Privacy Policy

Last updated: October 8, 2026

1. The short version

AugmentationAI gives you an API key to reach AI models run by third-party providers, a persistent memory store for your account, and tools that manage the context sent to those models.

• We keep what you save to your memory store, the account and billing data needed to run your account, a usage record for each API request (without the prompt or response), and web server logs needed to keep the service secure.
• When you make an inference request, your prompt, and any memory or other context included in it, is sent to the third-party Model Provider that serves the model, currently through the OpenRouter routing service. That provider handles it under its own terms. We do not store prompt or response bodies in our account or billing records.
• We do not sell your personal information. We do not use your store, your prompts or your outputs to train any model.
• You can download an export of your store at any time, and you can delete your account. Section 13 explains exactly what the export contains and when deleted data is gone.

The rest of this policy gives the details.

2. Who we are and how to reach us

AugmentationAI (augmentationai.com) is operated by 2821478 Alberta Ltd., a corporation incorporated in Alberta, Canada ("we", "us"). We are responsible for the personal information described in this policy, except where section 6 says we process it on your behalf.

Our privacy officer, Adam Lewis, is accountable for our compliance with this policy. For any privacy question, request or complaint, write to support@augmentationai.com and mark it for the attention of the Privacy Officer. General questions: support@augmentationai.com.

3. What this policy covers

This policy covers personal information we collect when you visit https://augmentationai.com, use the customer Hub at /hub, call our API at https://augmentationai.com/v1, connect an agent to our MCP memory endpoint at https://augmentationai.com/mcp, or contact us (together, the "Service"). Words defined in our Terms of Service, such as Inputs, Outputs, Model Provider and your store, have the same meaning here.

It does not cover the practices of Model Providers or other third parties, which have their own policies (sections 5 and 9).

4. What we collect

Information you give us

• Account data: your email address and, if you set one, a password. Passwords are stored only as a salted hash (argon2id); we never store them in plain text. If you sign in with Google or GitHub, we ask that service for your email address and basic profile (Google: the "openid email profile" scopes; GitHub: "read:user user:email") and use your verified email address to find or create your account.
• Billing data: payments are processed by Stripe. We keep the reference Stripe gives us for each payment, your package status, your wallet balance and your transaction history. Card numbers go to Stripe and do not pass through our servers.
• Your memory store: the notes, documents and references you, or your agents through your credentials, save. This is your data (section 6).
• Inference requests: the prompts, files and other Inputs you send through the API, and the Outputs returned. We pass these through to serve the request (section 5).
• Support and correspondence: what you send us when you email support or report a problem, and your email address if you ask to receive product updates.

Information collected automatically

• Usage records: for each API request, the time, the API key used, the model requested and served, the route and provider, token counts, the charge, latency, whether memory was used, the status, and a short error message if the request failed. We need these to bill you, show you your usage, and detect abuse. They do not include the prompt or response body. We also count memory reads and writes per store to operate the Service.
• Web server logs: for requests to our website and Service, the time, IP address, request path, status code and user agent, kept for security and abuse prevention. These logs are rotated automatically by size and are not kept indefinitely.
• Credentials: records of the API keys and memory tokens issued to your account, stored only as salted hashes, with a short display prefix and when each was created, last used or revoked.
• Security and audit records: a record of security-relevant account actions, such as sign-up, password change and account deletion.
• Session cookie: one first-party cookie that keeps you signed in (section 12).

What we do not collect. Our website does not load third-party analytics, advertising networks, tracking pixels or session-replay scripts, and we do not buy data about you from data brokers.

5. How inference requests are handled

5.1 Your request goes to a Model Provider. When you send an inference request, we pass your Inputs to the route that serves the model and return the Output to you. Today our routes go through OpenRouter, a routing service, which passes the request to the Model Provider that runs the model. This includes the models we offer under the GLM-X names, which are currently served by third-party providers through OpenRouter. The routes and providers can change; ask support@augmentationai.com which provider serves a model.

5.2 Context you include goes too. Whatever is in a request is sent to the model you call. If you, your tools or the harness include memory recalled from your store, or other context, in a request, that context is part of the Inputs and is sent to the Model Provider with it. Retrieval from your store itself runs on our own servers and does not send your store to any model.

5.3 Model Providers have their own practices. OpenRouter and each Model Provider handle Inputs and Outputs under their own terms. Some keep them for a period, for example for abuse monitoring, and some, including some free model endpoints, may log prompts or use them to improve their models. Model Provider practices differ. Using a third-party provider does not remove our own legal responsibilities for the personal information we handle or disclose. Before sending sensitive data, check the data practices of the model you are using.

