Privacy Policy

MentionOS (“MentionOS”, “we”, “us”, “our”) is an autonomous AEO agent. We provide Answer Engine Optimisation (AEO) and Generative Engine Optimisation (GEO) services, and we provide nothing else: the agent monitors how AI assistants answer questions about your brand, interprets what it finds, and carries out the work that improves those answers.

MentionOS is registered in the United Kingdom.

In relation to your account, billing records and correspondence with us, we act as a data controller and determine the purposes and means of processing. In relation to the brand, site and product data you submit to the platform (“Customer Content”), we act as a data processor and process it on your documented instructions.

If you have a question about this policy, or you wish to exercise a right described in it, contact legal@mentionos.ai.

This policy governs all personal data processed in connection with our AEO and GEO services, namely:

• our marketing website at mentionos.ai;
• the MentionOS platform at app.mentionos.ai (the “Platform”); and
• the reports, alerts and channel messages the agent sends to you or on your behalf.

MentionOS is a business-to-business service. We do not market or sell to consumers, and the Platform is not intended for personal or household use.

This policy does not apply to the third-party stores, site platforms or websites you connect to the Platform, or that we link to. Those services operate under their own privacy notices, which you should review before connecting or using them.

We collect personal data directly from you when you create an account, subscribe, run a free audit, connect a store or site, or contact us; automatically when you use the Platform or our website; and from third parties where you authorise a connection, for example when you sign in with Google.

Account data

Your name, business email address and password. Passwords are stored only as a bcrypt hash and cannot be recovered or read by anyone at MentionOS. We also record your email verification status and the date of your most recent sign-in. Where you sign in with Google, we receive your Google account identifier, name, email address and profile image.

Brand and site data

Your brand name, domain, product catalogue and the publicly accessible pages we crawl from your website. This forms part of your Customer Content.

Connection data

Access tokens and credentials for the stores and site platforms you connect, including Shopify, WooCommerce, Webflow, Framer and WordPress. Tokens are encrypted at rest and are used solely to perform the actions you authorise.

Service data

The prompts we monitor on your behalf, the responses returned by AI assistants, the sources cited in those responses, your visibility scores over time, the articles the agent drafts, and your conversations with the agent.

Billing data

Your Stripe customer and subscription identifiers, your plan and your billing dates. We never receive or store card numbers. Payment credentials are collected and held by Stripe, which acts as an independent controller for its own compliance purposes.

Channel data

The email addresses, workspace identifiers or telephone numbers you connect so that the agent can reach you.

Enquiry data

Where you submit our contact form: your name, business email address, brand, company size, platform and the content of your message.

Technical data

Session cookies, IP address, browser and device characteristics, and the server logs generated when you use the Platform.

We do not request special category data within the meaning of Art. 9 UK GDPR — including data revealing health, racial or ethnic origin, political opinions or biometric identifiers — and you must not submit it to the Platform.

We process personal data only where a lawful basis under Art. 6(1) UK GDPR applies. Each purpose and its basis is set out below.

• Providing the AEO and GEO services you have subscribed to. Legal basis: performance of a contract (Art. 6(1)(b)).
• Taking payment, issuing invoices and preventing payment fraud. Legal basis: performance of a contract (Art. 6(1)(b)); compliance with a legal obligation (Art. 6(1)(c)).
• Maintaining the security, availability and integrity of the Platform. Legal basis: legitimate interests (Art. 6(1)(f)), namely protecting our infrastructure and our customers from abuse.
• Responding to support requests and other correspondence. Legal basis: performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)).
• Improving the service using aggregated statistics that do not identify you or your brand. Legal basis: legitimate interests (Art. 6(1)(f)).
• Sending service communications, including alerts, reports, security notices and billing notices. Legal basis: performance of a contract (Art. 6(1)(b)).
• Sending marketing communications. Legal basis: consent (Art. 6(1)(a)), or legitimate interests (Art. 6(1)(f)) where you are an existing business customer. Every marketing email carries an unsubscribe link, which we honour immediately.
• Meeting tax, accounting, audit and other statutory obligations. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).

Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms and concluded that our processing is proportionate. You may object at any time, as described in Your rights.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

AEO and GEO work depends on the answers themselves. We therefore submit prompts to the AI assistants we monitor — ChatGPT, Perplexity, Gemini and Google AI — and record the responses they return. Those prompts contain your brand name, your domain and your product category. They do not require your customers’ personal data, and you must not include it.

We also submit your publicly available page content and product text to large language models, including models operated by OpenAI, Anthropic and Google, so that the agent can produce drafts, summaries and recommendations for you.

We procure these services on business API terms under which the provider does not use the data we submit to train its models.

AI output is probabilistic, and providers revise their models without notice. Nothing returned by an AI assistant or language model is warranted to be accurate, complete or current, and you remain responsible for anything you publish. See AI output, accuracy and results in our Terms.

