Who is responsible for your data
We are the controller for account data, and your processor for brand data.
mentionedin.ai (KvK 70562431, VAT NL002399377B14, The Hague, the Netherlands) is the controller for your account, billing and marketing data. For the brand, competitor and prompt data you put into your account, and the results, you are the controller and we process it on your behalf under the Data Processing Agreement at /dpa/. Contact: hi@mentionedin.ai.
The data we process
Only what is needed to run your account and your tests.
- Account data: your email address, your name and a hash of your password, or your Google account email if you sign in with Google. We never store the password itself.
- Billing data: handled by Stripe. We receive your billing contact and invoice details and never store card numbers.
- Brand data: your domain, brand profile, truth file, competitors and prompts.
- Results: the answers AI engines return, their cited sources, page grades and your intervention log. Answers can contain names of people that the engines mention.
- Free snapshot requests: the domain and email address you enter.
- Support messages you send to us.
- Usage logs: technical records used for security and troubleshooting.
Why we process it, and on which legal basis
Mostly to perform our contract with you, and marketing email only with your consent.
| Purpose | Legal basis |
|---|---|
| Creating and running your account, and providing the service | Performance of the contract |
| Billing, invoicing and tax records | Performance of the contract and legal obligation |
| Sending the free snapshot you asked for | Performance of the request you made |
| Security, abuse prevention and troubleshooting | Legitimate interest in a safe, working service |
| Service emails about your account, billing and changes | Performance of the contract |
| Product news and marketing email | Consent, which you can withdraw at any time |
How long we keep it
For the life of your account, then deleted within 30 days, except invoices.
- Account, brand and results data: kept while your account exists and deleted within 30 days after you delete the account.
- Invoices and billing records: kept for 7 years, because Dutch tax law requires it.
- Usage logs: kept only as long as needed for security and troubleshooting.
Who receives your data
Only the sub-processors that help us run mentionedin.ai, listed in full.
We do not sell personal data and we do not share it with advertisers. The companies that process data for us, such as the AI engines we measure, hosting, payments and email, are listed with their country and purpose at /subprocessors/. We give 14 days notice by email before adding a new one. We may also disclose data where the law requires it.
Transfers outside the EU
Where data leaves the EU, Standard Contractual Clauses protect it.
mentionedin.ai is hosted in the EU, in Germany. Some sub-processors are based outside the European Economic Area, for example in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.
Your rights
You can ask us to show, correct, delete or hand over your data at any time.
- Access: ask for a copy of the personal data we hold about you.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted.
- Portability: receive your data in a machine readable format.
- Restriction: ask us to limit how we use your data.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: stop marketing email at any time, with the link in each email or by writing to us.
- Complaint: lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Email hi@mentionedin.ai to use any of these rights. We answer within one month.
Cookies
No advertising or analytics trackers on mentionedin.ai.
This website sets no cookies. The app uses only strictly necessary cookies that keep you signed in and secure, plus those Stripe sets during checkout. We do not use advertising or analytics trackers.
We may update this policy. Material changes are announced by email, and the date at the top shows the current version.