Cookie & Privacy Policy

This policy is issued by In Memo LLC ("Mémo," "we," "us," or "our"), a California limited liability company operating in Los Angeles. It explains what personal information we collect through in-memo.com, why we collect it, who we share it with, and the rights available to you — including under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

When you use this site, we may collect:

• Email address — when you submit it through our signup form, along with the date and time of signup.
• Phone number — if you opt in to text messages, either through a Klaviyo signup form on our site or through the consent checkbox at Shopify checkout, we collect your phone number to send you marketing texts.
• Order and shipping information — if you place an order through our store, our e-commerce platform, Shopify, collects your name, email, shipping and billing address, and order history in order to fulfill your purchase.
• Bot-protection signals — our fraud-prevention provider, Cloudflare (Turnstile), automatically collects technical signals such as your IP address and device/browser characteristics to verify you're not a bot.
• Basic server logs — our hosting provider, Vercel, automatically logs standard technical data (IP address, browser type, request timestamps) for security and operational purposes.
• Aggregate traffic data — we use Cloudflare Web Analytics, a cookieless analytics tool, to see how many people visit this site, which pages they view, and where traffic comes from. It doesn't use cookies or track you individually across visits. If you accept advertising cookies, we also use Google Analytics, which does set cookies and gives your browser an identifier so Google can measure your visits over time; it doesn't run unless you accept, and never runs if your browser sends a Global Privacy Control (GPC) signal.
• How you found us — we keep our own record of visits to this site and how each visit arrived (the referring site, or the campaign link you clicked), tied to a random ID stored in your browser rather than to your name or email. We use it to count unique visitors and see which marketing works. If you join the waitlist, we add how you first arrived — for example the campaign or referring site — to your signup record so we can tell what brought you here. This doesn't involve advertising platforms.
• Optional details you choose to give — after you join the waitlist we may offer to ask for your first name, your city, and how you heard about us. All of it is optional and you can skip it. We add it to your signup record in Klaviyo so we can address you by name and plan launch events and shipping. If you pick a city from our list, we also record its region and country. We keep your answer to "how you heard about us" in our own records too, tied only to the random visitor ID above, never to your name or email.
• Your place in line — early signups may receive an early-access tier. To give each person one permanent place, we keep a one-way, keyed fingerprint of your email address (not the address itself) alongside your position, and we add your position and tier to your signup record.
• Advertising identifiers — if you accept advertising cookies in our cookie notice, Meta, TikTok, and Google automatically collect technical identifiers (such as browser and device characteristics) and record that you visited this site and, if you sign up, that you completed our signup form — including your IP address and a hashed (non-readable) version of your email address, so they can match it to your account — so they can show you relevant ads about Mémo elsewhere on the web. This doesn't run unless you accept it, and never runs if your browser sends a Global Privacy Control (GPC) signal.

We don't process or store payment card details ourselves — those are collected and handled directly by Shopify Payments, our payment processor. Beyond that, we don't collect or knowingly process sensitive personal information — things like government ID numbers, precise geolocation, or biometric data.

If you're located in the EEA, UK, or Switzerland, our legal bases are:

• Consent — you affirmatively submit your email to join our list, and can withdraw that consent at any time.
• Performance of a contract — to process, fulfill, and support an order when you make a purchase.
• Legitimate interests — for bot prevention, fraud protection, and keeping the site secure and operational. We also rely on it to understand how this site is used and which of our marketing works, using the random visitor ID described above (outside the EEA, the UK and Switzerland; there we ask first).

• Sending updates about Mémo — including launches and early access — by email
• If you opt in, sending marketing text messages about Mémo by phone
• Processing, fulfilling, and providing support for orders placed through our store
• Preventing automated abuse of our signup form and checkout
• Maintaining the security and reliability of our website
• Internally reviewing and analyzing order and customer-support data — for example, using AI tools such as Anthropic's Claude — to help us understand and improve our operations
• If you accept advertising cookies, showing you relevant ads about Mémo on Meta, TikTok, and Google, and measuring how this site is used and which of those ads work, using Google Analytics

We don't sell your personal information for money, and we don't use it for automated decision-making or profiling that produces legal or similarly significant effects. Any internal AI-assisted analysis is used only to inform our own operations, not to make automated decisions about you, and isn't used to train third-party AI models.