We disclose personal data to the service providers (“sub-processors”) that help us operate the service. Each is engaged under a written contract restricting processing to our documented instructions and imposing confidentiality and security obligations at least equivalent to our own.

We name our AI and payment providers below. For competitive reasons we identify the remaining providers by category, as Art. 13(1)(e) UK GDPR expressly permits.

• AI assistants and model providers — ChatGPT (OpenAI), Claude (Anthropic), Gemini and Google AI (Google), and Perplexity. We submit prompts to these providers and collect the responses.
• Payment processing — Stripe.
• Cloud hosting, database and backup providers — operating our website, the Platform and our stored data.
• Email and message delivery providers — transmitting our service and marketing communications, and delivering to any channel you connect.
• Data and research suppliers — collecting publicly available AI responses and supplying search data.
• Media and brand asset providers — hosting images and supplying brand logos and site imagery.

If you require the named list of our current sub-processors — for example, to complete your own vendor assessment — email legal@mentionos.ai and we will provide it.

We also disclose personal data to our professional advisers, and to a regulator, court or law enforcement body where we are legally required to do so. In the event of a merger, acquisition or sale of assets, personal data may transfer to the acquirer, and this policy will continue to apply until we notify you otherwise.

Some of our sub-processors are established outside the United Kingdom, principally in the United States. Where personal data is transferred outside the UK or the European Economic Area, we rely on one of the following safeguards:

• an adequacy decision made by the UK Government or the European Commission;
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; or
• the EU Standard Contractual Clauses, supplemented by a transfer risk assessment where one is required.

Copies of the safeguards applicable to a particular transfer are available on request from legal@mentionos.ai.

We retain personal data only for as long as is necessary for the purposes described in this policy, after which we delete or anonymise it.

Where we are required to retain data to establish, exercise or defend a legal claim, we will keep it for as long as that purpose requires and no longer.

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest;
• password hashing with bcrypt, so that credentials cannot be read by us;
• encryption of connection tokens before storage;
• least-privilege database roles — the application role holds no rights to drop or truncate data;
• automated backups taken every 12 hours and retained in two independent locations; and
• access controls limiting production access to personnel with a demonstrated need.

No system can be guaranteed secure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will notify you without undue delay where the risk to you is high.

Under UK and EU GDPR you have the right to:

• Access — obtain confirmation that we process your personal data, and a copy of it (Art. 15).
• Rectification — have inaccurate or incomplete data corrected (Art. 16).
• Erasure — have your data deleted where one of the statutory grounds applies (Art. 17).
• Restriction — require us to limit our processing in defined circumstances (Art. 18).
• Portability — receive the data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller (Art. 20).
• Object — object to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
• Withdraw consent — where processing is based on consent, withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, email legal@mentionos.ai. We respond within one month, which we may extend by up to two further months for complex or numerous requests, in which case we will tell you within the first month (Art. 12(3)). We do not charge a fee unless a request is manifestly unfounded or excessive.

You may also lodge a complaint with the Information Commissioner’s Office at ico.org.uk, or with your local supervisory authority in the EEA. We would ask that you raise the matter with us first so that we can resolve it.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know what personal information we collect, to request its deletion or correction, to opt out of any sale or sharing of it, and not to be discriminated against for exercising those rights.

In the preceding 12 months we collected the following categories of personal information, in each case for the business purposes set out in Purposes and legal bases.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding 12 months. We do not knowingly collect or sell the personal information of minors under 16.

To exercise these rights, email legal@mentionos.ai. You may use an authorised agent, in which case we will ask for written proof of authorisation and may verify your identity directly.

Our marketing website sets no advertising cookies and no analytics cookies, and we do not track you across other websites.

The Platform sets a single strictly necessary cookie to maintain your authenticated session; the Platform cannot operate without it. Our internal administration tool sets an equivalent session cookie for staff only.

Because we use strictly necessary cookies alone, no consent banner is displayed, consistent with regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003. If we introduce analytics or marketing cookies, we will obtain your consent before setting them and publish a cookie notice.

The Service is offered to businesses and is not directed to anyone under 18. We do not knowingly collect personal data relating to children. If you believe a child has provided us with personal data, contact legal@mentionos.ai and we will delete it.

We use models to score, rank and classify data within the Platform. We do not carry out automated decision-making that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Art. 22 UK GDPR.

The agent proposes actions for your approval, or executes them on a schedule you have configured, and its output remains subject to human review at all times.

We may update this policy to reflect changes to the Service, to our sub-processors or to applicable law. The date of the most recent revision appears at the top of this page. Where a change materially affects how we process your personal data, we will notify you by email before it takes effect.

Privacy and legal enquiries: legal@mentionos.ai

Support and complaints: support@mentionos.ai

MentionOS is registered in the United Kingdom.