Privacy Policy

This Privacy Policy explains how Ment Tech Labs Private Limited ("Ment Labs", "we", "us" or "our") collects, uses, shares and protects personal data when you use Social Agent by Ment Labs, the first agent on our Agents Hub platform (the "Service"). The Service runs at app.ment.tech, with supporting services at api.ment.tech, admin.ment.tech (our staff only) and media.ment.tech. Our marketing site is www.ment.tech.

Ment Tech Labs Private Limited is a company incorporated in India (CIN U62099MP2023PTC064895, GSTIN 23AAQCM6541F1ZE) with its registered office at 8 Sarswati Nagar, Annapurna Road, Indore CGO Complex, Indore, Madhya Pradesh 452001, India.

If you do not agree with this policy, please do not use the Service.

1. Who This Policy Covers

This policy applies to:

• Account holders: people who sign up for the Service and the workspaces they create.
• Workspace members: people invited into a workspace by its owner (on plans with more than one seat).
• Visitors: people who visit app.ment.tech without an account, for example to read our home page or this page.

It does not cover the social media platforms you connect (Meta, LinkedIn, X), AI providers you bring your own key for, or websites you link to from your posts. Each of those has its own privacy policy.

Where a business customer uses the Service to process personal data of its own customers (for example, names in uploaded testimonials), the business customer is the data controller or data fiduciary for that data and we act as its processor. Our Data Processing Addendum at app.ment.tech/legal/dpa governs that relationship.

2. What We Collect

2.1 Account and Profile Data

• Name, email address and profile picture (from Google when you sign in with Google), plus a phone number if you add one to your profile.
• Locale, time zone and notification preferences.
• Workspace name, country, currency, brand logo, brand colours and, for Indian customers who choose to give them, GSTIN, billing name and billing address for tax invoices.
• Your role in each workspace.
• Sign-in records: sign-in method, session identifiers and one-time sign-in links (stored only as a hash and deleted after use or expiry), and a record that you accepted these terms, with the date, the document versions and your IP address.

2.2 Business Sources You Upload (The Brand Brain)

To teach the agent about your business you can give us website URLs, PDFs, Word documents, plain text and your past social posts. We store the files and pages you provide, split them into text chunks, and create vector embeddings of those chunks so the agent can find relevant facts when it writes. We also derive a Brand Profile (offerings, audience, tone, key messages, proof points, calls to action, links) that you can edit.

Uploaded files are private. They are stored in private object storage, are never given a public link, and can only be opened through the Service by members of your workspace.

Please upload only material you have the right to share. If your sources contain personal data about other people (for example customer testimonials with names), you are responsible for having a lawful basis to use it.

2.3 Social Account Tokens and Connection Data

When you connect a social account we receive and store, for each connected page or profile:

• An OAuth access token and, where the platform issues one, a refresh token. Tokens are encrypted with AES-256-GCM before storage and are never shown in the browser or written to logs.
• The external account ID, display name, username, profile picture URL, token expiry and the scopes you granted.
• For Facebook and Instagram, your app-scoped Meta user ID (so we can honour Meta's deletion and deauthorisation requests), the Pages you manage and the Instagram Business or Creator account linked to each Page.
• For LinkedIn, your member profile (name, picture) and, once that feature is available, the organisation pages you administer.
• For X, your user ID, username and profile picture.

2.4 Content the Agent Generates

Research briefs, planned calendar items, post copy and variants, hashtags, alt text, images, carousels, video scripts, voiceover audio and rendered videos, along with the rationale for each post, critic scores, compliance check results, approval history and any edits you make. Post media is stored in Cloudflare R2 and served from media.ment.tech at long, random addresses that are not listed anywhere, because the social platforms and your calendar need to fetch it. Videos cut from your own footage stay private until the post is published (Section 2.10). Videos made with generative or presenter (avatar) models are marked as AI-generated in our records, and we set the platform's AI-content label where the platform offers one.

2.5 Analytics From the Platforms

For posts published through the Service we fetch performance metrics from the platform APIs after publishing. Depending on the platform these include impressions, reach, likes, comments, shares, saves, clicks, video views and follower change. If you choose to import your past posts, we read your recent posts to learn your voice.

For research, the Service reads public information about your niche: web search results, public posts on X that match your niche keywords, upcoming observances, and public posts from accounts you list as competitors or inspiration. These research signals are cached for up to 6 hours and shared between workspaces in the same niche; they contain no data about you. We do not read private messages, friends lists or any account you have not asked us to watch.