5.4 What we keep. We do not store the bodies of inference requests and responses in our account or billing records. We keep the usage records described in section 4. If a request fails, the short error message we keep can include up to a few hundred characters of the error text returned by the provider.

5.5 Images, audio and other people's data. If you send material showing or recording another person, you are responsible for having their consent where the law requires it, particularly for faces or voices that could count as biometric data. We pass such files to the Model Provider and do not process them further.

6. Your store

As between you and us, you retain the rights you hold in the content you submit to your memory store. This does not transfer ownership of third-party content to you. For the personal information it contains, we act as your service provider (a "processor" where the GDPR applies): we store and process it only to provide the Service to you, on your instructions.

• Separate store: your store is kept in its own database files and served by its own engine process, and your memory token reaches only your store.
• Not end-to-end encrypted: the Service processes your store content on our servers in order to index and retrieve it.
• No reading: we do not read your store except when you explicitly ask us to (for example, a support request), when we must investigate a credible abuse report, or when the law requires it.
• No training: we do not use your store to train any model, ours or anyone else's.

7. How we use personal information

We use personal information only for the purposes below, or for a purpose we tell you about before we collect it. Where the GDPR or UK GDPR applies, the legal basis for each is shown in brackets. Where Canadian privacy law requires consent, we seek meaningful consent appropriate to the information, purpose and circumstances. Merely using the Service does not constitute consent to unrelated or optional processing. We also rely on exceptions where applicable law permits them.

• To provide the Service: run your account, route your requests to Model Providers, host your store, and run the harness (contract).
• To bill you and keep accurate financial records (contract; legal obligation).
• To send service messages such as receipts, security alerts and changes to our terms (contract; legitimate interests).
• To answer your questions and support requests (contract; legitimate interests).
• To keep the Service secure, prevent fraud and abuse, and enforce our Terms (legitimate interests; legal obligation).
• To maintain and improve the Service using aggregated usage records that do not include your Inputs, Outputs or store contents (legitimate interests).
• To comply with the law and respond to lawful requests (legal obligation).
• To send you product updates, only if you asked for them. You can stop them at any time by writing to us (consent).

8. What we do not do

• We do not sell or rent your personal information, and we do not share it with advertisers or data brokers.
• We do not use your store, your Inputs or your Outputs to train any model.
• We do not show you targeted advertising or track you across other websites.

9. Who we share it with

We share personal information only with the following recipients, for the purposes stated:

• OpenRouter and Model Providers: the Inputs of each inference request, including any memory or context included in it, sent to serve that request (section 5). The request also carries our internal request reference.
• Stripe: payment processing. Stripe receives your payment details directly and processes them under its own privacy policy; we receive a payment reference and status.
• Google and GitHub: only if you choose to sign in with them, to confirm your identity and email address.
• Hosting and infrastructure provider: the provider of the servers and storage that run the Service and hold stores, account data and backups.
• Email provider: the provider of our email service, which handles messages you send to our support and contact addresses and email we send to you.
• Authorities and others where the law requires: we will disclose information if required by law, court order or other legal process, or where we believe in good faith it is necessary to protect someone's safety, investigate fraud or abuse, or enforce our Terms. Where allowed, we will tell you first.
• A successor business: if our business is merged, acquired or sells its assets, personal information may transfer to the new owner, which must keep honouring this policy. We will tell you before that happens.
• Anyone else, with your consent.

For an up-to-date list of the specific hosting and email providers we use, write to support@augmentationai.com.

10. How long we keep it

• Your store: until you delete your account. After deletion it is kept in a recoverable state for at least 30 days and then deleted (section 13).
• Inference request and response bodies: not stored in our account or billing records (section 5.4).
• Usage records, billing and transaction records: for as long as your account is open, and afterwards for as long as tax, accounting and other laws require.
• Web server logs: rotated automatically and not kept indefinitely.
• Security and audit records: as long as needed to protect the Service and meet legal obligations.
• Account data: until you delete your account, then on the schedule in section 13, except what we must keep by law.
• Support correspondence: as long as needed to resolve your request and keep a reasonable record of it.

When we no longer need personal information, we delete it or make it anonymous.

11. How we protect it

Traffic to and from the Service is encrypted in transit with TLS. Passwords, API keys and memory tokens are stored only as salted hashes. Each store is kept separately and served by its own engine process. Access to systems holding personal information is limited to people who need it. Copies of data may also exist in backups.

