Last updated October 29, 2026. For customers whose use of Mentioned is subject to the GDPR, the UK GDPR or Swiss data protection law. It includes the EU Standard Contractual Clauses.
This Data Processing Agreement (“DPA”) is between Pickleland LLC, a Texas limited liability company at 21427 Martin Lane, Pflugerville, TX 78660, United States, which operates Mentioned (“Mentioned”, “we”), and the customer that has accepted Mentioned's Terms of service (“Customer”, “you”). It forms part of the Terms and applies whenever Mentioned processes Customer Personal Data on your behalf. You don't need to sign anything for it to apply. If you want a countersigned copy for your records, email support@mentioned.at.
For Customer Personal Data, you are the controller (or a processor acting for your own controller) and Mentioned is your processor (or sub-processor). Mentioned is a controller only of the data it uses to run its own business, such as billing, security and abuse prevention, website analytics and sign-up attribution, which its Privacy policy covers. You are responsible for having a lawful basis for the Customer Personal Data you put into Mentioned and for the instructions you give.
Mentioned processes Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and what you or your users direct through Mentioned's settings, interface and API, including the actions of apps and AI agents you connect. Running a check or a tracked keyword is an instruction to send its brand, category, competitors and questions to the AI providers that answer it. Mentioned will tell you if it believes an instruction breaks Data Protection Law, unless the law forbids it. If Mentioned is required by law to process Customer Personal Data otherwise, it will tell you first unless that law prohibits it.
Mentioned limits access to Customer Personal Data to people who need it to provide, secure or support the service, and makes sure they are bound by confidentiality. Mentioned does not read your content except to provide support you ask for, to investigate abuse or a security issue, or where the law requires it.
Mentioned implements and maintains the technical and organisational measures in Annex II, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Mentioned may update them as long as the overall level of protection does not decrease.
Mentioned will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the email address of the account that owns the affected workspace and describes what is known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Mentioned will add details as they become available and take reasonable steps to contain and remedy the breach. Notification is not an admission of fault.
You give Mentioned general authorization to use sub-processors. The current list is at mentioned.at/subprocessors (Annex III). Mentioned imposes data-protection obligations on each sub-processor by written contract that are at least as protective as this DPA, and remains liable to you for their performance.
Mentioned informs you of an intended new sub-processor by adding it to that page at least 10 days before it starts processing Customer Personal Data. Mentioned does not send separate notices, so check the page if you need to follow changes. If you object to a new sub-processor on reasonable data-protection grounds within that period, your remedy is to stop using Mentioned and delete your account.
Taking into account the nature of the processing, Mentioned will help you, through the features of the service where possible, to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability and objection). If Mentioned receives such a request directly about Customer Personal Data, it will pass it to you rather than answer it. Mentioned will also give reasonable help with data protection impact assessments and prior consultations with supervisory authorities relating to Mentioned.
You can export your tracked keywords' history and delete keywords or your whole account in Mentioned at any time. When your account is deleted, and in any case within 30 days after the Terms end, Mentioned deletes Customer Personal Data from the live service, except where the law requires it to keep some. Mentioned also deletes accounts that have not been used for 2 years, after emailing the account 30 days before, as its Privacy policy describes. Deleted data is removed from backups as they expire, within 30 days. On request before deletion, Mentioned will help you obtain a copy of the data.
Mentioned will make available the information reasonably needed to demonstrate compliance with this DPA and Article 28 of the GDPR, including written answers to reasonable security questionnaires. Where that is not enough, you, or an independent auditor bound by confidentiality, may audit Mentioned's compliance once a year on at least 30 days' written notice, during business hours, at your cost, and in a way that does not disrupt the service or expose other customers' data. Audits of Mentioned's sub-processors are satisfied by the reports and certifications they make available.
Mentioned stores and processes Customer Personal Data in the United States. To the extent that providing Mentioned involves a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the transfer is governed by the SCCs, which are incorporated into this DPA by reference, as follows:
For transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) applies and is incorporated by reference. Table 1 is completed with the parties' details in Annex I, Tables 2 and 3 with the choices above and the Annexes of this DPA, and in Table 4 either party may end the Addendum as its Section 19 allows.
For transfers from Switzerland, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to the GDPR are read as references to the FADP for those transfers; “Member State” in Clause 18(c) includes Switzerland, so data subjects there can bring claims where they habitually reside.
If the SCCs conflict with this DPA or the Terms, the SCCs prevail.
Each party's liability under this DPA is subject to any limitations of liability in the Terms, except where Data Protection Law or the SCCs do not allow liability to be limited. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. This DPA lasts as long as Mentioned processes Customer Personal Data for you.
Your users, workspace members and the people you invite, and anyone whose personal data you or your users put into Mentioned, for example a person whose name is part of a brand or a competitor you track.
Account data (email address, password hash, sign-in identifiers such as a linked Google account ID or passkey credential, and invitations); content (brands, categories, competitors, questions, notes and annotations, and the AI answers stored for them); figures read live from services you connect (Google Analytics and Search Console), which Mentioned shows back to you and does not store; and technical data (a hashed IP address stored with each check, and request details in short-lived logs).
None are intended. Mentioned is not designed for special categories of personal data or data about criminal convictions, and you should not put them into Mentioned unless you have a lawful basis and have satisfied yourself that the measures in Annex II are adequate.
Continuous, for as long as you use Mentioned. Mentioned stores, organises, displays, transmits and deletes Customer Personal Data in order to provide the service as described in the Terms: asking AI assistants the questions you set up and recording their answers, showing results to you and your workspace, carrying out actions requested by apps and AI agents you connect, sending the emails you enable, and providing support.
As set out in section 9.
As listed in Annex III, for the purposes stated there, for as long as you use Mentioned.
The sub-processors listed at mentioned.at/subprocessors, as updated under section 7.