Privacy Policy

1. Who is responsible

The data controller for the Engram service at engram.rootcause.ro is ROOTCAUSE S.R.L., Brașov, Romania, Trade Registry no. J8/1028/2021, CUI 44063736. Privacy contact: engram@rootcause.ro. For memories you store about your work, you (or your organisation) decide what goes in — see Section 6.

2. What we process, and why

• Account data — your email and name (from Google sign-in or the email code flow). Basis: performing our contract with you.
• Your memories (User Content) — processed only to provide the service, on your instructions. Cloud Hosted brains are stored encrypted at rest in an isolated per-account space; Locally stored brains never leave your device (only an anonymized structural shape reaches us, for your brain map). Never used to train models, never sold, never shared. Basis: contract.
• Sign-in codes — the email code, and the requesting IP address (abuse prevention only). Deleted within 24 hours. Basis: contract and our legitimate interest in preventing abuse.
• Your benefit ledger — what the service did for you (skills fired, corrections, tokens saved), shown only to you in your console. Deleted with your account. Basis: contract.
• Improvement signals — pseudonymous, content-free records of what kind of problem the service helped with (a role category and a generic problem description; your identity is one-way hashed; never your memory content, names, or figures). On by default; switch off anytime in Settings. Basis: legitimate interest in improving the service, with your right to object honored by the toggle.
• Terms-acceptance record — your email, the Terms version, and the timestamp, kept after account deletion solely as evidence of the agreement. Basis: establishment and defense of legal claims.

3. Who touches the data (sub-processors)

• Railway (US) — cloud hosting for the service and Cloud Hosted brains.
• Resend (US) — delivers sign-in code emails and operational notices. Sees your email address only.
• Google — only if you choose "Continue with Google"; we receive your name and email.

Transfers outside the EU rely on EU-approved safeguards (the EU–US Data Privacy Framework and/or Standard Contractual Clauses, per each provider's terms). There is no advertising, no analytics, and no tracking anywhere on this site — the only cookie is the strictly-necessary session cookie that keeps you signed in.

4. How long we keep things

• Memories — until you delete them; deleted memories vanish immediately and are permanently erased within 90 days.
• Account data, ledger, signals, nightly reports — deleted when you delete your account.
• Sign-in codes + request IPs — 24 hours.
• Terms-acceptance record — retained after deletion, for legal claims only (see the Terms, Section 8.3).

5. Your rights

You can access and export everything (Settings → Data & ownership → Export, as machine-readable JSON), correct any memory, delete memories or your whole account instantly with a written deletion report, and object to improvement signals with the Settings toggle. Write to engram@rootcause.ro for anything else. You also have the right to complain to a supervisory authority — in Romania, ANSPDCP (dataprotection.ro) — or to the authority in your own EU country.

6. Other people in your memories

A working memory naturally mentions colleagues, clients, and other people who haven't seen this page. You are responsible for having a lawful basis to store personal data about others, and for honoring your organisation's rules when the data is your employer's. The setup flow asks you to mark what's private or off-limits before anything is read — use it. For Cloud Hosted brains we act as your processor: we store and process that content only on your instructions, and delete it when you do.

7. Security & breaches

Cloud Hosted memories are encrypted at rest with a key unique to your account; access is isolated per account; there are no passwords to leak. Full detail: security & your data. If a breach ever puts your data at risk, we will notify you and the competent authority without undue delay — within 72 hours where the law requires it.

8. Age; changes

The service is for people aged 16 or over. We'll update this policy as the product evolves; material changes are announced in the console before they apply. Questions: engram@rootcause.ro.