Privacy Policy
Effective date: 4 August 2026
1. Who We Are
Mentra ("the Service") is a content intelligence platform operated by WEDDEsign, a Norwegian sole proprietorship (org.nr 935 153 603), with its registered address at Skjæret 29, 1390 Vollen, Norway ("we", "us", "the Controller").
As the data controller, we are responsible for deciding how your personal data is collected, used, and protected in compliance with the EU General Data Protection Regulation (GDPR) and Norwegian data protection law.
2. What Data We Collect
2.1 Account Data
When you create an account, we collect:
- Email address
- Display name
- Authentication tokens (managed by Firebase Authentication)
2.2 Billing Data
When you subscribe to a paid plan, Stripe (our payment processor) collects:
- Payment card details (processed and stored exclusively by Stripe)
- Billing address
- Subscription history
We do not store your payment card information. We only store a Stripe customer ID and subscription status.
2.3 Content Data
Content you create, upload, or generate through the Service is stored in our database (Google Firestore) and associated with your workspace (tenant).
2.4 AI Interaction Data
When you use AI features, we process:
- The prompts and instructions you provide
- The content context sent to AI models for generation
- Generated outputs (text, images, video)
AI requests are processed by third-party AI providers (currently OpenAI and Anthropic). We send only the minimum context necessary for content generation. We do not send your personal data (name, email, billing info) to AI providers.
2.5 Usage Data
We collect basic usage metrics including:
- AI credit consumption
- Feature usage counts
- Login timestamps
2.6 Analytics Data (consent-based)
If — and only if — you accept analytics cookies, we use PostHog (EU-hosted) to understand how the site and product are used. This covers:
- Pages visited, referring site, browser and device type, and your IP address (used to derive approximate country/region)
- Which elements you click and how you move between pages. We record that a click happened and where, never the text on screen — that is stripped before anything leaves your browser.
- For signed-in users: your user ID, email address and display name, so we can tell whether a problem affects one account or everyone
We do not record your screen. Mentra does not use session replay or any other screen recording, anywhere in the Service — so your drafts, strategy and other content are never captured.
We do not use advertising cookies, and we do not sell or share this data with advertisers. Declining analytics has no effect on how the Service works. You can change your mind at any time using the controls in section 8 below — you stay signed in and nothing else about your account is affected.
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing and operating the Service | Contract performance (Art. 6(1)(b)) |
| Processing payments | Contract performance (Art. 6(1)(b)) |
| AI content generation | Contract performance (Art. 6(1)(b)) |
| Service improvement & debugging | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
| Service notifications | Legitimate interest (Art. 6(1)(f)) |
| Product & website analytics | Consent (Art. 6(1)(a)) — asked before any analytics cookie is set |
4. Third-Party Processors
We use the following third-party services to operate Mentra:
| Service | Purpose | Data Shared |
|---|---|---|
| Google Firebase (Auth & Firestore) | Authentication, database | Email, display name, content |
| Stripe | Payment processing | Billing details, subscription data |
| OpenAI | AI text & image generation | Content context, prompts |
| Anthropic | AI text generation | Content context, prompts |
| Replicate | AI video generation | Content context, prompts |
| Resend | Transactional email | Email address |
| PostHog (EU Cloud, Germany) | Product & website analytics — only with your consent | Usage events, pages visited, IP address; for signed-in users also user ID, email and display name |
All processors are bound by data processing agreements and comply with GDPR or equivalent data protection standards.
5. AI & Your Content
- Your content is not used to train AI models. We use AI APIs in "zero-retention" mode where available.
- AI-generated content belongs to you. We make no claims to outputs generated through the Service.
- AI providers may temporarily process your prompts for abuse monitoring per their terms, but do not retain them for training.
6. Data Retention
- Active accounts: Data is retained for the lifetime of your account.
- Cancelled accounts: Data is retained for 30 days after cancellation, then permanently deleted.
- Billing records: Retained for 5 years as required by Norwegian accounting law.
- Server logs: Automatically deleted after 30 days.
7. Your Rights (GDPR)
As a data subject under GDPR, you have the right to:
- Access — Request a copy of the personal data we hold about you.
- Rectification — Correct inaccurate personal data.
- Erasure — Request deletion of your personal data ("right to be forgotten").
- Data portability — Receive your data in a structured, machine-readable format.
- Restriction — Request that we limit how we use your data.
- Object — Object to processing based on legitimate interest.
- Withdraw consent — Where processing is based on consent, withdraw it at any time.
To exercise these rights, contact us at contact@mentra.systems. We will respond within 30 days.
8. Cookies
Mentra uses two kinds of cookie:
- Essential cookies — required for authentication and session management. These cannot be switched off without breaking sign-in.
- Analytics cookies — set by PostHog, and only after you accept them. We ask on your first visit and set nothing until you answer. Declining leaves the Service fully functional.
We do not use advertising cookies or third-party ad trackers. You can change your choice at any time, right here:
Analytics cookies
You have not made a choice yet. Analytics is off until you do.
9. Data Transfers
Some of our processors are based in the United States. Data transfers to the US are conducted under the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) as appropriate.
10. Security
We protect your data with:
- Encryption in transit (TLS/HTTPS) and at rest
- Role-based access control (RBAC) with permission-level enforcement
- Tenant-level data isolation
- Regular security reviews
11. Children
The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification. The latest version will always be available on this page.
13. Contact & Complaints
If you have questions or concerns about your privacy:
- Email: contact@mentra.systems
- Company: WEDDEsign (org.nr 935 153 603)
- Address: Skjæret 29, 1390 Vollen, Norway
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.