Privacy Policy

MentionLift is the trading name of MentionLift Ltd, a company incorporated in England and Wales under company number 17438016, whose registered office is at 66 Paul Street, London EC2A 4NA, United Kingdom (“MentionLift”, “we”, “us”). We help businesses win in organic marketing through consulting and full-service work, and we are supplied to businesses; see clause 3 of the Terms of Service.

This policy covers the website at mentionlift.ai and the information we handle in the course of an engagement. We also operate software products under their own brands, each with its own privacy policy: Redwatcher (redwatcher.com/privacy) and MentionChecker (mentionchecker.com/privacy). If you use one of those products, that product's policy applies to it, not this one.

We are the controller of your contact information, our billing records, our server logs, our website measurement records, and the public content our monitoring collects in order to provide our services. Where a client's own configuration or instructions cause us to process personal information on the client's behalf, we are that client's processor and act only on its instructions. Our processing terms for that role are available on request.

Contact us about this policy, or about information we hold, at privacy@mentionlift.ai.

Enquiries. When you fill in a form on this site (to request a sample report, an audit, or to get in touch) we collect your email address and, if you give them, your name, your company website and your message. We also record the page the form was on, any campaign parameters in the link you arrived through, and your browser type.

Business contacts. If you or your organisation are a prospective or current client, we may hold your business contact details: name, role, work email address, company and company website. These come from you, from public sources such as your company website or professional profile, or from business-data providers.

Engagement configuration. The brand, competitor and keyword lists, communities, exclusions, scoring rules, project description and alert destinations (an email address, or credentials for your own Slack workspace, Telegram chat or webhook endpoint) that you supply or approve. If you give us a website address we read that public site in order to propose a configuration.

Public content that matches a configuration. Our monitoring reads public posts and comments on platforms such as Reddit, public web pages, and the answers AI assistants give to questions we ask them, and retains what matches a client's configuration. For each match we hold the text, the author's public username where the platform shows one, the community or site, the link and the timestamp. We read only content that is publicly visible. We do not sign in to any platform as you, we cannot access private messages or private communities, and we never post.

Correspondence and engagement records. Emails, meeting notes, proposals, contracts and the documents exchanged in the course of an engagement.

Billing information. The legal name, billing address, VAT number and invoice history of the organisation we invoice. Where a payment is made by card, our payment processor collects and holds the card details; we do not receive or store them.

Technical records. Server logs containing IP address, browser type and pages requested, retained for security and fault diagnosis.

Website measurement. Records of how this website is used, collected through Google Analytics. Section 5 says what this contains and how to opt out.

We use the information above to reply to your enquiry and send you what you asked for; to propose, agree and perform an engagement; to run the monitoring a client has configured and deliver alerts to the destinations it chose; to estimate the relevance of each match and produce reports; to operate, secure and improve this website and our tools and diagnose faults; to invoice and take payment; and to contact you about your engagement, about security, and about material changes to our services.

Your information. Our lawful basis is the performance of our contract with you, or the steps you ask us to take before entering into one; our legitimate interest in running and promoting our business and keeping our systems secure; our legal obligations in respect of tax and accounting; and your consent where we ask for it.

Business contacts. Our lawful basis for holding and using the details of people at businesses we believe could benefit from our services is our legitimate interest in promoting those services to businesses. We contact business addresses only, we keep the details to what is needed to identify the right person, and you can object at any time (section 8).

Public content. Matched content may include an author's public username and whatever they published. Our lawful basis is legitimate interests: enabling a business to learn that it, its products or its market are being discussed in public, or described by an AI assistant, and to take part in that discussion. We have assessed that interest against the interests and rights of the people who posted, and have limited the processing accordingly. We read only material that is already public. We retain only material matching a client's configured terms. We keep no permanent archive. We do not construct profiles of individuals. We do not sell or disclose the content. Clause 7 of the Terms of Service prohibits clients from using our services to monitor or target individuals. Any person may object and have their content removed; see section 8.

When you give us your email address through a form on this site, we send you what you asked for and we may also send you email about our services: guides, examples of our work, changes to what we offer, and offers. Our lawful basis is our legitimate interest in telling people who have shown interest in our services about them; where the law requires it, we rely on the fact that you supplied your email address in the course of requesting something from us and were given the opportunity to decline such messages at that time.

