MencionIABack to home

This is an English translation of our Spanish legal texts. If they differ, the Spanish version prevails.

Privacy Policy

Last updated: October 2026.

Data controller

Antonio Samuel Martín Polo (Autonomio), NIF 50555557Q, Spain. Contact: hola@mencionia.es.

What data we process and why

  • Your email and your brand's data (name, sector, website, competitors) that you enter in the form, to generate your visibility report and send it to you.
  • Business contact details, if you write to us, to reply to you and, where applicable, offer you the paid plans.

Google data (Google Ads)

If you connect your Google Ads account from your profile, MencionIA accesses it with your permission, granted on Google's own consent screen.

  • What I read. The list of Google Ads accounts you have access to, and their campaign metrics: impressions, clicks, cost and conversions. Read-only: I never create, change or delete campaigns, ads or budgets.
  • What for. To show them to you, in MencionIA and in the AI assistant (Claude, ChatGPT or another) that you connect with your personal MCP token. They are only sent to that assistant when you ask it to.
  • What I store. Only the access permission (the Google token), encrypted, plus the connection date and the last-used date. Your campaign data is not stored: it is queried live and returned to you.
  • Who I share it with. Only the AI assistant you connect, and only when you ask it; from there that assistant (Anthropic, OpenAI or another) handles it under its own terms, which you choose. It also passes through the providers that run MencionIA (Vercel, which hosts it, and Supabase, where the encrypted token is stored), who process it only for that. I don't sell this data, don't use it for advertising or to train AI models, don't pass it to any other AI model, and don't mix it with other users' data.
  • How I protect it. Everything travels encrypted (HTTPS). The token is stored encrypted with AES-256-GCM, and the key is kept separately from the database. No browser can read the table it lives in: only MencionIA's server, and only for the account it belongs to. Your campaign data is never written to any log.
  • How long I keep it and how to remove it. The token is kept while the connection is active. Clicking «Disconnect» in your profile deletes it immediately. You can also revoke the permission at myaccount.google.com/permissions; if you do, I delete the token the next time I try to use it. If you ask me to delete your account, the token is deleted with it.

MencionIA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta data (Meta Ads: Facebook and Instagram)

If you connect your Meta Ads account from your profile, MencionIA accesses it with your permission, granted on Meta's own login screen.

  • What I read. Your Meta name and user id; the ad accounts you have access to (name, status, currency and time zone); their campaigns, ad sets and ads (name, status, budget and bid strategy); and their metrics: spend, impressions, reach, clicks, CTR, CPC, CPM, actions, cost per action and purchase return on ad spend.
  • What I can change, and only if you confirm it. Pause or resume a campaign, ad set or ad, and change the daily or lifetime budget of a campaign or ad set, by at most double or half in each step. Every change is first proposed with a summary and is only applied when you explicitly say yes. The confirmation expires after 10 minutes, works only once, and is refused if the value changed in Meta in the meantime. I never create, edit or delete anything else: no ads, copy, audiences, bids or payment methods.
  • What for. To show it to you, in your dashboard and in the AI assistant (Claude, ChatGPT or another) that you connect with your personal MCP token, and to apply the changes you confirm. It is only sent to that assistant when you ask it to.
  • What I store. The access permission (the Meta token), encrypted; your Meta id and name; how many ad accounts you had when connecting and which one is the main one; the connection, last-used and permission expiry dates; and a log of every applied change (what changed, previous and new value, date and result). Your campaign metrics are not stored: they are queried live.
  • Who I share it with. Only the AI assistant you connect, and only when you ask it, and the providers that run MencionIA (Vercel, which hosts it, and Supabase, where the encrypted token and the change log are stored). I don't sell this data, don't use it for advertising or to train AI models, don't pass it to any other AI model, and don't mix it with other users' data.
  • How I protect it. Everything travels encrypted (HTTPS). The token is stored encrypted with AES-256-GCM, and the key is kept separately from the database. No browser can read the tables holding the token and the log: only MencionIA's server, and only for the account they belong to. Every call to Meta is also signed with the app secret.
  • How long I keep it and how to remove it. The token is kept while the connection is active, and Meta expires it after roughly 60 days. Clicking «Disconnect» in your profile deletes the token immediately and also removes the permission in Meta. If you remove MencionIA from your Facebook account (Settings & privacy, Settings, Business integrations), Meta notifies me and I delete the token. If you request deletion of your data from there, Meta sends me the request and I immediately delete the token, your Meta id and the change log; you get a confirmation code and a page to check it. If you ask me to delete your account, everything is deleted with it.

If I emailed you without you asking

I measure which companies AI assistants name in each industry and sometimes email companies in that industry to show them the result. If you got an email like that, this is what I do with your data.

  • What I hold. The work email address, the company's name, website, city and industry; and your name, if the database had it. Nothing else.
  • Where it comes from. Business contact databases, or your business's public website, which I reach through Google Maps. The email you got says which. You did not give it to me.
  • What for. To send you a single email with the measurement for your industry. No more emails unless you reply.
  • Legal basis. Legitimate interest (GDPR Art. 6(1)(f)): letting a company know a fact about its industry, using business contact details only.
  • Who I share it with. The providers that make the sending work: Google (the mailbox I write from), Supabase (where the list is stored) and Vercel (where the program runs). I don't sell it or pass it on.
  • How long I keep it. Until you object or unsubscribe. From then on I don't write again, I delete your name and keep only your address on a suppression list, which is what lets me not do it. If you want that deleted too, ask me.
  • How to object. With the "Unsubscribe" button in that email or by replying to it. You don't need to give a reason. You can also complain to the Spanish Data Protection Agency (aepd.es).

Legal basis

To produce your report and send it to you, the basis is handling the request you make when you submit the form (art. 6(1)(b) GDPR). For the news emails, your consent, which is optional (art. 6(1)(a) GDPR).

News about AI search and unsubscribing

If you tick the checkbox, besides the report I'll send you news about visibility in AI search engines (GEO). It's voluntary and separate: you get the report either way. You can unsubscribe at any time using the link in every email, or by writing to me. When you unsubscribe I stop sending you communications and keep your email on a suppression list so I don't contact you again.

Retention

I keep your data for as long as needed to provide the service and meet legal obligations. You can request its deletion at any time.

Processors and transfers

I use these providers: Vercel (hosting and visit analytics), Supabase (database and account sign-in), Resend (email), Stripe (payments) and OpenRouter, the gateway that sends each report's questions to OpenAI, Google, Perplexity and Anthropic. Only the brand details (name, website, category and competitors) reach the models, never your email. If you connect your ad accounts, also Google (Google Ads) and Meta Platforms (Meta Ads), which is where I read that data from and, in Meta, where I apply the changes you confirm. Some of these providers process data outside the European Economic Area; I work with providers that offer adequate guarantees under the GDPR, such as standard contractual clauses.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@mencionia.es. You can also file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es), which is the competent authority under Spanish and EU law regardless of where you access MencionIA from.