Privacy Policy
This policy describes how MencionAI collects, uses, shares, and protects your data when you use the platform. By using MencionAI, you agree to the practices described below.
Last updated: June 5, 2026
Data we collect
We collect categories of information to deliver and improve our services. Account Data: name, email, Supabase authentication credentials, workspace role, and onboarding profile (company profile, target markets). Brand and Domain: analyzed domain, brand name, description, favicon, competitor list, custom prompts, and model preferences. Platform Usage: scans performed, prompt history, detected citations and mentions, visibility metrics, generated reports, and dashboards accessed. Payment and Billing: subscription plan, billing cycle, and Stripe customer identifier — card data is not stored by MencionAI; it is processed directly by Stripe. Technical Data: browser type, device, operating system, screen resolution, IP address (used for security, anti-fraud, and analytics), and cookies (Section 8).
How we use your data
We use your data to: create and manage your account; deliver the contracted services, including GEO scans and Command Center updates; track and display how your brand appears in AI provider responses; generate brand reports, competitive analysis, and visibility insights; process billing through Stripe and manage plan-based feature access; send transactional and lifecycle communications (billing, receipts, product updates, scan alerts); provide support and respond to requests; improve platform performance, features, and experience based on aggregated analytics; ensure platform security and prevent fraud or abuse. We do not sell or share your personal data with third parties for marketing.
Public AI data collection
MencionAI sends configured prompts to AI providers (ChatGPT, Claude, Gemini, DeepSeek, Grok, Perplexity, and others) and stores the generated responses, citations, referenced sources, mention rankings, and associated metadata. This data is linked to your brand and account for analytics and reporting purposes. MencionAI does not access private, restricted, or authenticated content from social networks, nor your credentials for any third-party platform. You control which domains, competitors, and prompts are monitored and can remove them at any time.
Third-party services
We work with trusted providers to operate and improve MencionAI, including: Supabase (authentication, database, and storage), Stripe (payment processing), Vercel (hosting and edge), transactional email providers, analytics tools, and AI providers (Section 5). Each provider handles data under its own privacy policy. We only select providers that meet appropriate privacy and security standards.
Data shared with AI providers
When using AI-powered features, the following types of data may be sent to AI providers for processing: brand name, domain, and description; competitor names and domains; campaign instructions and context; prompts configured for the Command Center. The following data is never shared with AI providers: your email, password, or credentials; payment or billing information; personal identifying information not related to the prompt. MencionAI does not use your data to train its own models and prefers providers that offer opt-out from training data usage when available.
Legal basis (LGPD)
We process personal data based on the legal grounds set out in the LGPD: (a) performance of a contract — processing necessary to deliver the contracted service; (b) consent — when you expressly consent for a specific purpose; (c) compliance with legal or regulatory obligations; (d) legitimate interests — platform security, anti-fraud, product improvement, and analytics, always balanced against your rights. For users in the European Economic Area or the United Kingdom, equivalent GDPR bases apply.
Your rights
You have the right to: confirm the existence of processing; access your data; correct incomplete, inaccurate, or outdated data; request anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance; data portability; information about shared use; withdraw consent; object to processing based on legitimate interests; and request review of automated decisions affecting you. To exercise any right, write to suporte@mencionai.com.br — we respond within 15 days for LGPD requests and 30 days for GDPR requests.
Cookies
We use cookies and similar technologies to: keep your session authenticated; remember preferences (language, currency, interface); improve user experience; analyze aggregated platform usage. You can control cookies via your browser settings, but some essential cookies are required for authentication and basic functionality — disabling them may impair use of the platform.
Data retention
We retain your information as follows: account data — while the account is active; brand and campaign data (including scan history, prompts, citations, reports) — for the duration of the subscription and for a reasonable period after deactivation to allow reactivation; billing and tax records — for the period required by tax and accounting laws; technical data and security logs — for periods compatible with anti-fraud and audit purposes. When you delete your account, we remove your personal data within a reasonable timeframe, except where retention is required by law or for legitimate business interests (fraud prevention, dispute defense).
Data security
We adopt reasonable technical and administrative measures to protect your data, including: encryption in transit (TLS/SSL); access controls and Supabase authentication; Row Level Security (RLS) policies on the Postgres database; application monitoring and logging; infrastructure protection via CDN, firewall, and edge.
International data transfers
MencionAI uses infrastructure and providers that may operate outside Brazil, including the United States and the European Union. International transfers occur with appropriate safeguards under the LGPD (standard contractual clauses, adequacy decisions, or specific consent, as the case may be) and in compliance with the GDPR where applicable. We ensure that providers adopt comparable privacy and security standards.
Children's privacy
MencionAI is intended for users aged 18 or over and is not directed at minors. We do not knowingly collect personal data of children or adolescents. If we identify data from minors in our systems, we will remove it promptly. If you believe we have collected data from a minor, please contact suporte@mencionai.com.br.
Changes to this policy
We may update this Privacy Policy periodically to reflect changes in the product, operational practices, or legal requirements. Material changes will be communicated by email and/or in-platform notices. Continued use of MencionAI after changes are published constitutes acceptance of the updated policy. The last-updated date appears at the top of this page.
Contact and Data Protection Officer
Questions, rights requests, or incident reports can be sent via WhatsApp +55 48 98819-4209 or by email to suporte@mencionai.com.br. The Data Protection Officer (DPO) can be reached at the same email. Please include enough context so we can assist you quickly.