Privacy Policy
Last updated
This policy explains how MentionReach handles personal data. The data controller is Onur Garip, an individual based in Türkiye, reachable at [email protected]. We follow the Turkish Personal Data Protection Law (KVKK, No. 6698) and, for people in the EU/EEA and UK, the GDPR. We don't sell personal data.
1. What we collect
- Account data: your email address, and your name and profile picture if you sign in with Google.
- Product data you enter: product URLs and profiles, competitors, questions, and the scan results we generate for them.
- Billing data: your purchase history and credit balance. Card details go straight to Polar; we never see or store them.
- Usage data: pages viewed, features used, device and browser type, approximate location from your IP address, and, where enabled, session recordings of how the app is used (form inputs are masked).
- Technical logs: IP address and request logs kept for security and debugging.
2. Why we use it
| Purpose | Legal basis |
|---|---|
| Create your account, sign you in, run scans, send results | Performing our contract with you |
| Process payments and keep accounting records | Contract; legal obligation |
| Service emails (sign-in links, scan results, low balance) | Contract |
| Product analytics to improve the Service | Legitimate interest |
| Security, abuse prevention, debugging | Legitimate interest |
3. Who processes it
We use these providers to run the Service. Each only gets the data it needs:
| Provider | What for | Data |
|---|---|---|
| Hostinger (VPS hosting) | Servers that run the app and database | All Service data |
| Cloudflare | DNS, network protection, content delivery | IP address, request data |
| Resend | Sending emails | Email address, email content |
| Polar | Payments, merchant of record | Email, purchase and payment data |
| PostHog (US) | Product analytics | Usage data, account ID and email |
| OpenAI, Google, Anthropic | Answering scan questions | Questions and product details you enter (no account data) |
| Optional Google sign-in | Sign-in data | |
| Unsplash | Photos on public pages | IP address (images load from their CDN) |
Some providers are outside Türkiye and the EU, mainly in the US. Where required, transfers rely on standard contractual clauses or your explicit consent given when you sign up.
5. How long we keep it
- Account and product data: while your account exists, and deleted within 30 days after you ask us to delete it.
- Billing records: as long as tax and accounting law requires (up to 10 years in Türkiye).
- Analytics data: up to 12 months. Server logs: up to 30 days.
6. Your rights
You can ask to access, correct, delete or export your data, object to or restrict processing based on legitimate interest, and withdraw consent. Under KVKK Article 11 you can also ask whether your data is processed, for what purpose, and to whom it was transferred.
Email [email protected] from your account address. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU/EEA, your local data protection authority.
7. Security
Traffic is encrypted with HTTPS, admin access to our servers is limited to a private network, and sign-in uses one-time email links instead of passwords. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
8. Children
The Service isn't meant for anyone under 16, and we don't knowingly collect their data.
9. Changes
We'll update the date above when this policy changes and email you about material changes. See also our Terms of Service.