2.6 Billing Data

Plan, billing interval, subscription status, invoices and GST tax invoices, credit ledger entries (grants, usage, packs, refunds) and payment status. Card, UPI and bank details are collected and stored by our payment processor (Razorpay for INR). We never see or store full card numbers. We receive a payment reference, a masked identifier and the payment outcome.

2.7 Usage, Device and Log Data

IP address, browser and device type, pages and actions in the product (for example "campaign started", "post approved"), credits used per action, errors and performance timings. We record these in our own database and server logs, and send error reports to Sentry. We do not use a third-party product analytics service inside the app.

2.8 Marketing Measurement on Our Home Page

Our home page at app.ment.tech can use Google Analytics, Google Ads and the Meta Pixel to measure our own advertising. These load only after you accept them in the cookie banner. When you arrive from an ad, the page also stores the campaign tags and ad click identifiers in a first-party cookie so that, if you sign up, we can tell which campaign brought you. See the Cookie Policy for details.

2.9 Communications and Sign-Up Forms

Emails you send to support@ment.tech or our other addresses, messages you send to Aura, the in-product assistant, and the email address you give us when you join a waitlist for an agent that is coming soon or ask us to contact you from our home page.

2.10 Footage and Recordings You Upload (The Library)

You can upload your own video recordings to the Library, from your device or from Google Drive. For each recording we store the original file and create files we need to work with it: a smaller preview, the audio track, thumbnails and still frames, a transcript with the time of each word, a short summary, tags and the positions of faces and the main subject in the frame. We use these to suggest short clips, to frame them for vertical video, to write captions, and to let the agent know what footage you have. A summary of each recording and its transcript are added to your Brand Brain search index; transcripts are not used to write other posts unless you use that recording.

• Private storage. Recordings, their derived files and clips cut from them are stored in private object storage, never given a public link, and shown only to members of your workspace through short-lived links. A clip becomes public post media only when it is published.
• Transcription and analysis. The audio track is sent to OpenAI or ElevenLabs to make the transcript, and still frames and the transcript are sent to Anthropic to write the summary and tags (Section 5.2). If you added your own OpenAI or ElevenLabs key, that provider transcribes under your own agreement with it.
• Faces. We detect where faces are in the picture so the video can be framed around the speaker. We store only the position of each face (a box and a track number within that recording). We do not store facial landmarks or face templates, we do not compare faces between recordings, and we never identify or recognise who a person is.
• People in your footage. If your recordings show or record other people, such as customers giving a testimonial, you are responsible for having their permission. Before a recording marked as a testimonial can be used, an owner or admin of your workspace must confirm consent and note where the release is kept. We record who confirmed it and when. If you withdraw consent, we stop every new and scheduled use of that recording and delete unpublished clips made from it; posts already published stay on the platforms until you remove them, and we list them for you.
• Watermarks. We check recordings for watermarks from other apps and stock sites. A platform mark on a video you confirm is your own may be removed when we cut it, and we tell you when we do. A stock-site or other company's mark is never removed, and that recording is not used in posts.
• Google Drive. If you import from Google Drive, you pick the files in Google's own picker and we receive access only to those files (the drive.file permission). We use the access once to copy the files you picked, store it encrypted only for the import, and delete it when the import ends. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Voice. We never copy anyone's voice from your recordings. If voice cloning is offered on your plan, it is only for the workspace owner's own voice: the owner records a spoken consent statement and a sample in Settings, both are stored privately, and ElevenLabs creates the voice. The owner can turn it off at any time, which deletes the voice at ElevenLabs.

2.11 Data We Do Not Collect

We do not collect government identification numbers or full payment card numbers, and we do not knowingly collect data about children. We do not create biometric identifiers: face detection in your recordings finds where a face is, never who it is (Section 2.10). We never ask for or store your social media passwords.

