Legal
Privacy Policy
Last updated: June 2024
1. Introduction
RecallGuard Infrastructure (“RecallGuard”, “we”, “us”, or “our”) provides an enterprise-grade governed memory control plane for AI agents. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our platform, APIs, and related services (collectively, the “Services”).
By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.
2. Information We Collect
2.1 Account Information
When you register, we collect your email address, organisation name, and any profile information you provide. We use email OTP (one-time passcode) authentication — we never store passwords.
2.2 Agent Memory Content
Your AI agents submit memory content to RecallGuard for governance review. This content is stored in our systems (Aurora DSQL) until it is approved, rejected, archived, or erased. All submitted content is encrypted at rest and in transit.
2.3 Audit and Activity Data
We maintain an append-only audit log of all governance actions (approvals, rejections, erasures, key operations) for compliance and accountability purposes. Audit log entries are never deleted — this is a core product guarantee required for regulatory compliance.
2.4 Technical and Usage Data
We automatically collect IP addresses, request timestamps, HTTP method/path, and response codes for security monitoring and rate limiting. We do not log memory content in access logs.
3. How We Use Your Information
- To provide, operate, and improve the Services
- To send transactional emails (sign-in codes, team invitations)
- To enforce access policies and role-based permissions
- To detect and prevent fraud, abuse, and security threats
- To comply with legal obligations and respond to lawful requests
- To generate anonymised usage analytics that improve the platform
We do not sell your data. We do not use memory content submitted by your agents to train AI models.
4. PII Detection and Handling
RecallGuard uses Amazon Comprehend to scan memory content for Personally Identifiable Information (PII) before it enters the governance review queue. Detected PII entities are flagged on the memory record and surfaced to your reviewers. We do not extract or store PII entities separately — only the metadata indicating their presence is retained.
5. Data Sharing and Disclosure
We do not sell, rent, or share your personal information with third parties except as necessary to:
- Deliver the Services — AWS (Aurora DSQL, OpenSearch, Bedrock, Comprehend, S3, SQS, Lambda), Vercel (compute and deployment), Resend (transactional email), Upstash (rate limiting and caching)
- Comply with law — in response to valid legal process or to protect the rights, property, or safety of RecallGuard, our customers, or the public
- Business transfers — in connection with a merger, acquisition, or sale of assets, where your information may be transferred as part of that transaction
All sub-processors are contractually bound to protect your data and may not use it for their own purposes.
6. Data Retention
We retain your data as long as your account is active or as needed to provide the Services. Audit log entries are retained indefinitely as required for regulatory compliance. Memory content that is rejected or archived may be purged after 90 days. Upon account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law or for legitimate audit purposes.
7. GDPR and Your Rights
If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:
- Access — request a copy of personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your personal data (“right to be forgotten”). Note: audit log entries cannot be deleted for compliance reasons, but memory content can be erased via our GDPR Erasure tool
- Restriction — request that we restrict processing of your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, contact us at privacy@recallguard.dev. We will respond within 30 days.
8. Security
We implement industry-standard technical and organisational measures to protect your data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Short-lived IAM credentials via OIDC (no long-lived AWS keys stored)
- API key hashing — plaintext keys are shown once and never stored
- HMAC-SHA256 webhook signatures for payload integrity
- Rate limiting and SSRF protection on all public endpoints
- Append-only audit log with tamper-evident S3 exports (Object Lock)
No system is 100% secure. If you discover a security vulnerability, please disclose it responsibly to security@recallguard.dev.
9. Cookies and Tracking
We use session cookies set by Better Auth to maintain authenticated sessions. We do not use third-party advertising or tracking cookies. We do not use analytics services that share your data with third parties.
10. Children's Privacy
The Services are intended for business use and are not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.
11. International Transfers
RecallGuard is deployed in AWS eu-west-2 (London) and Vercel's lhr1 region. If you access the Services from outside the UK/EEA, your data may be transferred to and processed in those regions. We rely on Standard Contractual Clauses (SCCs) for any transfers outside the EEA/UK.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the dashboard at least 14 days before the change takes effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy.
13. Contact Us
For privacy-related inquiries:
- Email: privacy@recallguard.dev
- Security: security@recallguard.dev