Privacy policy

Saudad (https://saudad.ai) is run by ANDGINJA DIGITAL SERVICES, LDA, Av. Avelino Teixeira da Mota, Lote 308, 5º Esq., 1950-034 Lisboa, Portugal, VAT/NIPC PT517700263 (“we”, “us”).

We decide how your account, sign-in and billing information is used, so for those we are the data controller under the EU General Data Protection Regulation (GDPR) and Portuguese law (Lei n.º 58/2019).

Contact for anything in this policy: andre@andginja.com.

We have not appointed a data protection officer.

• Saudad keeps what your agents choose to save, so they remember it next time. You can see, edit, undo, export and delete all of it.
• We use your memories only to run Saudad for you. We don’t sell them, show ads, or use them to train AI.
• No AI reads your memory on Saudad’s side. To make search work by meaning, the text of your memories, notes and searches is sent to OpenAI’s embeddings service, which turns it into numbers.
• Sign-in is a code sent to your email. We use only the cookie needed to keep you signed in. No ad trackers. On our public pages we count visits with our own tool, without cookies and without recording who you are; never in your dashboard.
• Delete your account and your memories go at once; encrypted backup copies age out within 30 days.

Each item says why we need it and the GDPR legal basis we rely on.

Your account

• Your email address, to create your account, send your sign-in codes and write to you about your account. Basis: performing our contract with you (Art. 6(1)(b)).
• Sign-in codes. A 6-digit code, stored encrypted, that works for 10 minutes. Basis: contract.
• Your sessions. When you sign in we keep a session record with the time, the IP address and the browser description (user agent) your browser sent, and set a cookie so you stay signed in. Basis: contract (keeping you signed in) and our legitimate interest in keeping accounts secure (Art. 6(1)(f)).
• Your plan. Whether you are on a trial, a paid plan or a complimentary plan, and the dates that matter. Basis: contract.
• An invite, if someone invited you: your address, who invited you, a short note only our admins see, and the dates. Basis: our legitimate interest in running an invite-only beta (Art. 6(1)(f)).

The apps you connect

When you connect an agent (for example Claude, ChatGPT, Claude Code, Codex, Cursor or OpenClaw), we keep a record of the connection: the app’s name as the app gives it, where the app asked us to send you back after you approved it, what you allowed (read and save, or read only), and when it was created and last used. For API keys we keep only a fingerprint of the key and its first characters, never the key itself. Basis: contract.

If an app asks for it on the approval screen, it also receives your name, email address or profile picture from us; the approval screen says so before you agree. Saudad asks for no name or picture when you sign up, so in practice an app can receive only your email address.

How Saudad is used

• Usage counts: how many reads and saves your memory had each day, and how many bytes were saved, to apply the daily limits. Basis: contract.
• Product events: a few milestones, such as when a trial started, when an app was first connected (with the app’s name), when the first memory was saved, and when a plan was chosen, cancelled or refunded. They hold no memory content, email address or free text. We use them to understand whether Saudad works for people. Basis: our legitimate interest in improving the product (Art. 6(1)(f)).
• Audit records of actions on your account (for example “a space was renamed” or “the account was deleted”), with ids only, never content or your address. Basis: our legitimate interest in security and in proving what happened (Art. 6(1)(f)).

Your memories themselves have a section of their own: Your memories, below.

Visits to our public pages

We count visits to our public pages (the home page, pricing, the guides for connecting your apps, the comparisons and these legal pages) to understand how people find Saudad and whether the site works for them. We do it with PipeTrace, an analytics tool we make and run ourselves: it runs on the same Hetzner server in Nuremberg, Germany, and no other company receives what it records. Your browser loads it from pipetrace-api.andginja.com.

• It sets no cookies, stores nothing in your browser and records no identifier for you, so your visits can’t be linked to each other, to you or to your account.
• For each page view it records the page’s address (the page itself and its campaign tags, nothing else from the link), the website you came from (its domain only), the campaign tags (UTM), your country, the type of device (computer, phone or tablet), your browser’s name (not its version) and language, and the time to the minute.
• When someone asks for an invite on these pages, it also records that an invite was requested: the name of the action, never the email address.
• Your IP address is used to look up your country and, briefly and only in memory, to protect the service from abuse. It is not stored.
• It never runs in your dashboard, on sign-in, on the screen where you approve an app, or on a link that carries a code, such as the confirmation links we email.
• If your browser sends the Global Privacy Control (GPC) signal, our pages don’t load it at all.

Basis: our legitimate interest in understanding and improving our website (Art. 6(1)(f)). You can object at any time by writing to us, or by turning on Global Privacy Control in your browser. The counts are deleted automatically after 25 months.