3. How We Use Data

• Create and secure your account, sign you in

  Data used

  Account, sign-in records

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent and specified purpose

• Build and maintain your Brand Brain

  Data used

  Business sources, embeddings

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent

• Connect to your social accounts and keep tokens fresh

  Data used

  Tokens and connection data

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent

• Research trends and plan your calendar

  Data used

  Brand Brain, public research signals, your analytics

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent

• Generate copy, images and video

  Data used

  Brand Brain, campaign settings, performance history

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent

• Analyse your recordings, suggest clips and edit them

  Data used

  Library recordings, transcripts, face positions

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent

• Publish posts to the accounts and times you chose

  Data used

  Generated content, tokens

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent

• Measure performance and improve the next plan

  Data used

  Platform analytics

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Consent

• Bill you, issue tax invoices, handle refunds

  Data used

  Billing data

  Legal basis (GDPR)

  Contract, legal obligation

  Basis (India DPDP Act 2023)

  Specified purpose, legal obligation

• Send service email (sign-in links, approvals, failures, digests, billing)

  Data used

  Account, generated content

  Legal basis (GDPR)

  Contract

  Basis (India DPDP Act 2023)

  Specified purpose

• Send product news (you can opt out)

  Data used

  Account

  Legal basis (GDPR)

  Legitimate interest, consent where required

  Basis (India DPDP Act 2023)

  Consent

• Keep the Service reliable and secure, prevent abuse

  Data used

  Usage, device and log data

  Legal basis (GDPR)

  Legitimate interest

  Basis (India DPDP Act 2023)

  Legitimate use

• Measure our own advertising

  Data used

  Home page cookies, sign-up attribution

  Legal basis (GDPR)

  Consent

  Basis (India DPDP Act 2023)

  Consent

• Comply with law and answer lawful requests

  Data used

  Any

  Legal basis (GDPR)

  Legal obligation

  Basis (India DPDP Act 2023)

  Legal obligation

We do not sell personal data. We do not use your Brand Brain, your generated posts or your platform analytics to train our own or anyone else's machine learning models.

4. Automated Decision Making and AI

The Service is an AI autopilot. In autopilot mode, software decides what to post, when and where, within the goals, schedule, content mix and topic rules you set. You can switch any campaign to approve-before-posting mode, edit or reject any post, pause any campaign, and see the rationale behind every post. No decision the Service makes has legal or similarly significant effects on you or your audience; it produces marketing content for your own accounts.

AI output can be wrong, out of date or inappropriate. You remain responsible for everything published to your accounts. See the Terms of Service for the full AI output disclaimer.

5. Service Providers and Subprocessors

We use the following providers to run the Service. Each is bound by contract to process data only on our instructions and to protect it. Business customers under our DPA receive notice of material changes.

5.1 Hosting and Infrastructure

• Contabo GmbH

  What it does

  Virtual private server that runs the app, API, background workers, PostgreSQL database and Redis

  Data it receives

  All Service data

  Location

  Asia (Singapore)

• Cloudflare, Inc.

  What it does

  DNS, network protection and the R2 object storage behind media.ment.tech; also holds our encrypted nightly database backups

  Data it receives

  Request metadata; post media, private uploaded files, data exports and backups

  Location

  Global network; R2 storage in Asia-Pacific

• Resend (Plus Five Five, Inc.)

  What it does

  Sending service email

  Data it receives

  Your email address and the email content

  Location

  United States

• Functional Software, Inc. (Sentry)

  What it does

  Error monitoring

  Data it receives

  Error details, request metadata and user ID, with tokens and secrets removed

  Location

  United States

5.2 AI and Content Generation

By default the Service uses Ment Labs' own accounts with these providers (pooled keys), metered as credits on your plan.

• Anthropic, PBC

  What it does

  Research, planning, copywriting, critic and compliance checks, Aura chat, describing your Library recordings

  Data it receives

  Brand Brain excerpts, campaign settings, research results, drafts, your Aura messages, still frames and transcripts of your recordings

  Location

  United States

• OpenAI, L.L.C.

  What it does

  Embeddings for Brand Brain search, image generation, transcribing your recordings

  Data it receives

  Text chunks for embedding, image prompts, the audio track of your recordings

  Location

  United States

• Google LLC (Gemini API)

  What it does

  Image generation, some text generation, generative video (Gemini Omni)

  Data it receives

  Prompts derived from your brand and topic, and for video a visual prompt and, when used, a still image you own

  Location

  United States

• Tavily

  What it does

  Web search for the research step

  Data it receives

  Niche keywords and topics, no personal data

  Location

  United States

• Pexels

  What it does

  Stock video clips

  Data it receives

  Search keywords, no personal data

  Location

  Germany

• ElevenLabs, Inc.

  What it does

  Voiceover for videos, transcribing your recordings

  Data it receives

  Video script text and voice choice, the audio track of your recordings, and, only if the owner turns on voice cloning, the owner's voice sample

  Location

  United States

• fal (Features and Labels, Inc.)

