Last updated: August 2026
SenseLab Artificial Intelligence, Inc. (“SenseLab”, “we”) operates a memory service for AI agents: you store notes, decisions and context, and your agents read them back in later sessions. This policy describes what we hold, who else receives it, and what you can make us do about it.
It covers the dashboard at amfs.sense-lab.ai, the API at api.sense-lab.ai, the MCP connector at mcp.sense-lab.ai, and the SenseLab SDKs when configured against our hosted service. It does not cover the open-source AMFS software when you run it on your own infrastructure, where no data reaches us.
For the purposes of the UK and EU General Data Protection Regulation, SenseLab is the controller of the account data described below.
Account and identity
Your email address, first and last name, an optional company name, the plan your account is on, when you last signed in, and whether your address has been verified. If you sign in with a password we store a bcrypt hash of it and never the password itself. If you sign in with Google or GitHub we store the provider’s name and the opaque subject identifier it gives us, not your credentials there.
The memories you store
The substance of the service: the entity paths and keys you choose, the values you write, a confidence score, which agent wrote each one, and when. Entries are copy-on-write, so editing a memory adds a version rather than replacing one — earlier versions remain readable as history until the entry or the account is deleted.
We also derive two things from each value in order to find it again: a full-text search index, and a numeric embedding vector. Both are computed on our own servers. You decide what goes into a memory, and we do not inspect it. Please do not store payment card numbers, government identifiers, health records, or anything else you would not want held by a third-party service.
Keys and tokens
API keys are stored as one-way hashes, alongside the first few characters so you can recognise a key in a list. Access tokens, refresh tokens and authorization codes issued when you connect a client such as ChatGPT or Claude are likewise stored only as hashes, as are invitation and password-reset tokens. A copy of our database would not yield a credential anyone could replay.
Rooms and shared memory
If you use rooms, we hold the room’s membership, the email addresses you invite, and an activity log that records reads and writes — including which entry was read and which agent read it — so every member can see what the room has been used for. Documents added to a room are stored as files, along with the text extracted from them and embeddings of that text.
Decision traces
When an agent commits an outcome we store the trace: a summary of the decision, the memories it read, the tools it called, and token counts for any model calls involved. Traces are written to an append-only table, which is what lets them be used as evidence later, and which has consequences for deletion described in section 6.
Operational records
Security and audit events, which may include the IP address a sensitive action came from. Server logs, which record email addresses on sign-in paths and a truncated client identifier for connector calls. Our infrastructure provider also generates its own request logs for every service.
For readers in the UK or EEA, the lawful bases we rely on are these.
We do not sell personal information, we do not share it for advertising, and we do not use your memories to train machine-learning models — neither our own nor anyone else’s.
This section matters more than any other, so it is stated plainly. The purpose of a connector is to let an AI assistant read your memories. When you connect one and it calls a SenseLab tool, the text of the memories it asked for is sent to that assistant’s provider — OpenAI for ChatGPT, Anthropic for Claude — and becomes part of that conversation, held under that provider’s privacy policy and retention rules, not ours.
That is the connector working as intended rather than a leak, but it does mean a provider you connect ends up holding whatever you ask it to recall. Two consequences worth knowing:
We use Mixpanel to understand how the dashboard is used. You should know the extent of it, because it is more than page counts:
We rely on legitimate interests for this, and we do not currently ask for your consent before it starts. We would rather say so here than imply a choice we do not offer. If you would prefer not to be recorded, note that analytics and session recording run only in the browser dashboard: using SenseLab through the SDK, the API or an MCP connector involves no session recording at all. A tracker-blocking browser extension also prevents it. If you want us to exclude your account, write to hello@sense-lab.ai and we will act on it.
We use the following processors and service providers. All are in the United States.
Google Cloud Platform — United States — us-central1 (Iowa, United States)
Receives: Everything described in section 1: it hosts our services, database and file storage.
Why: Infrastructure. This is where your data lives.
OpenAI — United States
Receives: Excerpts of your memory text — up to roughly fifty entries per request — when a briefing or digest is generated, when results are re-ranked, and when a room negotiation is mediated.
Why: These features summarise and reason over your memories using a language model (gpt-4o-mini). Search and semantic retrieval do not use OpenAI: embeddings are computed on our own servers, so ordinary reading and searching sends nothing to them.
Amazon Web Services (Simple Email Service) — United States
Receives: Recipient email addresses and the contents of the message.
Why: Transactional email only: room and team invitations, welcome messages, password resets, and notices when an account approaches a plan limit.
Mixpanel — United States
Receives: Your email address and name, account and plan attributes, dashboard interaction events, session recordings, and connector call metadata. Not your memory contents.
Why: Product analytics and session replay, as described in section 4.
HubSpot — United States
Receives: Email address, first and last name, company name, plan tier, how you signed up, and when you signed up and last signed in, together with our internal account and user identifiers.
Why: Customer relationship management. Records are synchronised when they change, roughly every fifteen minutes.
Stripe — United States
Receives: Billing email address, our account and user identifiers, and your payment details, which you give to Stripe directly.
Why: Payment processing on paid plans. We never see or store card numbers.
Google and GitHub — United States
Receives: Only what is inherent in signing in with them, if you choose to.
Why: Optional single sign-on.
Separately from the list above, an AI provider receives your memory text when you connect its client to SenseLab. Section 3 explains that in full.
We may also disclose data where the law requires it, and to a buyer or successor if the business is sold, in which case this policy travels with it until replaced.
Production data is stored in us-central1 (Iowa, United States). Every provider named in section 5 is established in the United States, so if you are in the UK or the EEA your personal data is transferred outside it. We rely on the data processing terms offered by each provider, which incorporate the European Commission’s Standard Contractual Clauses or an approved transfer framework where the provider offers one. We do not currently offer a region option for data residency.
The honest version, because a policy that promises clean erasure and a system that cannot deliver it is worse than a clear explanation.
Data deletion sets out how to make the request and what to expect.
Subject to the limits described above, you can ask us to give you a copy of your data, correct it, delete it, restrict or stop a particular use of it, or provide it in a portable form. Where we rely on legitimate interests you may object, and where we rely on consent you may withdraw it.
Write to hello@sense-lab.ai from the address on the account. We will respond within one month. There is no charge, and we will not treat you differently for asking.
If you are in the UK or EEA and think we have handled your data badly, you may complain to your national supervisory authority — in the UK, the Information Commissioner’s Office. We would rather you told us first.
Traffic is encrypted in transit. Storage is encrypted at rest by our infrastructure provider. Passwords are hashed with bcrypt, API keys with Argon2, and tokens with SHA-256. Each account’s data is isolated at the database level by row-level security, so a query on one account’s behalf cannot return another’s rows.
For completeness: the contents of your memories are protected by that storage-level encryption and access control, and are not separately encrypted with a key only you hold. Staff access is limited to what is needed to run and support the service.
SenseLab is not intended for children, and we do not knowingly collect data from anyone under 16. If you believe a child has an account, write to hello@sense-lab.ai and we will remove it.
We will update the date at the top when this changes, and email account owners before a change that materially reduces the protection described here.
SenseLab Artificial Intelligence, Inc., a company incorporated in the State of Delaware, United States. Privacy and data protection: hello@sense-lab.ai.