Security and abuse prevention

To stop abuse we limit how often anyone can ask for a sign-in code, try a code, or register an app. These limits work from your IP address and, for sign-in, your email address. The counters are held only in our server’s memory for a few minutes and are never written to a database or a log. Basis: our legitimate interest in keeping Saudad safe (Art. 6(1)(f)).

Our application’s logs record what went wrong (error names and internal ids). They are written so they never contain your email address, an IP address, a sign-in code, a key or anything from your memory.

Emails we send you

• Sign-in codes, and your invite if someone invited you. Basis: contract (sign-in) and legitimate interest (invites).
• Once paid plans open: reminders before a trial ends, a notice if your plan ends, and two warnings before an ended plan’s memory is deleted. Basis: contract.
• Near the end of a trial, one email asking what a fair price would be. A person reads the replies. Basis: our legitimate interest in setting a fair price; you can ignore it or ask us not to send it.

Our emails are plain: no images, no open or click tracking.

“Tell me when it’s ready” and invite requests

If you ask to hear when something is ready (Saudad Team, Saudad Business, Saudad for ChatGPT) or ask for an invite, we keep your email address, the topic, a fingerprint of the confirmation link, and three times (when you asked, when we emailed you, when you confirmed). Nothing else. Basis: your consent (Art. 6(1)(a)), given by confirming from your inbox. Resend sends these emails.

• If you don’t confirm, the request is deleted after a week.
• Every email has a Remove link that deletes your address from every topic at once.
• Once we send the one announcement email for a topic, we delete that topic’s list.
• An invite request is removed once we invite you, with your account if you have one, and in any case 12 months after you confirmed it.

Payments (when paid plans open)

Paid plans are not open yet. When they are, payments are handled by Stripe. At checkout Stripe collects your name, email, billing address, card details and, if you give one, your VAT number. We never see or store your card details. We keep the Stripe customer and subscription ids, your plan, its billing interval and its dates. Basis: contract, and our legal obligations to issue invoices and keep accounting records (Art. 6(1)(c)).

We issue invoices for Portuguese tax purposes ourselves, in InvoiceXpress, and share billing records with our accountant and, as the law requires, with the Portuguese tax authority.

Messages you send us

If you write to us, we keep your message and our reply to help you and to keep a record. Basis: legitimate interest, or contract when it is about your account.

Your memories are what your agents decide to save while you use them (preferences, people, projects, decisions), and the notes they write. Each memory is labelled with its space and the app that saved it. Saudad never sees your conversations: only what an agent sends us to save, and the searches it makes.

Treat it as personal, and possibly sensitive. What you and your agents save can include anything: health, family, money, your clients, other people. We treat all of it as sensitive. It is kept in a separate database for each person, and no one else’s agents can ever reach it.

What we do with it. Only what running Saudad needs: store it, back it up, make it searchable, give it to the agents you connected, and show it to you. We do not sell it, use it for advertising, use it to train AI models, or read it to learn about you. The people who run Saudad can technically reach the databases on our server, but they don’t look at your memories, except to help you when you ask us to, to keep the service secure, or when the law requires it. Our admin tools show account details only; they have no screen for memory content.

Search by meaning. To find memories by meaning, not just exact words, the text of each memory and note, and each search, is sent to OpenAI’s embeddings service, which returns a list of numbers we store with it. No chat model processes your memory on Saudad’s side. OpenAI states it does not train on data sent through its API; it may keep requests for a limited time under its own API data policy, for example to detect abuse.

You control it.

• See and search everything in your dashboard.
• Edit a memory or a note in place.
• Forget anything. Your agents stop seeing it at once. You can undo it from your dashboard for 7 days; after that it is deleted for good, and it leaves our encrypted backups within 37 days of when you forgot it (in rare cases a few days longer, if the nightly clean-up has to wait). If the same words are still in a note you keep, they stay in that note until you change or delete it.
• Export everything as a zip file (a JSON file plus your notes as text files) at any time. The download link works for 48 hours.
• Delete your account at any time (see How long we keep it).

Legal basis. We process your memories to provide the service you asked for: contract (Art. 6(1)(b)).

Other people in your memories. If your memories include other people’s personal data, for example your clients, you are responsible for having the right to keep it. If you use Saudad for your work and store personal data on behalf of your business or your clients, our data processing agreement applies to that data, as part of our terms.

We use a small number of companies to run Saudad. Each processes data only on our instructions, under its data protection terms. The full list, with what each does and where, is our sub-processor list.

