Ashley Memo Privacy Policy

Version 2.2 · Effective 2026-10-23 · Applies to the Ashley Memo app for iPhone and Apple Watch (including the beta) and the ashleymemo.com website

This policy applies only to Ashley Memo, the product and services of Atlas x Mind Limited, a New Zealand company (NZBN 9429051326067) ("Ashley", "we", "us"). We are responsible for your personal information under this policy.

This policy explains:

• 1. How we collect and use your information
• 2. How we use cookies and similar technologies
• 3. How we share and disclose your information
• 4. How we protect your information
• 5. Your rights
• 6. Children
• 7. Where your information is stored, transfers, and how long we keep it
• 8. Changes to this policy
• 9. How to contact us

We know how much your personal information matters to you, and we work to keep it safe and to keep your trust. We handle personal information in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs), and the Biometric Processing Privacy Code 2025 for voiceprints. We collect only what Ashley needs, use it only for the purposes described here, and tell you plainly what we do. Please read this policy before you use Ashley.

1. How we collect and use your information

What we collect, and why

We collect only the information below, and only to provide Ashley to you. Some of it is optional; if you choose not to provide it, the related feature won't work, but the rest of Ashley will.

Reminders. If you ask Ashley to remind you of something, the app asks for access to Apple Reminders and adds the reminder there. Calendar entries are opened in Apple's own editor for you to save; Ashley does not read your calendar.

Report a problem. Report a problem makes a file on your iPhone. It contains technical records (such as listening segments, uploads, disk writes, the app version and device model) and never contains audio. Your latest transcript is included only if you tick the box. You send the file yourself through the iPhone share sheet, to whoever you choose. If you send it to us by email, it is kept as described for email in section 7.

Feedback & Suggestions and diagnostic logs. When you send feedback from Feedback & Suggestions, the app automatically attaches a diagnostic log: the app version, device model, system version and recent technical records (such as the times, counts and error codes of connections, uploads and disk writes). If you choose Apple Watch, the watch's own technical records are attached too. Diagnostic logs never contain conversations, transcripts or audio. You can also attach a screenshot yourself; whatever it shows is sent to us with your feedback. Feedback and attachments are stored on our servers encrypted with your account's key, and are used only to find and fix problems. If you send a voice note, our transcription provider turns it into text and the recording is then deleted. An AI model groups each day's feedback into a short summary that is emailed to our team.

Ask Ashley questions and answers. When you ask Ashley something, your question, your last few messages, and the cards and quotes that match it are sent to our AI providers (section 3) to write the answer, under the same rules as writing your cards. Once the answer is written, our server doesn't keep the text of your question or Ashley's answer. It keeps only usage figures without content, such as the language, the kind of question, how long the answer took and what it cost.

When Ashley asks you. If this is on, Ashley may ask you about one spot in a recent conversation that it didn't catch, at most once a day and never at night or while you're listening. To choose that spot, quotes from your last few conversations are sent to our AI providers under the same rules. Your answer is encrypted with your account's key and kept with that card. You can ask less often, or turn it off, in the app.

Your focus list. The profile, focus items and sorting rules you enter are stored encrypted with your account's key and used only to sort your cards. To sort a card, its title and summary, together with your profile, focus items and rules, are sent to our AI providers under the same rules. Transcripts aren't sent for this. You can change or delete them at any time, and deleting them also deletes how your cards were sorted.

Website. If you join the waitlist, we keep your email address and the link code that brought you, only to invite you and tell you when Ashley opens.

Voiceprints

A voiceprint is a set of numbers calculated from a stretch of someone's voice. It is biometric information, and we handle it under the Biometric Processing Privacy Code 2025.

