Privacy Policy

1. Introduction and scope

This Privacy Policy explains how MentionFlow, operated by Apollo Digital (“MentionFlow”, “we”, “us”), handles personal data. It covers three groups of people: our customers and the people on their teams; the visitors to a customer’s website who are counted by our optional tracking snippet; and individuals who may appear incidentally inside the public content we analyze about a brand.

For account and billing data about our customers, we act as the data controller. For the brand data a customer configures and the results we produce for them, we generally act as a data processor acting on the customer’s instructions; that customer is the controller. Where we act as processor, this policy describes our practices, and the customer’s own privacy notice governs their end users.

We are based in and host in the European Union, and we have written this policy with the EU General Data Protection Regulation (GDPR) in mind. [TBD — founder/counsel: confirm the controller legal-entity name and registered address, and whether an EU representative or Data Protection Officer must be named under Articles 27/37.]

2. Data we collect from customers

When you use MentionFlow as a customer, we collect:

• Account data — your name, email address, the sign-in method you use (email/password or Google/Microsoft OAuth), and, if you enable it, two-factor authentication settings. Passwords are stored only as salted hashes.
• Workspace configuration — the brands, prompts, competitors, regions, and knowledge-base content you set up. This is your content; treat it as such when deciding what to put in it.
• Billing data — your plan, subscription status, and the customer and subscription identifiers held by our payment processor. Card and payment details are handled by Stripe; we do not receive or store full card numbers.
• Usage and technical data — logs, feature usage, and diagnostic information generated as you use the Service, used to operate, secure, and improve it.
• Communications — messages you send us (for example, support requests) and the notifications you ask us to send you.

3. Data we collect about brands

To provide the Service, we collect and analyze public content about the brands a customer chooses to track:

• AI-engine answers — the responses that AI assistants and AI search surfaces give to the prompts a customer configures, sampled from their public surfaces, together with the citations and search queries those answers include.
• Public web and community content — publicly available web pages that engines cite, and public community discussions relevant to a brand (for example, public Reddit threads).

This content is generated by third parties, not by us. It is about brands and topics, not about our customers’ end users — but public content can incidentally contain personal data (for example, a person named in a public forum post or quoted in an answer). We process such content only to measure and report on brand visibility, not to build profiles of individuals.

If you are an individual and believe personal data about you appears in content we have collected, contact us at [email protected]. We will review the request and, where appropriate, remove or restrict the relevant records on our side; note that we do not control the original source, so removal from the source itself must be requested from the engine or website that published it.

4. Data from services you connect

If you choose to connect Google Search Console, we use Google OAuth to obtain read-only access to your Search Console data and import the metrics needed for your reporting. We request only read-only scope and do not modify anything in your Google account. You can disconnect at any time.

If you configure a Slack webhook, we send the notifications you enable to that webhook. We only send to Slack when you have set this up.

5. The visitor tracking snippet

Customers can add an optional MentionFlow snippet to their website to see which visits arrive from AI assistants. This snippet is deliberately designed not to collect personal data. For each visit it records only the page path (with any query string stripped off), the referring host, and, where the referrer is a known AI assistant, which one it was.

We also record whether the request came from the customer's own registered website, and if it did not, the name of the website it came from. This is a check on the customer's data, not on the visitor: the snippet's identifier is public, so this is how a customer can tell their own traffic apart from anything written by an unrelated site.

It does not set any cookie, does not store IP addresses, does not capture query strings, and does not fingerprint or identify individual visitors. Because it stores no identifiers, it cannot be used to profile a person or follow them across sites.

6. Cookies and similar technologies

We use only the cookies needed to run the Service — we do not use advertising or cross-site tracking cookies, and we do not embed third-party ad or analytics trackers in the product:

• A session cookie that keeps you signed in after authentication.
• A small preference cookie that remembers the brand you have selected in the dashboard.
• A first-party referral cookie set on our marketing site (retained for up to 60 days) so that referrals are attributed correctly.