• Hetzner: the server Saudad runs on, in Hetzner Online GmbH’s data centre in Nuremberg, Germany, including the databases that hold your account and your memories. The server is shared with other services we run; each runs separately in its own containers.
• Cloudflare: runs saudad.ai’s domain and network protection. Every request to saudad.ai, from your browser or your agents, passes through Cloudflare, which sees your IP address and the request, including memory text in transit. Cloudflare R2 also stores our nightly backups and your exports, both encrypted with keys Cloudflare does not hold.
• OpenAI: turns memory text, notes and searches into numbers for search by meaning.
• Resend: sends our emails.
• Google (Google Workspace): hosts our email inbox, so it holds the messages you send us.
• Stripe: takes payments, once paid plans open.
• InvoiceXpress: the invoicing software we use for Portuguese invoices, once paid plans open.

PipeTrace, which counts visits to our public pages, is not on this list: it is our own software, run by us on that same Hetzner server, and no other company receives what it records.

The agents you connect are not our sub-processors. You choose which apps connect, and what each may do. When your agent reads or saves a memory, the app’s provider (for example Anthropic or OpenAI) handles it under your own agreement with them, and their privacy policy applies. Saudad doesn’t send your memories to any agent provider by itself; your agent fetches them through the connection you approved. Disconnect an app at any time in your dashboard.

International transfers. Some of these companies are in the United States or process data there (Cloudflare, OpenAI, Resend, Google, Stripe). Where data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework where the company is certified, or on the European Commission’s standard contractual clauses.

We may also disclose data when the law requires it, for example to a court or a public authority with a valid order.

Deleting your account. Deleting your account is immediate and cannot be undone. Right away we delete your memories and notes in every space, your spaces, your exports, your API keys and app connections (every agent is disconnected), and your sign-in details, and you are signed out everywhere. If you pay for Saudad, your subscription is cancelled at once. Copies in our encrypted backups age out within 30 days. After that we keep only records of internal ids and dates, never your memories or your email address, for up to 24 months, and the billing records the law requires, which Stripe and our accountant hold.

• Every connection to saudad.ai is encrypted (HTTPS).
• Each person’s memory is kept in its own database, and automated tests check the wall between people.
• Nightly backups are encrypted, each person’s memory with its own key. When a memory is deleted (with its account, or after an ended plan), that key is destroyed, so its old backups can no longer be read. Exports are encrypted while stored.
• Sign-in codes are stored encrypted. API keys are stored only as a fingerprint. Connection secrets are stored encrypted.
• Sign-in has no passwords to steal: a new code is emailed each time, and repeated wrong codes lock the address out for a while.
• Our application’s logs are written not to contain memory content, email addresses or IP addresses.
• Our databases publish no port to the internet; they sit on a private network on our server.

No system is perfectly secure. If a breach puts your data at risk, we will tell the CNPD within 72 hours where the law requires it, and tell you without undue delay when it is likely to put you at high risk.

Under the GDPR you can ask us to:

• give you a copy of your data (much of it is in your dashboard and your export);
• correct it (you can edit memories and notes yourself);
• delete it (you can delete your account yourself);
• restrict how we use it, or object to uses based on our legitimate interests;
• give you your data in a portable form (the export is a zip of JSON and text files);
• withdraw consent at any time (the Remove link in any “Tell me when it’s ready” email), without affecting what we did before.

Write to andre@andginja.com. We answer within one month. We may need to check it’s really you, usually by asking you to write from the email address on your account.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the authority where you live or work.

Saudad uses only what it needs to work:

• A sign-in cookie that keeps you signed in. It is set when you sign in and lasts 7 days, renewed while you use Saudad.
• Your browser’s session storage, briefly: the email you typed on the home page, carried to the sign-in page and then removed; and, while you delete your account, a marker that reopens the dialog after you sign in again (it expires after 15 minutes).
• Cloudflare may set a security cookie to tell people from bots.

We use no analytics, advertising or social media cookies. Our pages load nothing from other companies (our fonts are our own). The one script our public pages load from elsewhere is our own visit counter, PipeTrace, from pipetrace-api.andginja.com, and it uses no cookies and no browser storage (see Visits to our public pages). Because everything above is strictly necessary for the service you asked for, and the visit counter stores nothing on your device, we don’t ask for cookie consent.

Saudad is not meant for children. You must be at least 18 to create an account. If you think a child has given us their data, write to us and we will delete it.

If we change this policy in a way that matters, we will email you before the change takes effect and show the date at the top of this page. Earlier versions are available on request.

ANDGINJA DIGITAL SERVICES, LDA, Av. Avelino Teixeira da Mota, Lote 308, 5º Esq., 1950-034 Lisboa, Portugal. Email: andre@andginja.com.