• We ask first. Voice recognition is off until you turn it on. After you agree to listening, the app explains voiceprints on a separate page, and voice recognition starts only if you choose Turn on voice recognition. If you choose Not now, listening works as usual; Ashley just doesn't tell speakers apart or recognise them. You can turn it on or off later in the app's privacy settings.
• What is made. One voiceprint for each voice in a conversation, including the people around you, plus one for your own voice if you set it up.
• What it's used for. Only to tell who said what in your own conversations, and to recognise people you've named, inside your account. We never use voiceprints to identify anyone outside your account, and never compare them across accounts. We never use them to infer emotion, personality, race or ethnicity, health or any other characteristic.
• Where it's kept. On our server in the United States, encrypted with a key made for your account.
• How long. Until you delete the conversation it came from, delete the person, turn off voice recognition, or delete your account.
• How to delete it. Turning off voice recognition, or choosing Delete my voiceprint data, deletes all of your voiceprints from our server. Deleting a conversation, a time range or a person deletes the voiceprints that belong to it (section 5).

How we use it, and our legal basis

We use your information only to run Ashley for you: transcribing, writing cards, recognising voices if you've turned that on, keeping your history, keeping your account secure, billing, support, and fixing faults. We don't use it for advertising, profiling for others, or selling. When we improve how Ashley answers, we change our own instructions to the AI model; we don't train any model on your data. If we ever want to use your information for a purpose not described here, we will update this policy first and tell you (section 8).

If you're in the EU, UK or another place that asks for a legal basis:

• Providing Ashley to you is performance of our contract with you.
• Voiceprints are biometric data. We process them only with your explicit consent, which you give in the app before voice recognition starts and can withdraw at any time (see Voiceprints above).
• Sending your data to transcription and AI providers happens only after you agree in the app.
• Security logs, fraud prevention and keeping records of deletions are our legitimate interests and, where they apply, legal obligations.

2. How we use cookies and similar technologies

• Website. The website uses no cookies, no advertising trackers and no third-party analytics. If you arrive through a channel link (such as a link with ?src=), your browser's local storage remembers that link code for 30 days, so that if you join the waitlist we know which channel brought you. It stays in your browser and is sent to us only with your waitlist sign-up. You can clear it in your browser settings at any time.
• App. The app has no advertising or analytics SDKs and does not track you across other apps or websites.

3. How we share and disclose your information

Service providers

We use the service providers below. The data sharing page, ashleymemo.com/data-sharing, lists exactly what each one receives, and when.

Providers that act only for us. Google Cloud, Cloudflare, Soniox, OpenRouter, DeepInfra, Anthropic and Microsoft 365 hold or process your information only on our behalf, and not for their own purposes. Under section 11 of the Privacy Act 2020, that is not a disclosure to them: we remain responsible for your information as if we held it ourselves.

Providers that also use information for their own purposes. Apple and Stripe also process some information under their own privacy policies (for example, Stripe to prevent fraud). Where that means information leaves New Zealand, we rely on IPP 12: these providers are subject to privacy laws or binding safeguards that, overall, protect information in a way comparable to the Privacy Act.

Your own AI assistant

If you connect an AI assistant (for example Claude or ChatGPT) to Ashley using the "Connect your AI" feature, that assistant can read your cards, transcripts, place names and the names of people you've named, under that assistant's own terms. Access is read-only, each read is logged, and you can disconnect it in the app at any time. Disconnecting stops future reads only; what the assistant has already read is handled under its provider's terms. Connection keys expire after at most a year.

Requests from police, courts and others

We hand over data only in response to a valid court order or a statutory order that legally requires us to (such as a production order or search warrant under New Zealand law). We'll tell you before we hand anything over, unless the law forbids it. We don't hand over data because of a lawyer's letter or a request from someone else in a dispute.

4. How we protect your information

• Your audio, transcripts, cards, voiceprints, names, notes and locations are encrypted on our server with a key made for your account.
• Our server holds what it needs to unlock that key, because it has to transcribe and read your conversations to write your cards. This service does not use end-to-end encryption.
• Every decryption is logged: when, which account, which kind of item, and which part of the system did it. The log never contains your content.
• People at Ashley don't read your conversations. The only exception is when you ask us to look into a specific problem and give us permission; we look only at what's needed for that problem.
• Your data is kept separate from every other account, and we test that separation automatically.
• Off-site backups are encrypted with a separate key that is kept offline.

