Legal
Privacy Policy
What we collect, why, how long we keep it and who else touches it. Nothing is stored in your browser until you accept it.
Effective 22 September 2026
1. Who is responsible
MentionLab SRL, a company incorporated under Belgian law, registered office Rue Blanche-Eau 15, 6950 Nassogne, Belgium, enterprise and VAT number BE 1030.919.265, is the controller for the personal data described here. Our Data Protection Officer is Pierre-Stanislas Quievreux, pierre@mentionlab.io. For anything in this policy, write to legal@mentionlab.io.
2. Cookies and consent
apiforgeo.com loads Google Tag Manager, which we use to measure how the site is used. Every visitor starts with all of it denied, on every page: no analytics cookie, no advertising cookie, no advertising identifier, and nothing written to localStorage or sessionStorage. Denied is the default, not a setting you have to find.
The banner at the bottom of the page asks you once. Accept lets the
measurement tags set their cookies and read them again on a later visit.
Reject keeps everything denied, and nothing is stored. We keep your answer in
your browser under the key consent, so that you are asked once and not on every
page. That one key is strictly necessary to honour your choice, and it is the only thing we
store before you answer.
Legal basis: your consent, under article 129 of the Belgian Electronic Communications Act of 13 June 2005 and article 6(1)(a) GDPR. You can withdraw it at any time with Cookie settings in the footer, which reopens the banner. Withdrawing is one click, the same as giving it.
The third parties a page contacts are Google, for the tag manager (googletagmanager.com) and for the measurement domains its tags call once you accept, and Google Fonts (fonts.googleapis.com, fonts.gstatic.com), which serves the two typefaces. Both receive your IP address and browser details. Cloudflare serves the site and keeps short-lived operational logs.
3. When you ask for a key
The form on the pricing page sends three fields to our CRM: your work email, your company name, and what you told us you are building. We use them to send you a key and a sandbox project and to follow up. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering a business enquiry. Every email we send carries an unsubscribe link.
4. When you use the API
| What | Why | Legal basis |
|---|---|---|
| Account and billing data | Running your account, invoicing, accounting records | Contract, and legal obligation |
| Key metadata, request logs, IP address, credit consumption | Authenticating calls, rate limits, billing, detecting abuse, debugging | Contract, and legitimate interest in a secure service |
| Prompts, tags, entity lists and the results we store | Executing the prompts and serving your analytics reads | Contract |
| Support correspondence | Answering you and keeping a record | Contract, and legitimate interest |
5. Prompts and what comes back
Prompts are business questions about brands and products. Do not put personal data in prompts. They are transmitted to third-party generative engines we do not control.
Generative answers sometimes name individuals, for example an author credited on a cited page. We process that only to compute and store the metrics you asked for. If you are named in output we hold and want it removed, write to legal@mentionlab.io and we will handle it under section 8.
For data you send us about your own customers, you are the controller and we are your processor. A data processing agreement is available on request and governs that.
6. Who else processes data
Each provider is bound by a contract limiting it to our instructions.
| Provider | Role | Where |
|---|---|---|
| Cloudflare | Website hosting and CDN | Global edge |
| HubSpot | CRM for the key-request form | European Union (eu1) |
| Tag Manager and site measurement, only once you accept | Global | |
| OpenAI, Google, Perplexity, Anthropic, Microsoft, xAI | Operating the generative engines your prompts run against | Per operator |
| Infrastructure, payment and support providers | Running the API, billing you, answering you | Current list on request |
Executing a prompt means sending it to the relevant engine operator, who processes it under their own terms. That is inherent to the service, and it is why section 5 asks you to keep personal data out of prompts. Where a provider processes data outside the EEA, the transfer relies on an adequacy decision or the European Commission's Standard Contractual Clauses; ask legal@mentionlab.io which applies to a given provider.
We do not sell personal data and we do not share it for advertising.
7. How long we keep things
- Key requests that do not become accounts: up to 24 months from last contact.
- Account data: for the life of the account and a reasonable period after closure.
- Billing records: seven years, as Belgian law requires.
- Stored prompt runs: your plan's historical retention window, shown on the pricing page.
- Request logs and support correspondence: as long as needed to bill, secure and debug the service, and to answer you.
On account closure we delete or anonymise your data, except what we must keep by law.
8. Your rights
You can ask us for a copy of your data, or to correct it, delete it, restrict or object to processing, or port it. Where we rely on legitimate interest you can object, and we will stop unless we have compelling grounds. We do not make decisions with legal or similarly significant effects about you by automated means; the metrics we compute describe brands and answers, not people.
Write to legal@mentionlab.io and we will answer within one month. If you are not satisfied you can complain to the Belgian Data Protection Authority (Autorité de protection des données), or to the authority where you live or work.
9. Security
Everything travels over TLS. Keys are bearer credentials, stored hashed and revocable from the application at any time. Projects are isolated, so one customer's data is not readable from another's project. Access to production data is limited to staff who need it, and logged. Report a vulnerability to security@mentionlab.io; we will acknowledge it and will not pursue good-faith research.
10. Changes and contact
We will update this policy as the service changes, and tell account holders about material changes by email before they take effect. The effective date at the top identifies the current version. The service is for businesses and is not directed at children.
Privacy and data rights: legal@mentionlab.io. Data Protection Officer: pierre@mentionlab.io. Security: security@mentionlab.io. Post: MentionLab SRL, Rue Blanche-Eau 15, 6950 Nassogne, Belgium.