Privacy Policy

Four kinds of thing, and nothing else:

Connecting a Google account is optional, and everything except the drafting-into-Gmail step works without it. The connection is made through Composio, which brokers the OAuth grant and holds the token; we call it to act on your mailbox and it is a processor for us.

What the product does with that access is narrow and it is worth stating plainly. It drafts a message, sends that message from your address when you tell it to, and reads a thread it already sent in, and only that thread, so it can draft a reply to an answer you received. It does not read your mailbox generally and it does not scan messages unrelated to an opportunity you worked on.

Message text we fetch in order to draft a reply is used for that draft and is not kept in a database of ours. Mentionry's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not use Gmail data for advertising, we do not sell it, we do not use it to train generalized models, and we do not let humans read it except with your permission, for security, or where the law requires it.

You can disconnect the mailbox from the product at any time, and you can revoke the grant yourself from your Google Account's third-party access settings. Either revokes our access immediately.

In your browser. The drafts Mentionry writes for you are stored in your own browser's local storage on the machine you are using, not in a database we own. That is a deliberate design decision rather than an omission: holding them would mean keeping a copy of every pitch every customer ever considered sending, and nothing about running the product requires it.

The practical consequences are worth knowing. Clearing your browser data clears them. They do not follow you to a different computer. And there is no copy of them for us to hand over, lose, or be compelled to produce.

Replies are the same idea from the other direction. Mentionry keeps the Gmail identifiers needed to go and ask your mailbox what happened to a thread, and asks live each time. It does not store the reply, a status, or a sent flag, because the mailbox is the only honest source for any of those.

To run the product: to find and judge openings for the domain you gave us, to write the drafts, and to put them where you asked. To keep an account working and secure, to answer you when you write to us, to bill a subscription, to detect abuse, and to fix what breaks.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use your content to train generalized AI models.

If you are in the UK, the EU or the EEA, the law asks us to name the ground for each use rather than leave it implied. There are four, and every use above sits under one of them.

For information about you as our customer, such as your account, your billing and your use of the site, we decide what happens to it and we are the controller of it.

For the personal information you bring into the product, such as a journalist's published contact details or the contents of a mailbox you connect, you decide what happens to it and you are the controller. We act on your instructions as a processor: we hold that material only to run the service for you, we do not use it for anything of our own, and we return or delete it when you close the account or disconnect the mailbox. If your organization needs that written as a data processing agreement, write to us and we will sign one.

Only the providers needed to run the service, each doing one job under contract:

Each of those providers is under a written contract that holds it to the same obligations we have taken on here, and none of them may use what it receives for anything of its own. We stay responsible to you for what they do with it.

The list will change as the product does. When we add a provider that will handle personal information, we update this page, and where you are our processor customer we will tell you before the change takes effect so you can object. If you object and we cannot find another way to run the feature, you can cancel without penalty for the remainder of the period you paid for.

We may also disclose information where the law requires it, to a regulator or a court, or to protect somebody's safety, and to a buyer if the business is sold, in which case this policy continues to apply until it is replaced with notice.

Some of what the product finds is information about journalists, editors and site owners: a name, a role, an outlet, and a contact address the source published for exactly this purpose. It comes from public sources, and Mentionry never guesses at an address that was not published.

If you are one of those people and you would rather not appear, write to us and we will remove you. Once you have been contacted through somebody's mailbox the relationship is with that sender rather than with us, so tell them too, and they must respect it.

Account and subscription records last as long as the account does, and afterwards only as long as billing, tax and legal obligations require. Server and security logs are kept for a short operational period. Drafts are not ours to keep, as described above.

Delete your account and the account record goes with it, subject to the records we are required to retain and to copies that persist briefly in backups before they age out.

Traffic is encrypted in transit. Credentials for third-party services are held server-side and are never exposed to the browser. Access to production is limited to the people who need it.

No online service is completely secure, and the honest version of this section stops there rather than claiming otherwise. Protecting your own account credentials is your part of it, and telling us quickly if you think they are compromised is the most useful thing you can do.

If personal information of yours is exposed by a breach on our side, we will tell you without undue delay and in any case within 72 hours of becoming aware of it, and we will tell you what happened, what was affected and what we are doing about it. We would rather send that message early and incomplete than late and tidy.

Depending on where you live you may have the right to a copy of your personal information, to have it corrected or deleted, to restrict or object to how it is used, and to complain to your data protection authority. Write to us and we will do it. We may need to check who you are first, and a few narrow legal exceptions apply.

If you are in California, the same rights apply under their own names: to know what we collect and why, to a copy of it, to have it deleted or corrected, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of, and we will never treat you differently for exercising a right. You may use an authorised agent, and we will verify the authorisation.

Two of these you can exercise without asking anyone: revoke the mailbox grant from your Google Account, and clear your browser data to remove the drafts.

We answer a request within 30 days, and tell you if a lawful extension is needed. If we get it wrong you can complain to your data protection authority, and in the EU or the UK you can do that where you live or work.

We use cookies and equivalent local storage for the things that cannot work without them: keeping you signed in, remembering a preference, and holding the drafts described above. We do not use advertising cookies and we do not run third-party ad trackers on this site.

Spotbo Inc. is a Delaware corporation and the providers above operate in several countries, so information may be processed outside the country you live in, most often in the United States. Where that transfer is out of the UK, the EU or the EEA, it is made under the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK is involved, or under an adequacy decision where one covers the destination. Ask us and we will tell you which mechanism covers a given provider.

Mentionry is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16.

We will update this page when the product or the law changes, and the date at the top is the one that counts. Where a change is material we will give notice as well as changing the page.

Privacy requests and questions go to [email protected], or through the contact page. The commercial side of the agreement is in the Terms of Service.