If there is a privacy breach. If we have a privacy breach that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and the people affected as soon as practicable, as Part 6 of the Privacy Act 2020 requires.

5. Your rights

Access, correction and other requests

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, and give you a copy (the app can also export your audio, transcripts, cards and people as files you can read);
• correct it;
• delete it;
• stop processing your voiceprints (withdraw consent).

Email our Privacy Officer at [email protected]. We'll reply within 20 working days. We may need to check it's really you. If you're not happy with our answer, see section 9 for where you can complain.

Deleting your data

• A conversation: delete it in the app. Its audio, transcript, card, voiceprints and location are removed from our server.
• A time range: in the app, go to Privacy & Security → Delete Data and choose the period. The audio, transcripts and locations from that period are removed from our server, any card that overlaps it is removed whole, and voiceprints that came only from that period are removed too. People, names and voiceprints from other times are kept.
• Your voiceprints: turn off voice recognition, or choose Delete my voiceprint data, in the app's privacy settings. All of your voiceprints are removed from our server.
• Your account: use Delete account in the app's account settings. You confirm with Sign in with Apple. Your account is locked and everything is erased straight away: audio, transcripts, cards, voiceprints, people, locations, your profile and focus list, feedback, connected AI keys, devices and your account key. We also revoke Ashley's access to your Apple account and remove you from the backups on our server. Copies in our encrypted off-site backups are cleared as those backups roll over within 14 days, and our deletion record stops them from ever being restored. Deleting your account doesn't cancel a subscription, so cancel it first.
• What remains afterwards is listed in section 7 (decryption log, deletion record, and the subscription records the law requires us to keep).
• Content that has already been processed by a provider is deleted under that provider's terms, as described in section 3.

The people around you

While Ashley is listening, it hears everyone near you. Those people are usually not Ashley users, and this policy can't agree to anything on their behalf.

• You're responsible for telling people and following the rules where you are. Some places require everyone's consent before a conversation is captured, and workplaces may have their own rules.
• If someone asks you to delete a conversation they were in, please do.
• Anyone whose voice Ashley heard can contact our Privacy Officer directly at [email protected], and can complain to the Privacy Commissioner. We'll answer their request under the Privacy Act, and we may also pass it to you.
• Voiceprints of people you haven't named are used only inside your account to group who said what. We never use them to identify anyone outside your account.

6. Children

Ashley is not meant for anyone under 16, and we don't knowingly collect information from children. If you believe a child has an account, tell us and we'll delete it.

7. Where your information is stored, transfers, and how long we keep it

Where it is stored

Our server is in the United States (Google Cloud, Oregon). The encrypted audio archive and encrypted backups are stored by Cloudflare, in a region Cloudflare chooses automatically. This means your information leaves New Zealand, Australia, Canada, the EU and the UK. Before Ashley is offered in the EU and UK, we will have Standard Contractual Clauses or an equivalent safeguard in place with each provider.

How long we keep it

8. Changes to this policy

When Ashley starts doing something new with your data, such as a new provider, a new storage region or a new retention period, we update this page before it happens and tell you in the app or by email. If our practice ever differs from what this policy says, we will pause the feature concerned until the two match, and tell you.

9. How to contact us

• Company: Atlas x Mind Limited, 1 Sunnyview Ave, Shelly Park, Auckland 2014, New Zealand
• Privacy Officer: Gavin Zhong
• Email: [email protected]

We'll reply within 20 working days. If you're not happy with our answer, you can complain to:

• New Zealand: the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909)
• Australia: the OAIC (oaic.gov.au)
• EU / UK: your local data protection authority, or the ICO in the UK. You also have the rights to restrict or object to processing and to data portability. We will appoint an EU representative before Ashley is offered in the EU.
• Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca)
• United States: we don't sell or share your personal information for cross-context advertising, and we don't use sensitive information to infer things about you. Residents of California and other states with privacy laws can use the rights above.