Every marketing email carries a one-click unsubscribe link, and you may also decline by writing to privacy@mentionlift.ai. We act on a request to unsubscribe promptly. Alerts, reports and messages about an engagement are not marketing: they are the service you engaged us for, and they stop when the engagement ends. Unsubscribing from marketing does not affect them.

Analytics. This website uses Google Analytics 4, a service of Google, to measure how the site is used: pages viewed, where you arrived from, campaign parameters in the link, approximate location derived from your IP address, device, browser, and which forms were submitted. Google Analytics sets first-party cookies on our domain that let it recognise a returning visitor, and Google receives the measurement data and processes it on our behalf. We use it to count visits and form submissions, not for advertising, and we do not pass the data to anyone else. You can prevent measurement by installing Google's browser opt-out add-on, by blocking the googletagmanager.com domain, or by clearing this site's data in your browser. A browser set to refuse cookies is not blocked from anything on this site.

Advertising. As of the effective date of this version, no advertising or retargeting tag runs on this site. If we add one, it will load only after you have agreed to it, and never before; in the United Kingdom and the European Economic Area we will ask first, and if you decline or do not answer no advertising tag will be loaded at all. We will update this policy, and the choice we offer you, before any such tag goes live. We do not sell personal information and we do not pass it to data brokers.

We do not sell personal information. We use the following processors, each bound by a data processing agreement and permitted to use the information only to provide its service to us:

Content sent for relevance scoring is processed in order to return a score or an analysis. It is not used by those providers to train their models.

Alert destinations you choose (Slack, Telegram, a webhook endpoint) are operated by third parties under their own terms; we send alerts to them on your instruction and hold the credentials you supply only for that purpose. We may use contractors to perform parts of an engagement; they are bound by confidentiality and see only what the engagement requires.

We also disclose information where required by law, and to a purchaser or successor if the business or its assets are transferred, in which case this policy continues to apply until you are notified otherwise.

Enquiries and business contacts: for as long as we are in contact with you, and then for up to 24 months from our last contact, unless you ask us to stop sooner.

Engagement configuration and matched content: in full for the duration of the engagement. When an engagement ends, monitoring stops, and the project's configuration and its matched content are deleted within 30 days, unless you ask us in writing to keep them for a further engagement.

Contracts, invoices and correspondence needed to evidence an engagement: for six years after the engagement ends, as United Kingdom tax and company law requires.

Server logs are retained for a short operational period and then deleted. Google Analytics event data is retained for up to 14 months.

Depending on where you live, you may have the right to access, correct, delete, export or restrict the personal information we hold about you, to object to processing carried out on the basis of legitimate interests, and to object at any time to direct marketing. Write to privacy@mentionlift.ai and we will respond within one month. You may also lodge a complaint with your local data protection authority, which in the United Kingdom is the Information Commissioner's Office.

If you are the author of public content we have matched and you want it removed from our systems, write to legal@mentionlift.ai or privacy@mentionlift.ai with the link. You do not need an account with us and you do not need to give a reason. This is also how to object to the processing described in section 3.

Data is encrypted in transit and at rest. Access to production systems is restricted to those who require it. Credentials you supply for your own alert destinations are used only to deliver your alerts. No system is entirely secure. If a breach affects you, we will notify you and the relevant supervisory authority as required by law.

Our database, monitoring workers and email infrastructure are hosted in the EU. Some processors may handle data outside your country. Where information is transferred outside the EEA or the United Kingdom, we rely on an adequacy decision or on Standard Contractual Clauses, together with the United Kingdom Addendum where required.

MentionLift is supplied to businesses and is not offered to anyone under 18. Our website and services are not directed at children. We do not knowingly collect a child's information, and we delete it if we learn that we have.

Each version of this policy bears a version number and an effective date, stated at the head of this page. The version applicable to any processing is the version in force at the time.

Amendments which correct or clarify, and which do not reduce your rights, take effect on publication. A material amendment takes effect not less than 30 days after we email the address we hold for you, and, for a client with a current engagement, at the start of the first billing period beginning on or after the effective date. Superseded versions are retained and are available on request.

Data protection, removal requests and objections: privacy@mentionlift.ai
Legal notice: legal@mentionlift.ai
Postal address: MentionLift Ltd, 66 Paul Street, London EC2A 4NA, United Kingdom (company number 17438016, registered in England and Wales)