The Service is not end-to-end encrypted: it processes your store content on our servers to index and retrieve it. No system is perfectly secure, and we cannot guarantee absolute security. Your security also depends on you: keep your password, API keys and memory token secret and never share them.

If a breach of security safeguards affecting your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as the law requires, without undue delay, and any other regulator where the law requires.

12. Cookies

We use one first-party session cookie to keep you signed in to the Hub. It is strictly necessary, lasts up to 24 hours, and is removed when it expires or you sign out. We use no third-party tracking cookies. You can block or delete cookies in your browser, but you will then not be able to sign in.

13. Export and deletion

Export. From the Hub you can download an export of your store as NDJSON at any time, with no fee. Today it contains a first line labelling the export, then, for each memory, its id, namespace, title and a content field that is the retrieval snippet, which can be shorter than what you saved. It does not include links between memories or version history. We are working on a full-text export.

The steps below are separate actions with separate results:

• Cancelling a package stops the next renewal; paid access continues to the end of the period you have paid for. It does not delete any data.
• Deleting a single memory: there is no self-serve option yet. Write to support@augmentationai.com and we will remove it.
• Deleting your account and store (in Settings, or by writing to us): your store stops being served immediately and your access ends. The store is kept in a recoverable state for at least 30 days, so that a mistaken deletion can be undone at your request, and is then deleted together with your account data.
• Backups: copies in backups are removed as backups rotate.
• Records kept for legal reasons: billing and transaction records, usage records needed for them, and security and audit records are kept as long as the law requires, even after deletion.

Email support@augmentationai.com and we will confirm when deletion is complete.

Deleting data with us does not delete copies a Model Provider may have kept of Inputs you sent it. To ask about those, contact the Model Provider.

14. Where your data is stored and transferred

We are based in Canada. Your store, account data and backups are held on servers run by our hosting provider, which may be outside your province or country; ask support@augmentationai.com for the current location. When you make an inference request, your Inputs are sent to OpenRouter and to the Model Provider that serves the request, which may be in the United States or another country. Information stored or processed outside your country may be accessible to the courts, law enforcement and national security authorities of that country.

For transfers subject to EEA or UK data-protection law, an applicable lawful transfer mechanism must be in place before the transfer. Canadian adequacy decisions have conditions and do not automatically cover every company or onward transfer. Contact us for information about the safeguards that apply to a particular transfer.

15. Your rights

You can export your store and delete your account yourself from the Hub. For anything else, write to support@augmentationai.com. We will respond within 30 days and may need to confirm your identity first. An authorized agent may make a request for you with proof of authority. We may decline a request where the law allows it, and will tell you why.

Everyone. You can ask to access the personal information we hold about you, correct it, get a copy of it, have it deleted, or withdraw your consent to a use of it (subject to legal and contractual limits; withdrawing consent may mean we cannot keep providing the Service).

Canada. Depending on the circumstances, the Personal Information Protection and Electronic Documents Act (PIPEDA) or Alberta's Personal Information Protection Act applies. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

EEA and UK. Where the GDPR or UK GDPR applies, you also have the right to restrict or object to processing, including processing based on legitimate interests, to data portability, and to complain to your local data protection authority or, in the UK, the Information Commissioner's Office.

United States. Depending on your state, you may have the right to know what personal information we collect, use and disclose, to access, correct and delete it, and to opt out of its "sale", "sharing" for targeted advertising, or profiling. We do not sell or share personal information for targeted advertising and do not profile you. We will not discriminate against you for exercising your rights.

For personal information in your store about other people, we act on your instructions. If someone asks us to act on their data in your store, we will refer them to you where the law allows.

16. Children

You must be at least 13 years old, or the age of digital consent where you live if that is higher, to use the Service. The Service is not directed at children, and we do not knowingly collect personal information from children below that age. If we learn we have, we will delete it promptly. If you believe a child has given us personal information, contact support@augmentationai.com.

17. Links to other sites

Our website and documentation link to other sites, including Model Providers, OpenRouter, Stripe, GitHub and Google. We are not responsible for their privacy practices; check their policies.

18. Changes to this policy

If we change this policy materially, we will email account holders at least 14 days before the change takes effect and update the date above. Other changes take effect when posted. Keep your email address current so these notices reach you.

19. Contact and complaints

2821478 Alberta Ltd., Calgary, Alberta, Canada. Legal notices: support@augmentationai.com

Privacy questions, requests and complaints: support@augmentationai.com, attention Adam Lewis, Privacy Officer. We will try to resolve any concern directly. You also have the right to complain to the privacy regulators listed in section 15.