7. How we use data and our legal bases

We use the data above to run collections and compute metrics, generate reports, recommendations, and content drafts, send the alerts and digests you configure, handle billing, provide support, keep the Service secure, comply with our legal obligations, and improve the Service. Under the GDPR we rely on these lawful bases:

• Performance of a contract — to provide the Service to you and administer your account and subscription.
• Legitimate interests — to secure, maintain, analyze, and improve the Service and to produce aggregated, anonymized insights, balanced against your rights.
• Consent — where you connect an optional integration or opt into optional communications; you can withdraw consent at any time.
• Legal obligation — to keep records required by tax, accounting, and other laws.

We do not sell personal data, and we do not use it for third-party advertising.

8. Subprocessors

We use a small set of vendors to run the Service. Each processes only what its function requires. The data-collection and extraction vendors (Bright Data, DataForSEO, OpenAI, Anthropic, Perplexity, xAI) process brand prompts and public answer content to collect and analyze it — not our customers’ end-user personal data.

We keep this list current and will update it as our vendors change. [TBD — founder/counsel: confirm each vendor’s contracting entity and processing location, that a data-processing agreement / Standard Contractual Clauses are in place with each, and whether to offer customers advance notice of new subprocessors.]

9. International data transfers

We host customer and brand data in the European Union. Some subprocessors listed above are located in, or may process data in, countries outside the EU/EEA, including the United States. Where personal data is transferred outside the EU/EEA, we rely on an appropriate transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. [TBD — founder/counsel: confirm the transfer mechanism in place with each non-EU subprocessor.]

10. Data retention

We keep account and workspace data for as long as your workspace exists, so your history is here waiting if you return. When you delete a workspace, its data is erased from our production systems immediately. If your subscription ends, we retain your existing workspace data so you can pick up where you left off if you re-subscribe. You can ask us to delete your workspace data at any time — see “Your rights” below — and we will erase it within 30 days of your request.

Exceptions: we retain billing and transaction records for as long as required by tax and accounting law; we may keep limited security and audit logs for a reasonable period; and we may retain aggregated, anonymized statistics indefinitely because they no longer identify anyone. Visitor-snippet events contain no personal data and are retained as operational analytics.

11. Your rights

If you are in the EU/EEA (and, similarly, in the UK), you have the right to access your personal data; to have it corrected or erased; to restrict or object to its processing; to data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection supervisory authority.

You can delete your account yourself at any time from Account settings — this erases your profile, sessions, sign-in providers, and two-factor setup, and removes you from every workspace. If you are the only owner of a workspace, transfer ownership or delete that workspace first. Audit-log entries recording actions you took are kept, with your email, as part of each workspace's security trail (the security-log exception in section 10).

To exercise these rights, email [email protected]. We will respond within 30 days (extendable for complex requests, as the law allows). Where we act as a processor for a customer’s workspace, we will refer a request that concerns that workspace to the relevant customer (the controller) and support them in responding. MentionFlow is established in Bulgaria; our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (CPDP / Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria — kzld.bg, [email protected]. You may also complain to the supervisory authority where you live or work.

12. How we protect data

We take reasonable technical and organizational measures to protect personal data, including: encryption in transit (TLS); hosting within the EU; role-based access control with strict tenant isolation, so a workspace’s data is only accessible to its authorized members; storing passwords only as salted hashes and supporting two-factor authentication; and delegating card handling to a PCI-compliant payment processor so we never store card numbers.

No system is perfectly secure, and we do not claim certifications we do not hold. If a personal-data breach occurs that is likely to affect you, we will notify affected customers and the relevant authority as required by law.

13. Children

The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will update the “Last updated” date above and, where the change materially affects customers, notify workspace owners by email. Your continued use of the Service after a change takes effect means you accept the updated policy.

15. Contact

For any privacy question or to exercise your rights, contact us at [email protected]. MentionFlow is operated by Apollo Digital [TBD — founder/counsel: add the controller’s registered legal name and address, and an EU representative if one is required].