Data processing terms

These terms form part of the agreement and apply wherever we process personal data in connection with the service. "Customer" means you. "Mentioned" means Mentioned Ltd.

1. Who controls what

This is the part that differs from most software of this kind.

Data	Controller	Mentioned's role
Your account, your users, your brand profile	Mentioned	Controller. We decide what to collect to run the service.
The contact corpus: journalists, publications, addresses	Mentioned	Controller. We gathered it, we decide what is in it, and it is shared across customers.
Who you choose to contact, and what is sent under your name	Customer	Processor, acting on your instruction to send.
Replies that arrive in your mailbox	Customer	Processor. We forward them to you and store them so the thread makes sense.

We are candid about the second row because it matters. The corpus is not your list held on your behalf: it is ours, assembled from published sources, used across every customer. Requests from the people in it come to us and we answer them directly, at this page, without asking you.

2. Where Mentioned is your processor

In that role we will:

• process personal data only on your documented instructions, which include your use of the product;
• make sure anyone with access is bound by confidentiality;
• keep appropriate technical and organisational measures, described in section 5;
• not engage a sub-processor without the notice in section 4;
• help you respond to a data subject's request, and with your own assessments, so far as we reasonably can;
• tell you without undue delay if we become aware of a personal data breach affecting your data;
• delete or return the data at the end of the agreement, except where we must keep it;
• make available the information needed to show we have done all of this, and allow an audit no more than once a year on reasonable notice, or sooner after a breach.

3. Your obligations

You confirm you have a lawful basis for contacting the people you choose to contact, and that your instructions do not require us to break the law. Where you connect a mailbox, you confirm you are entitled to send from it.

4. Sub-processors

You agree to these, and we will give thirty days' notice before adding another:

Sub-processor	Purpose	Location
Anthropic PBC	Reading pages, drafting pitches	US
Snov.io	Business contact lookup	US
Resend	Transactional email	US
Stripe	Payments	US, Ireland
Hosting and database provider	Running the service	EU or UK

If you reasonably object to a new sub-processor, tell us within the notice period and we will either find another route or let you cancel without penalty.

5. Security

• Encryption in transit everywhere, and at rest for stored data.
• OAuth tokens for your mailbox stored encrypted and used only to send.
• Access limited to those who need it, with individual accounts.
• Sending defaults to disabled, and the mail transport has to be enabled deliberately in each environment, so a bug cannot send mail from an environment that was never meant to.
• Backups, with restoration tested.

6. International transfers

Where a sub-processor is outside the UK, transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision.

7. Duration

These terms last as long as we process personal data for you. Sections on confidentiality and liability survive.

If your procurement process needs this signed on paper, email privacy@mentioned.ai and we will sign it.