  What it does

  Generative video with other models (such as MiniMax), when Google is unavailable

  Data it receives

  Visual prompt and, when used, a still image you own

  Location

  United States

• Runway AI, Inc.

  What it does

  Generative video, on plans that include it

  Data it receives

  Script, visual prompt and, when used, a still image you own

  Location

  United States

• Luma AI, Inc.

  What it does

  Generative video, on plans that include it

  Data it receives

  Script and visual prompt for the clip

  Location

  United States

• HeyGen

  What it does

  Avatar video, on plans that include it

  Data it receives

  Script, avatar and voice choice

  Location

  United States

Each provider's API terms say that API inputs and outputs are not used to train its models by default, except Runway and HeyGen, whose standard terms let them use inputs and outputs to improve their services; we send them only what each clip needs. We ask fal not to store request data. Luma and HeyGen are used on our accounts only after they confirm in writing that we may offer them to you.

Bring your own key. Your own keys are optional. In Settings, Integrations you can add your own API key for Anthropic, OpenAI, Google Gemini or Replicate, and in Settings, Video Providers for Runway, Luma, Google, HeyGen, Kling, Pika (through fal), ElevenLabs or Pexels. A working key is used for your workspace instead of ours, and that provider processes your prompts and media under your own agreement with it. Calls on your key are not metered as the provider's usage; small platform fees in credits still apply to video renders and to analysing recordings, as shown in the product. Your key is encrypted with AES-256-GCM, shown only masked, and used only for your workspace.

5.3 Payments

• Razorpay Software Private Limited

  What it does

  Subscriptions, UPI, cards, net banking and mandates in INR

  Data it receives

  Name, email, phone, billing details; payment instrument details are handled only by Razorpay

  Location

  India

Prices in other currencies, paid through Stripe, are not available yet. If we enable them we will add Stripe to this list first.

5.4 Advertising Measurement (With Your Consent Only)

• Google LLC (Google Analytics, Google Ads)

  What it does

  Measures visits and ad conversions on our home page

  Data it receives

  Cookie identifiers, pages viewed, ad click identifiers

• Meta Platforms Ireland Ltd (Meta Pixel and Conversions API)

  What it does

  Measures our Facebook and Instagram ads

  Data it receives

  Cookie identifiers and page events; when you sign up, start a trial or pay, a hashed email address, a hashed user ID, the ad click identifier, IP address and browser type

These providers act as independent controllers for their own advertising services.

5.5 Social Platforms

Meta Platforms (Facebook, Instagram), LinkedIn and X are not our subprocessors. They are independent controllers of the data in your accounts on their platforms. We send them the posts you publish and read back the data described in Section 2.

6. Data From Meta Platforms

This section describes how we handle data obtained through Meta's platforms (Facebook Login for Business, the Facebook Pages API and the Instagram Graph API) and is written to meet Meta's Platform Terms and Developer Policies.

What we access and why. We request only the permissions needed for the features you use:

• pages_show_list: to list the Facebook Pages you manage so you can pick which to connect.
• pages_read_engagement: to read your Page's posts and engagement so the agent can learn your voice and measure performance.
• pages_manage_posts: to publish posts to the Pages you connected, the Service's core function.
• publish_video: to publish videos to the Pages you connected.
• read_insights: to read Page and post insights (impressions, reach, engagement) for the analytics screen and the planner.
• instagram_basic: to identify the Instagram Business or Creator account linked to your Page and read its profile and media.
• instagram_content_publish: to publish images, carousels and reels to your connected Instagram account.
• instagram_manage_insights: to read media and account insights for analytics and planning.
• business_management: to find Pages and Instagram accounts held in a Business Portfolio you manage.

How we use Meta data. Only to provide the Service to you: showing you your Pages and accounts, publishing content you or your autopilot created, and reporting on how that content performed. We do not use Meta data for advertising, for building or augmenting user profiles, for selling or licensing to anyone, for training AI models, or for any purpose unrelated to the feature you enabled.

How we store it. Access tokens are encrypted with AES-256-GCM and stored in our database, hosted as described in Section 5.1. Page and Instagram identifiers, names, profile pictures, post IDs, permalinks and insight numbers are stored alongside your workspace. Nothing from Meta is shared with any third party except our hosting providers in Section 5.1, and the AI providers in Section 5.2, which receive short excerpts of your past posts only when you choose to import them so the agent can match your voice.