We share limited data with service providers who help us run this site, each acting under their own privacy commitments:

• Shopify Inc. — powers our online store and checkout, and processes order, shipping, and billing information on our behalf.
• Shopify Payments — our payment processor, which handles and stores payment card details directly; we never see or store full card numbers.
• Klaviyo, Inc. — our email and SMS marketing platform, which stores your email address and/or phone number and engagement data.
• Cloudflare, Inc. — provides Turnstile, our bot- and fraud-prevention service, and Cloudflare Web Analytics, a cookieless analytics tool we use to see aggregate traffic like page views and referrers.
• Vercel Inc. — hosts this website and processes standard server logs.
• Supabase, Inc. — hosts the database where we keep our own records described in this policy: the short-lived copy of signup attempts, your place in line, and our visit and cookie-choice records, which are tied to a random ID rather than to your name or email.
• Anthropic, PBC — we may use Anthropic's Claude AI models internally to help us review and analyze order and customer-support data. This use is internal only — Claude is not customer-facing on this site today — and Anthropic does not use this data to train its models.
• Meta Platforms, Inc., TikTok Inc., and Google LLC — if you accept advertising cookies, these platforms receive technical identifiers and signup activity so they can show you ads about Mémo on their own services, and Google also receives the pages you view through Google Analytics, which we use to measure our traffic. This may be considered "sharing" your information under the CCPA; see your rights and opt-out options below.
• Professional advisors — accountants, attorneys, and insurers, where necessary for them to advise us.
• Successors — if we're ever involved in a merger, financing, acquisition, or sale of assets, information may be disclosed as part of that transaction, subject to standard confidentiality protections.
• Legal authorities — where required by law, subpoena, or court order, or to protect the rights, property, or safety of Mémo, our customers, or the public.

We don't sell your personal information for money. Advertising cookies are opt-in — nothing is shared with Meta, TikTok, or Google unless you accept them, and you can withdraw that choice at any time via "Do Not Sell or Share My Personal Information" in the site footer.

The vendors named above reflect our current practice, and we may add, remove, or replace any of them at any time, provided the new vendor is bound by confidentiality and data-protection obligations consistent with this policy. Switching a vendor within a category described above doesn't by itself change what we collect or why, so it doesn't require a new version of this policy.

Our service providers may process your information in the United States or other countries outside your own. Where required, these transfers rely on appropriate safeguards, such as Standard Contractual Clauses.

• Email signups — for as long as you remain subscribed, and for a limited period afterward to honor unsubscribe/suppression requests, unless you ask us to delete it sooner.
• Signup attempts — if you submit our signup form, we briefly keep a copy of your email address so a technical failure can't silently lose your signup; that copy is deleted within 30 days.
• Visit and cookie-choice records — our own records of site visits, cookie-notice choices and your "how you heard about us" answer, tied to the random visitor ID, are deleted after 13 months. A signup itself is kept only as a count, with the visitor ID removed after 13 months.
• Your place in line — for as long as you're on the list; on request we'll delete it.
• Backups — information we delete may remain in encrypted database backups for a limited period until they expire.
• Order and transaction records — for as long as needed to fulfill your order and provide related support, and afterward for as long as required to meet our tax, accounting, and legal recordkeeping obligations.

If you're in the EEA, UK, or Switzerland, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request erasure of your information
• Restrict or object to our processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

If you're a California resident, you have the right to:

• Know the categories and specific pieces of personal information we've collected about you, the sources it came from, why we collected it, and who we've shared it with
• Delete personal information we hold about you, subject to a few legal exceptions — for example, records we're required to keep for tax or accounting purposes
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information — we don't sell personal information for money, and you can opt out of the advertising "sharing" described above at any time via "Do Not Sell or Share My Personal Information" in the site footer, which withdraws consent and stops any future sharing with Meta, TikTok, or Google
• Limit the use of sensitive personal information — this doesn't add anything in practice, since we don't collect or use sensitive personal information beyond what's needed to complete a transaction
• Not be discriminated against for exercising any of these rights

Shine the Light. California residents may separately request a list of any third parties to whom we disclosed personal information for their own direct marketing purposes in the prior calendar year. We don't currently make such disclosures.

