Privacy Policy

What we store

• Your email address, for your account and service emails.
• If you join the waitlist: your email address is sent to us by email (via Resend) and kept in our mailbox, not in our database.
• A hash of your password (never the password itself), if you sign up with a password.
• If you sign in with Google or GitHub: your verified email address and that account's ID number, and nothing else from it. The ID keeps your account tied to you if the address later moves. We never see that account's password. We use its access token only during sign-in and don't keep it.
• A hash of each API key (never the key itself) and a short prefix so you can recognise it.
• How many checks you run each month, for plan limits.
• We save only the domain part of what you check (for example gmail.com) and the dates it was first and last checked, to spot new disposable services. We never save the full address or the part before the @.
• Your IP address, held briefly in memory to limit abuse. Our host (Vercel) may also keep it in standard server logs.
• Subscription status from Paddle (plan, status, renewal date). We do not receive or store card details.

Why we use it

Younes Outerbah is the data controller. We process your data to provide the service you signed up for (our contract with you) and for our legitimate interest in keeping the service secure and free of abuse.

To run the service you asked for, handle your subscription, keep the API from being abused, and keep the service secure. We do not use your data for advertising.

Who processes it

We use these service providers, each only for the purpose listed:

• Paddle.com: payments, billing, VAT and invoices. Paddle is the Merchant of Record for all orders and processes your payment details under its own privacy policy.
• Resend: sending service emails, and forwarding waitlist sign-ups to our mailbox.
• DNS resolvers: to check a domain we look up its public DNS records; the domain name (not the full address) is sent in that lookup.
• Vercel and Neon: hosting the website, application and database.
• Google and GitHub: sign-in, if you choose it, under their own privacy policies.

Some providers may process data outside your country, under their own safeguards.

We don't sell your data

We do not sell, rent or trade personal data, and we do not share it beyond the providers above, except where the law requires it.

Cookies

We use essential cookies: a session cookie that keeps you logged in, a non-secret flag cookie that tells our pages you are logged in, and, if you sign in with Google or GitHub, a cookie lasting up to 10 minutes that protects that sign-in. We do not use advertising cookies. Paddle sets its own cookies during checkout.

To see how the site is used we use Vercel Web Analytics, which uses no cookies and does not identify you.

How long we keep it

We keep account data while your account is open, and monthly usage counts for billing history. Waitlist emails stay in our mailbox until launch or until you ask us to delete them. Paddle keeps billing records as the law requires.

Your rights and deletion

Email hello@mentioned.click from the address on your account to get a copy of your data, correct it, or have your account and keys deleted. We reply within 30 days. You can also complain to your local data protection authority. Deleting your account does not delete records Paddle must keep for tax purposes.

Changes

We may update this policy. The date at the top shows the latest version; for material changes we will tell account holders by email.