Retention and deletion. Meta data is kept while the connection is active. When you disconnect a Page or account on the Connections page, we delete its tokens immediately; the posts you published and their metrics stay in your workspace history until you delete the workspace. When Meta tells us you removed the app, or sends a data deletion request, we immediately delete the tokens, profile details and insights we hold for every connection linked to your Meta user ID, and give you a confirmation code you can check at app.ment.tech/legal/data-deletion. When you delete your workspace, its tokens are deleted at once and everything else after the 30 day grace period in Section 9.

Your controls on Meta's side. You can remove the Service's access at any time in Facebook or Instagram settings under Apps and Websites. We then stop all activity on that account and delete the data as above.

Compliance. We comply with Meta's Platform Terms, Developer Policies and the Instagram Platform Policy. We do not circumvent rate limits, scrape, or access any data that you have not granted through the official sign-in flow.

7. Data From LinkedIn

We use LinkedIn's APIs under the LinkedIn API Terms of Use. To post to your profile we request openid, profile, email and w_member_social. Posting to Company Pages you administer uses LinkedIn's Community Management API, which requests w_organization_social, r_organization_social and r_organization_admin; this becomes available once LinkedIn approves our application. We store your member ID, name, picture and the organisation IDs you connect, plus post IDs and metrics for posts we published. We do not use LinkedIn data to build profiles of members, and we delete it on workspace deletion as in Section 9. You can revoke our access at any time in your LinkedIn settings under Data privacy, Permitted services.

8. Data From X

We use the X API v2 under the X Developer Agreement and Policy. We request tweet.read, tweet.write, users.read, offline.access and media.write. We store your user ID, username, profile picture, encrypted tokens, the IDs of posts we published and their public metrics. For research we may read public posts matching your niche keywords; these are cached for up to 6 hours and not linked to you. You can revoke our access in X settings under Security and account access, Connected apps.

9. Retention and Deletion

• Account and workspace data

  How long we keep it

  While your account or workspace exists. When you ask to delete it, we wait 30 days so you can change your mind, then delete it permanently.

• Social tokens

  How long we keep it

  Until you disconnect the account, the platform revokes access, or you ask to delete the workspace. They are deleted at once in each case.

• Brand sources, chunks and embeddings

  How long we keep it

  Until you remove the source or delete the workspace. Removing a source deletes its text and search index at once; uploaded files are deleted with the workspace.

• Generated content, media and platform analytics

  How long we keep it

  While the workspace exists.

• Library recordings, their derived files, transcripts and clips

  How long we keep it

  Until you delete the recording or the workspace. Deleting a recording removes it from your Library at once and deletes its files, transcript and search index, and stops any scheduled post that uses it.

• Consent and rights confirmations for recordings

  How long we keep it

  While the recording exists, then as long as we need them to show we met our obligations.

• Google Drive access for an import

  How long we keep it

  Only until that import ends.

• Research signals

  How long we keep it

  Up to 6 hours.

• Workspace data exports

  How long we keep it

  The download link works for 24 hours; the file is deleted within 2 days.

• Error reports (Sentry)

  How long we keep it

  Up to 90 days.

• Server logs

  How long we keep it

  Up to 30 days.

• Billing records and tax invoices

  How long we keep it

  8 years, as Indian tax and company law requires, even after the workspace is deleted. They contain your billing name, address, email and GSTIN, and no social platform data.

• Records of consent and of data requests

  How long we keep it

  As long as we need them to show we met our obligations. They hold no content, and a Meta deletion record holds only a keyed hash of your Meta user ID.

• Backups

  How long we keep it

  Nightly database backups are kept for 30 days, so deleted data can remain in a backup for up to 30 days after it is deleted.

You can delete your workspace in Settings, Danger Zone and your account in Settings, Privacy, or email privacy@ment.tech. See the Data Deletion page at app.ment.tech/legal/data-deletion for every option.

10. Your Rights

10.1 If You Are in the EEA, the UK or Switzerland (GDPR and UK GDPR)

You have the right to access your personal data, to rectify it, to erase it, to restrict or object to processing, to data portability, and to withdraw consent at any time where processing is based on consent. You also have the right to complain to your local supervisory authority. Ment Tech Labs Private Limited is the controller. We have not appointed an EU or UK representative at this time; contact privacy@ment.tech and we will respond within one month.