To exercise any of these rights, email privacy@in-memo.com. We'll verify your identity using information tied to your account or order history and respond within 45 days, extendable by another 45 days where the law allows. You may designate an authorized agent to make a request on your behalf; we may ask for written proof of that authorization and will still separately verify your identity.

If you live in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, or another state with a comprehensive consumer privacy law, you have rights to know, delete, and correct your personal information, and to opt out of targeted advertising, that are substantially similar to the CCPA rights above, along with a right to appeal a denied request.

Nevada law (NRS 603A) separately gives Nevada residents the right to opt out of the sale of certain "covered information." We don't sell covered information as Nevada law defines it.

To exercise any of these rights, or to appeal a decision, email privacy@in-memo.com.

Cloudflare Turnstile may set cookies or use similar device signals to verify you're human, including in "invisible" mode where no challenge is shown. See Cloudflare's Turnstile Privacy Addendum for how Cloudflare handles this. Cloudflare Web Analytics is cookieless and doesn't set any cookies. Neither of these requires your consent to operate.

Advertising and measurement cookies (Meta, TikTok, Google Ads, and Google Analytics) are different: they're off by default and only start once you click "Accept" on our cookie notice. That notice gives you one choice covering all of them: "Accept" is what lets Meta, TikTok, and Google set these cookies and receive the activity described above, and "Decline" leaves them all off. You can change your choice at any time via "Do Not Sell or Share My Personal Information" in the site footer, which reopens the same notice. If your browser sends a Global Privacy Control (GPC) signal, we treat that as an opt-out automatically and advertising cookies never load, regardless of any earlier choice.

Your choice on our cookie notice is remembered in your browser's local storage, not a cookie. The random visitor ID described above is stored the same way; it is replaced with a new one after 13 months, and you can remove it at any time by clearing this site's data in your browser. If you are in the EEA, the UK or Switzerland, we only set it after you accept our cookie notice.

There's no accepted industry standard for how a site should respond to a browser's "Do Not Track" signal, so beyond honoring Global Privacy Control as described above, this site doesn't otherwise change its behavior based on one.

If you opt in — through a Klaviyo signup form on our site, or through the consent checkbox at Shopify checkout — you agree to receive recurring automated marketing text messages from Mémo at the phone number you provide. Consent isn't a condition of purchase. Message and data rates may apply, and message frequency varies. Reply STOP to unsubscribe at any time, or HELP for assistance. This consent is governed by the Telephone Consumer Protection Act (TCPA).

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the personal information we handle, including access restrictions and secure hosting infrastructure. No method of transmission or storage is completely secure, and we can't guarantee absolute security. If a security incident affects your personal information, we'll notify you and any applicable regulators as required by law.

This site links to third-party platforms, like Instagram and TikTok. We aren't responsible for their privacy practices — review their own policies before sharing information with them.

This site isn't directed to children under 16, and we don't knowingly collect personal information from them.

We may update this policy from time to time. The "last updated" date above reflects the most recent revision. If a change materially affects how we use personal information we've already collected, we'll give more prominent notice — such as an email or a banner on the site — before it takes effect.

Our city search uses data from GeoNames, licensed under Creative Commons Attribution 4.0. Your typed search text is processed on our own servers, not sent to GeoNames.

To exercise any of the rights above, or with any question about this policy, In Memo LLC can be reached at privacy@in-memo.com, via Instagram, or by mail at In Memo LLC, 2108 N St Ste N, Sacramento, CA 95816. Every marketing email we send includes a one-click unsubscribe link, and you can stop marketing texts at any time by replying STOP.