Scope and Controllership
This notice explains how Deep Thinking Ltd (a company registered in England and Wales, company number 09091119) handles personal data across the Kizuna-Mem product family. Your rights and our obligations differ depending on which surface you are using:
- Desktop (Free / Personal) — runs locally on your device. Your memories, embeddings, and graph stay on your machine. We see only limited telemetry and licence-activation data, described below.
- kizuna.cloud (Pro / Pro Team / Enterprise Cloud) — a managed service we operate. We are the controller for account and billing data, and we act as a processor for the Customer Data you submit.
- Enterprise (Self-Hosted) — the Kizuna-Mem binary runs inside your infrastructure. You are the controller for Customer Data; your own systems process it. We only handle the limited data required to issue and enforce licence keys and to provide support you request.
Data We Collect
The categories of personal data we collect depend on the surface:
The Desktop application does not upload Customer Data to our servers in Free or Personal modes. Diagnostic telemetry from the Desktop is opt-in, aggregated, and scrubbed of content before transmission.
How We Use Your Data
We process personal data for the following purposes:
- To provide, secure, and operate the Services.
- To authenticate you and enforce licence and tenant isolation.
- To process payments and issue invoices.
- To monitor usage, detect abuse, and enforce rate limits and quotas.
- To provide technical support you request.
- To improve the Services through aggregated, non-identifying analysis of system behaviour.
- To comply with legal obligations and enforce our Terms.
We do not sell personal data. We do not use Customer Data to train shared machine-learning models. We do not use Customer Data for advertising.
Legal Bases (UK GDPR / EU GDPR)
Where UK or EU data protection law applies, we rely on the following legal bases:
Subprocessors
For the managed kizuna.cloud service we rely on the following subprocessors. Enterprise (Self-Hosted) does not use any of these for Customer Data — your infrastructure is the substrate.
We will notify customers of material changes to the subprocessor list through the Services or by email.
International Transfers
Customer Data on kizuna.cloud is stored primarily on EU-region servers (Hetzner, Germany) with edge caching via Cloudflare's global network. Where data is transferred outside the UK or EEA — for example to a subprocessor with US-based operations — we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an equivalent adequacy mechanism.
Enterprise customers can request region-pinned deployments under an Enterprise contract; Self-Hosted Enterprise runs entirely on your infrastructure and pins data by definition.
Retention
Your Rights
Subject to applicable law, you have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent where we rely on it. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).
For kizuna.cloud accounts, many of these rights can be exercised directly in the dashboard — you can export, forget, or delete Customer Data yourself. For everything else, contact us at the address below and we will respond within 30 days.
Security
We apply administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, alteration, or destruction, including end-to-end TLS, encryption at rest, role-based access controls, audit logging, and (for Enterprise) FIPS 140-2 cryptography and WORM audit storage. For more detail see our Security Specification.
No system is impenetrable. We will notify affected customers promptly — and supervisory authorities where required — in the event of a personal-data breach.
Children's Privacy
The Services are not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be announced through the Services or by email. The “last updated” date at the top of this page always reflects the current version.