Privacy Policy
Last updated: October 2, 2026
This policy explains how MentionAudit (“we”) collects, uses, and shares personal data when you use our website, dashboard, and APIs (the “Service”). We do not sell personal data and we do not run advertising or marketing trackers.
1. Who we are
The data controller is Sam Miller, 1209 Mountain Road Pl NE Ste N, Albuquerque, NM 87110, United States. Contact: [email protected].
2. What we collect
- Account data: email, name, profile image, password hash or OAuth provider ID, workspace name, plan, and billing name and address.
- Audit content: the brand domains, keywords, competitor names, and briefs you submit, plus the AI responses and analysis we generate from them. Do not submit personal data of third parties as audit input.
- Connected integrations: if you connect Google Analytics, Search Console, or Slack, we store an encrypted OAuth token and pull only the data you authorize. Disconnecting revokes the token.
- Usage and technical data: pages viewed, features used, IP address, user agent, request URLs, and error reports.
- Coming-soon gate replay: while the public site sits behind our coming-soon gate, we record a privacy-masked session replay of that one page, so we can see whether visitors read it and which link they take. The replay captures the page’s layout and your interactions with it — clicks, pointer movement, and scrolling — but all visible text, input values, and element attributes are masked in your browser before anything is sent, the page’s links are excluded from capture, and the recorded address is normalized to the gate itself. Console logs, network request headers and bodies, canvas content, and cross-origin frames are not recorded. No other page is recorded, and the anonymous identity used on the gate is discarded before sign-in, so a replay is never joined to your account.
3. How we use it
- To provide the Service — run audits, store your history, send transactional email, process payments (legal basis: contract).
- To secure and improve the Service — fraud and abuse prevention, error monitoring, product analytics (legal basis: legitimate interests; you may object at any time).
- To comply with law — tax, accounting, and lawful requests (legal basis: legal obligation).
- Product updates — only if you opt in; unsubscribe at any time (legal basis: consent).
We do not make automated decisions that produce legal or similarly significant effects on you.
4. Who we share it with
We share personal data only with the categories of service provider below, each bound by a data-processing agreement, and with authorities where legally required. We do not sell personal data or share it for cross-context behavioural advertising.
| Category of recipient | Purpose | Location |
|---|---|---|
| Authentication and billing | Account sign-in and subscription payments | United States, Ireland |
| Hosting and infrastructure | Application, database, and frontend hosting; bot protection on the public audit form | United States, global edge |
| Analytics and error monitoring | Understanding product usage, privacy-masked replay of the public coming-soon gate, and diagnosing faults | United States |
| AI model providers | Generating the AI responses your audit analyzes. Audit inputs only, no account data. | United States |
| Optional integrations you connect | Third-party analytics and messaging tools you connect from your account | United States |
5. Cookies
We use Clerk session cookies to keep you signed in, and a short-lived Cloudflare cookie for bot protection on the public audit form. Your light/dark preference is stored in browser local storage. If you choose to exclude your browser from analytics, a preference cookie remembers that choice for up to one year; it contains no visitor identifier. Our analytics and session-replay provider runs in memory-only mode, so it writes no cookie or storage of its own and a full reload starts a new anonymous session. We set no advertising or tracking cookies, so no consent banner is shown.
6. Retention
- Account and audit data: while your account is active, and until you request erasure after closing it. Backups roll off within 35 days.
- Billing records: 7 years, as required for tax purposes.
- Server logs and error reports: up to 90 days.
- Coming-soon gate replays: 30 days.
- Integration tokens: deleted within 24 hours of disconnection.
7. International transfers
We are located in the United States and our providers process data there. Where we transfer data of EEA, UK, or Swiss residents, we rely on Standard Contractual Clauses or the EU-US Data Privacy Framework as applicable.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, to withdraw consent, and to lodge a complaint with your local data-protection authority. To exercise any of these, email [email protected]; we respond within 30 days and may ask you to verify your identity. We do not discriminate against you for exercising your rights.
9. Children
The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data; contact us to have it removed.
10. Changes
We will update this policy when our practices change and notify account owners of material changes by email or in-product notice.
11. Contact
[email protected]. See also our Terms of Service.