Security and privacy

The data you entrust to us is the most intimate that exists. Here's how we protect it — no fluff, no empty promises.

An honest premise. No system is 100% invulnerable. What we can do is reduce the attack surface, segment data, encrypt wherever possible, and make every access traceable. What we can't do is promise the impossible. What we won't do is hide how we work behind slogans.

🔐

At-rest encryption that's actually applied

Sensitive data in the database — memories, conversations, profiles, contacts, capsule texts and protected billing data — is encrypted field by field with AES-256-GCM: a database dump would not make these contents readable without the corresponding cryptographic key. Files attached to capsules are stored on a dedicated volume encrypted at block level with LUKS2 and not publicly exposed to the network. Backups are in turn encrypted with AES-256.

Only the structural data needed for the AI to work (category tags, sensitivity flags, semantic vectors for search) stays in the clear. Everything you read, write and remember is encrypted.

👁️‍🗨️

Pseudonymisation before sending to AI providers

When the AI processes a conversation, the names and emails of the people in your Bonds are masked before leaving the server. You always see the originals; the providers receive opaque identifiers in their place. The limits of pseudonymisation are set out in the privacy policy.

The pseudo-identifier ↔ real-name map is rebuilt on-the-fly from the structured data in your account, never persisted elsewhere. Your AlterEgo still answers specific personal questions because we de-pseudonymise the reply before showing it to you.

🗝️

Encrypted backups with a separate key

Database backups are encrypted with a dedicated key, distinct from the live database key. Even if a backup is exposed, without both keys it's unreadable.

Backups are normally retained for 12 months. When you delete your data, it is also removed from the backups as they rotate: normally within 12 months and, for technical reasons related to the rotation of the copy kept by the controller, within 13 months at the latest, no copy of the deleted content remains in the backups.

⚖️

GDPR compliant

Full export of your data (art. 20), real deletion (art. 17), granular consents (art. 7), transparent disclosure (art. 13-14), right to object (art. 21).

Service designed in Italy, data hosted in Europe. Non-EU transfers only to AI providers with a documented impact assessment.

🤖

AI Act: no deception

Every reply from your AlterEgo is flagged as AI-generated. The system doesn't pretend to be you: it's a declared representation, not a replacement.

Capsule recipients who talk with your AlterEgo always know they're conversing with an AI. Never hidden impersonation.

🕊️

Digital legacy: your choices, applied

Post-mortem directives signed while you're alive: continue, freeze, delete. Never applied automatically for final actions — always with verification and audit.

The digital fiduciaries you designate can activate your digital will only after a formal declaration made under their own responsibility, taken in charge by our administration and reviewed according to the relevant national rules. Final deletions require admin approval with full audit trail.

🔄

Traceability of critical actions

Every sensitive action — both by staff (deletions, post-mortem approvals, backup downloads, user management) and security events on your account (password changes, account deletion, consent changes, admin sign-ins) — is recorded in an append-only audit log.

Audit entries are retained for at most 12 months. The exceptions, kept without time limit as proof that the deletion took place, are the record of an account deletion (self-deletion or approved post-mortem deletion) and the record of the deletion of a capsule’s contents at the end of its cycle. A weekly sentinel detects anomalies automatically and notifies admins by visible email. No critical action can be performed without leaving a trace.

🔑

Regular key rotation

Encryption keys are rotated periodically. In case of suspected compromise, documented procedures and scripts allow immediate rotation.

In case of an incident that may expose personal data, we notify the supervisory authority within 72 hours (GDPR art. 33) and affected users if the risk is high (art. 34).

Things we don't do

  • ✓We don't sell your data. To anyone.
  • ✓We don't use it for targeted advertising.
  • ✓We don't train generic AI models on your content.
  • ✓We don't share it with third parties except for essential technical services (with signed DPAs).
  • ✓We don't keep it longer than necessary, and never without a legal basis.

Want to know more?

The full documents are published on the site: Privacy notice (/privacy), Terms & conditions (/terms) and Cookie policy (/cookies), plus the DreamersWare Payments purchase corpus linked in the footer. If you have specific questions before you start, write to us.

support@save-me.ai

Convinced?

Build your AlterEgo with the peace of mind it deserves.

Get started