How Mentalics handles data
Mentalics is a brand-intelligence service. It reads publicly available social media posts about the brands our customers ask us to monitor, evaluates them with an AI judge against each brand's own rules, and delivers the alerts that matter to the messaging channels the customer connects (Telegram, Slack, Microsoft Teams). Customers can also ask the Mentalics assistant questions about their data in the panel or in a connected channel. This page explains what data we process, why, for how long, and what your rights are.
1. Data we process
| Category | What | Source | Why |
|---|---|---|---|
| Public social media content | Post text, links, public author handle and follower count, public engagement metrics, video transcripts, image descriptions | Public pages of X, Instagram, TikTok, YouTube, LinkedIn and Facebook, collected through data providers (Apify) and official platform APIs | Detect and evaluate mentions of the monitored brand |
| Customer account data | Name, work e-mail, organisation, role, password hash | Provided by the customer when the account is created | Authentication and access control to the customer panel |
| Delivery channel identifiers | Telegram group id and title; Slack workspace name, channel name, and the incoming-webhook URL and bot token issued by Slack; Microsoft Teams team and channel identifiers, team name and Microsoft tenant identifier | Provided by the customer when connecting a channel | Deliver alerts to the channel the customer chose |
| Questions to the assistant | Question text, the answer, the time, and the platform user and channel identifiers of the person who asked | The customer panel chat, and messages that address the Mentalics bot in a connected Slack, Telegram or Teams channel | Answer the question, keep the conversation context, audit |
| Security and audit records | Login attempts, channel connect / disconnect / test events, time, IP address, browser identifier | Generated by the service | Security, incident investigation, accountability |
| Access logs | Request path, time, status, IP address (query parameters are masked) | Generated by the web server | Availability and abuse detection |
2. AI processing
Post text, transcripts and image descriptions are sent to large-language-model providers solely to classify the content for the monitored brand; questions asked to the assistant are sent to them to produce the answer. Current providers: EVREN (Türkiye), OpenRouter (United States), OpenAI (United States) and models running on our own servers. Speech in videos is transcribed by transcriptapi.com (United States) or a speech-recognition model reached through OpenRouter. Alert decisions are produced by this evaluation; no automated decision with legal effect on an individual is made.
3. Slack, Telegram and Microsoft Teams
Slack. The Mentalics.ai app requests the incoming-webhook, app_mentions:read, chat:write and channels:join permissions. It posts alerts to the channel you select, joins that channel, and receives only messages that mention it so it can answer them in a thread; it cannot read other messages. Uninstalling the app in Slack stops delivery and answers immediately.
Telegram. The bot posts alerts to the group you add it to and processes only messages addressed to it (a mention, the /sor command or a reply to one of its answers). Other group messages are not stored.
Microsoft Teams. The Mentalics app is added to a team by the customer. It posts a connection code in the channel, posts alerts to the channels linked in the panel, and receives only messages that @mention it. Removing the app from the team stops delivery immediately.
Delivered alerts and assistant answers are kept in an outbound ledger so that we can answer what was sent, where and when.
4. Retention
- Public social media content and evaluations: for the duration of the customer relationship, then deleted or anonymised within 90 days.
- Customer account data: while the account exists, then deleted within 30 days of closure.
- Channel identifiers: until the channel is removed in the panel; Slack webhook URLs and bot tokens are stored on our infrastructure provider, are never shown in full in the interface or logs, and are only used by the delivery service.
- Security, audit and access logs: 12 months.
5. Sharing and hosting
We do not sell data. Data is shared only with the processors needed to run the service: hosting (Hetzner, EU), social data providers (Apify), platform APIs, AI providers named above, and the messaging platforms you connect (Slack Technologies, Telegram, Microsoft). Each acts on our instructions under a data-processing agreement or the platform's own terms.
6. Your rights
Under the Turkish Personal Data Protection Law (KVKK) and, where applicable, the GDPR, you may request access to, correction of, or deletion of personal data we hold about you, object to processing, and file a complaint with the supervisory authority. Authors of public posts may ask us to remove their content from our records. Send your request through the contact form and mention that it is a privacy request; we answer within 30 days.
7. Changes
We update this page when our processing changes and record the date above. Material changes are announced to customers in the panel.