Privacy Policy

Who is responsible for your data

The controller of personal data processed through mentionradar.com is the administrator of the mentionradar.com service. For every privacy question or request, write to [email protected].

When a customer uses MentionRadar to monitor its brand, the customer decides which keywords, competitors and prompts are tracked. For the personal data contained in the monitoring results of that customer's workspace, the customer is the controller and we act as its processor under our data processing agreement.

Data we process and why

Account and workspace data

Name, work email address, password (stored only as a one-way hash), team and workspace names, roles, invitations, notification settings and the keywords, competitors, prompts, alert rules and reports you configure. We use it to provide the service you signed up for (performance of a contract).

Billing data

Company name, billing address, tax identifier if you provide one, plan, invoices and payment status. Card details are entered on the payment operator's secure page and we never receive full card numbers. We use billing data to charge for the service and to meet accounting and tax obligations (contract and legal obligation).

Brand scans from the homepage

The brand name, optional domain and optional competitor you enter, the scan result, and a one-way hash of your IP address that lets us apply the limit of one scan per day. We use it to show the result and to prevent abuse (legitimate interest in running a fair free scan).

Technical and security data

IP address, browser type, pages requested, timestamps and error logs, plus signals from form protection that tell people and automated scripts apart. We use it to keep the service secure, to stop spam and abuse and to fix problems (legitimate interest).

Support correspondence

Emails you send to [email protected] and our replies. We use them to answer you and to improve the product (contract or legitimate interest).

Public content collected for customers

MentionRadar collects public pages that contain the keywords our customers track: news articles, blog posts, forum and Reddit threads, Hacker News items, reviews, YouTube video descriptions and public posts on X. Such pages can contain the public username or name of the author. We store the link, title, a short excerpt, the author name as published, the publication time and our sentiment and reach estimates, and show them only inside the workspace of the customer that tracks the keyword. The legal basis is the legitimate interest of our customers in knowing what is said publicly about their brands, and our interest in providing that service. We do not collect private messages, private groups or content behind a login, and we do not build profiles of individual authors.

AI answers

Prompts that customers track are sent to the AI engines they choose so that the answers can be read and analysed. Prompts describe brands and product categories and should not contain personal data. Answers are stored in the customer's workspace.

Cookies

We use only cookies that are needed for the service to work: a session cookie that keeps you signed in, a security token that protects forms, and a cookie set by the form protection service to tell people from automated scripts. We do not use advertising cookies or cross-site tracking. Because these cookies are strictly necessary, they do not require consent.

Who receives the data

We share personal data only with service providers that process it on our behalf under written agreements, and only to the extent each one needs:

• a hosting provider in the European Union that runs our servers, databases and backups,
• a payment operator that processes subscription payments and stores card details,
• an email delivery provider that sends verification codes, alerts, digests and reports,
• AI model providers that answer the prompts our customers track,
• a website security service that protects forms from automated abuse.

When you connect a Slack incoming webhook, alerts are delivered to the Slack workspace you chose. We may also disclose data when the law requires it or to protect our rights. We never sell personal data and never share it for advertising.

Transfers outside the European Economic Area

Some providers, in particular AI model providers and the email delivery provider, may process data outside the European Economic Area. In that case the transfer is protected by an adequacy decision of the European Commission or by the standard contractual clauses approved by the Commission, together with additional safeguards where needed.

How long we keep data

• Account and workspace data, for as long as the account exists. After cancellation the account is read-only for 30 days and then deleted.
• Mentions and AI answers, for the history period of your plan (3, 12, 24 or 36 months), then deleted on a rolling basis.
• Homepage scans that were not saved to an account, up to 30 days.
• Billing records, for the period required by accounting and tax law.
• Technical and security logs, up to 90 days unless needed to investigate an incident.
• Backups roll off within 30 days of deletion.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability, and to object to processing based on legitimate interest. If you are an author whose public post appears in a customer's workspace, you can object or ask for removal by sending the link to [email protected], and we pass the request to the customer where required. Residents of California and other US states with privacy laws have comparable rights to know, delete and correct, and we do not sell or share personal information as those laws define it.

We answer requests within one month. You can also lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

Security

Data is encrypted in transit and at rest, workspaces are separated, access is limited by roles and logged, and secrets such as webhook URLs and API tokens receive an extra layer of encryption. More detail is on the security page.

Children

MentionRadar is a business service and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

When we change this policy we update the effective date above, and for material changes we notify account owners by email before the change applies.

Contact

Privacy questions and requests go to [email protected] with the subject "Privacy".