1. Who we are
The data controller is Ionuț-Robert Sandu, Persoană Fizică Autorizată (PFA), CUI 51596898, B-dul Bucureștii Noi 136, parter, ap. 5, Sector 1, Bucharest, Romania. Contact for privacy questions: privacy@mentionnorth.com.
2. What we collect
| Context | Data |
|---|---|
| Free audit | The website address you enter; your IP address, used only as a short-lived rate-limit counter; the generated report. |
| Account | Your email address, and your name if you sign in with Google or LinkedIn; how you signed in; audits you save. |
| Subscription | Email address, name and company, billing address and VAT ID (entered on Stripe’s checkout), the website, competitors and questions you configure, and your reports. |
| Payments | Card details are entered on Stripe and never reach our systems. We receive Stripe’s customer and subscription identifiers and payment status. |
| The contents of messages you send us. We send you service emails: sign-in links, purchase confirmations, weekly report summaries (which you can turn off) and billing notices. | |
| Technical | Our hosting provider processes standard request data (IP address, user agent, timestamps) for security and reliability. |
The AI providers only receive public information about the website being analyzed (its brand name, domain, category and buyer questions). We do not send them your personal data.
3. Sign in with Google or LinkedIn
You can create an account or sign in with Google or LinkedIn instead of an email link. If you do, we request only the basic OpenID Connect scopes (openid, email, profile) and receive:
- Your email address and whether the provider has verified it — used to identify your account and to send you sign-in links, purchase confirmations and reports you asked for;
- Your name — used to greet you in the dashboard and in our emails.
We do not request access to your contacts, calendar, files, posts or any other data, we do not store the access tokens issued by Google or LinkedIn, and we never post on your behalf. This information is stored with your account (see “How long we keep it”) and is deleted when you ask us to delete your account. We do not sell it, use it for advertising, or transfer it to third parties except the service providers listed below that host our application.
Google API Services User Data Policy. MentionNorth’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Why we use it (legal bases)
- To provide the Service you request — running audits and scans, showing your dashboard, billing (Art. 6(1)(b) GDPR, contract).
- To keep the Service secure and prevent abuse, e.g. rate limiting free audits (Art. 6(1)(f), legitimate interests).
- To meet legal obligations, such as keeping invoices and accounting records (Art. 6(1)(c)).
- To reply to your messages (Art. 6(1)(b) or (f)).
We do not sell personal data, do not use it for advertising and do not build marketing profiles.
5. Service providers
- Cloudflare, Inc. — hosting, storage (Workers KV), AI model inference (Workers AI) and routing of AI requests (AI Gateway).
- OpenAI, Anthropic and Google — answer the questions we ask about the analyzed brand. They receive no personal data.
- Stripe — payment processing, invoicing and the billing portal. Stripe acts as an independent controller for some payment data; see stripe.com/privacy.
- Cloudflare Email Service — delivery of our service emails.
- Google and LinkedIn — only if you choose to sign in with them; we receive your name and verified email address and nothing else.
- Our email provider — to receive and answer your emails.
6. International transfers
Cloudflare and Stripe may process data outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses offered by these providers.
7. How long we keep it
- Free audit results: 24 hours (90 days if you save them to an account).
- Sign-in links: 30 minutes (7 days in the purchase confirmation). Sessions: 30 days.
- Rate-limit counters (IP-based): up to 2 days.
- Customer account and reports: for the duration of your subscription and up to 12 months afterwards so you can return to your history, unless you ask us to delete them sooner.
- Invoices and payment records: as long as tax and accounting law requires.
8. Your rights
You can ask to access, correct, delete, restrict or port your personal data, and object to processing based on legitimate interests. Email privacy@mentionnorth.com; we reply within one month. You may also complain to a supervisory authority — in Romania, the ANSPDCP (dataprotection.ro) — or the authority in your country.
9. Cookies
We set a single, strictly necessary sign-in cookie and use no analytics or tracking. See the Cookie Policy.
10. Security
All traffic is encrypted with HTTPS. Secrets are stored in Cloudflare’s encrypted secret store, dashboards are protected by long random links, and payment data stays with Stripe.
11. Changes
We will post updates on this page and, for material changes, notify customers by email.