10.2 If You Are in India (Digital Personal Data Protection Act, 2023)

Ment Tech Labs Private Limited is the data fiduciary. You have the right to a summary of the personal data we process and of the processing, the right to correction, completion, updating and erasure, the right to grievance redressal, and the right to nominate another person to exercise your rights if you are unable to. You may withdraw consent at any time; this does not affect processing before the withdrawal, and features that need the data will stop working. To exercise these rights, write to our Grievance Officer with "DPDP request" in the subject. We respond within 30 days. If you are not satisfied with our response you may approach the Data Protection Board of India.

Grievance Officer: Ujjwal Sahay, Managing Director, Ment Tech Labs Private Limited, 8 Sarswati Nagar, Annapurna Road, Indore CGO Complex, Indore, Madhya Pradesh 452001, India. Email: privacy@ment.tech. Phone: +91-7479866444.

10.3 Everyone Else

Wherever you are, you can download, correct and delete your data in the product or by emailing privacy@ment.tech. In Settings, Privacy you can download your personal data at once and, as a workspace owner or admin, prepare a full workspace export. The export includes the details, transcripts and consent records of your Library recordings; you can download the original files from the Library.

10.4 How to Exercise Your Rights

Email privacy@ment.tech from the address on your account, or use the in-product controls. We may ask you to verify your identity. We do not charge for requests unless they are manifestly unfounded or excessive. Workspace members should send requests about data held in a business customer's workspace to that customer; we help the customer as its processor.

11. International Transfers

We are based in India. Our main servers are run by Contabo in Asia (Singapore), and our file storage and backups are in Cloudflare R2 in the Asia-Pacific region. Our other providers operate mainly in the United States, the European Union and India. Where personal data of EEA, UK or Swiss residents is transferred outside those territories, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with each provider, together with the provider's own safeguards. Where personal data of Indian residents is transferred outside India, we do so in line with the DPDP Act and any restrictions notified by the Central Government.

12. Security

All traffic to the Service uses TLS. OAuth tokens, bring-your-own API keys and other secrets are encrypted with AES-256-GCM using a key held outside the database. Files and backups in Cloudflare R2 are encrypted at rest by Cloudflare. Every workspace's data is scoped by workspace ID and enforced in the data layer. Brand documents, Library recordings, unpublished clips and data exports are private and only reachable through the Service after a membership check. Upload links for recordings can only write, never read, and expire after one hour. Staff viewing a workspace cannot confirm consent, add keys or change recordings. Our staff panel requires two-step verification, and staff access to a customer workspace is logged. Webhook signatures are verified, and sign-in attempts are rate limited.

No system is perfectly secure. If we learn of a breach that affects your personal data we will notify you and, where required, the relevant authority without undue delay, within 72 hours where the GDPR applies, and as required by the DPDP Act and its rules in India.

13. Children

The Service is for businesses and professionals and is not directed to children. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email privacy@ment.tech and we will delete it.

14. Cookies

We use a small number of strictly necessary cookies (sign-in, security, your cookie choices) and, only with your consent, analytics and advertising cookies on our home page. The Cookie Policy at app.ment.tech/legal/cookies lists each one.

15. Marketing Communications

We send service email as part of the Service (sign-in links, approval requests, publishing failures, weekly digests, billing notices). We may also send product news; each such email has an unsubscribe link, and you can turn it off in Settings, Notifications. Opting out does not stop service email.

16. Third Party Links

Posts the agent creates may include links to your own website or to sources it found. We are not responsible for the privacy practices of other sites.

17. Changes to This Policy

We may update this policy as the product and the law change. We will post the new version at app.ment.tech/legal/privacy with a new date and, for material changes, notify account holders by email or in the product at least 14 days before the change takes effect. When the change needs your agreement, we ask for it again at sign-in.

18. Contact

• Privacy requests and grievances: privacy@ment.tech
• Privacy questions and general enquiries: contact@ment.tech
• Support: support@ment.tech
• Post: Ment Tech Labs Private Limited, 8 Sarswati Nagar, Annapurna Road, Indore CGO Complex, Indore, Madhya Pradesh 452001, India

Related documents: Terms of Service (app.ment.tech/legal/terms), Refund and Cancellation Policy (app.ment.tech/legal/refunds), Cookie Policy (app.ment.tech/legal/cookies), Data Deletion (app.ment.tech/legal/data-deletion), Data Processing Addendum (app.ment.tech/legal/dpa).