train models; contract concluded with Anthropic Ireland Limited — Ireland, with processing in the United States, see section 6), OpenAI (generation of semantic vectors for search, generation of the image when you ask to illustrate a memory, spelling correction of your text when you request it, and transcription of the audio recordings you import; data not used to train models; contract concluded with OpenAI Ireland Ltd. — Ireland, with processing in the United States, see section 6), Resend (sending of transactional emails: login codes, reminders and notifications — United States, see section 6), and Sentry (monitoring of technical errors — hosted in the European Union, Germany; receives only anonymised error reports, never the content of your memories, your photos or your credentials).
6. International data transfers
Some of your data is processed outside the European Union, in the United States. For processing by artificial intelligence, your contractual counterparty is established in the European Union — Anthropic Ireland Limited and OpenAI Ireland Ltd. — and it is that entity which then transfers the data to its affiliates in the United States. Transactional emails (login codes, reminders, notifications) are sent by Resend (Plus Five Five, Inc.), established in the United States, which processes the data there directly. These transfers are governed by the standard contractual clauses adopted by the European Commission (Article 46 GDPR), incorporated into the data processing agreements concluded with each of these providers; a copy of these safeguards can be obtained on request at [email protected]. Your data is never used to train these providers' models. The hosting of your grimoire — database, server, files, backups and technical monitoring — remains, for its part, located in the European Union. Finally, for the sake of transparency: the encryption of your memories protects their storage on our servers; the content needed for a given processing operation (the text of a memory, a photo) is decrypted for the duration of the call to the provider concerned.
7. Retention period
Your personal data is kept for as long as your account is active. If you delete your account, all of your data (profile, memories, conversations, embeddings) is deleted within 30 days.
8. Your rights (GDPR)
In accordance with the GDPR, you have the following rights: the right of access (to obtain a copy of your data), the right to rectification, the right to erasure (“right to be forgotten”), the right to data portability (JSON export available in Settings), the right to object, and the right to restriction of processing. To exercise these rights, contact us at: [email protected]
9. Testimonies from someone close to you
You can ask someone close to you to complete one of your memories by sending them a link yourself: Grimzoo never writes to that person and does not know their address. The only data concerning them is the first name you entered to recognise them — it is not verified — and the text they write, stored encrypted like your memories. They have no account, and none is ever created for them. Before sending, they are told that you will be able to quote their words by name, including if the memory is shared or printed: sending constitutes agreement, and the version of that information and its date are kept. You can then integrate it into your memory — quoted in quotation marks and under their name, or blended into your text after review by an artificial intelligence (Anthropic, see sections 5 and 6); it then follows the fate of your memory and may therefore appear in a shared grimoire or in a printed book. An unused link expires after 30 days and can be revoked at any time; a reply received can be erased as long as you have not integrated it. Once integrated, the record of their agreement is kept for as long as the memory: it is what attests who said what, and it disappears with the memory or with your account. This text is included in the export of your data. To exercise their rights (access, rectification, erasure), this person can contact you, or write to [email protected] stating who sent them the link: nothing in our databases makes it possible to find them otherwise.
10. Security
We implement appropriate technical and organisational measures: encryption of data in transit (HTTPS/TLS), passwordless authentication by 6-digit OTP code, row-level security policies on the database, and restricted access to production data.
11. Cookies
Grimzoo uses only cookies strictly necessary for the operation of the service (session, authentication). Audience measurement is provided by Umami, a self-hosted, cookie-free solution that collects no personal data and no individual identifier. We do not use advertising or third-party tracking cookies. You can configure your browser to refuse cookies, but this may affect the operation of the service.
12. Complaints
If you consider that the processing of your data is not compliant, you can lodge a complaint with the competent supervisory authority: in Belgium, the APD (Autorité de protection des données) — www.autoriteprotectiondonnees.be; in France, the CNIL (Commission Nationale de l'Informatique et des Libertés) — www.cnil.fr
13. Contact
For any question about this policy, write to: [email protected]
To exercise your GDPR rights, contact us at [email protected]