Mentally.ai – Privacy Policy
Last updated: October 21, 2026
1. Who we are
Mentally.ai and Mentally Copilot are services of Mentally Digital, LLC, a Delaware limited liability company, 1644 Deluca Dr., San Jose, CA 95131, United States ("Mentally Digital", "we", "us"). Mentally Digital is the controller of the personal data described in this Privacy Policy.
Privacy contact: legal@mentally.ai – general enquiries: info@mentally.ai.
2. Scope
This Privacy Policy explains how we process personal data of: visitors of mentally.ai, copilot.mentally.ai and related pages (the "Website"); people who request a demo, a course, content or information; customers' account holders, users and billing contacts of Mentally Copilot and the other services of Mentally Digital offered through the Website (the "Services"); business contacts we communicate with.
When the Services process documents and data uploaded by a customer or retrieved from a company's Cassetto Fiscale on behalf of a customer ("Customer Data"), we act as processor on behalf of that customer, which is the controller. That processing is governed by the Mentally Copilot Terms of Service and, where applicable, the Data Processing Agreement. When a user chooses a third-party artificial intelligence model in the Services, the content submitted through that feature is processed by the selected provider in accordance with its own terms and policies. Data subjects concerned should contact the relevant customer.
3. Personal data we process
- Contact data: first and last name, work email, phone number, company, role, company size.
- Account and billing data: login credentials, company details, tax identification numbers, billing address, subscription and payment history. Payment card data is handled by our payment processors; we do not store full card numbers.
- Usage and technical data: IP address, browser and device information, pages visited, dates and times of access, diagnostic and log data.
- Communications: content of emails, support requests and other correspondence.
- Business contact data from other sources: name, role, company and professional contact details obtained from public professional sources, business directories and data providers.
- Cookies and similar technologies: see the Cookie Policy.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR, Art. 6) |
|---|---|
| Sending the content or information you request, organising demos, answering enquiries | Steps taken at your request before a contract; legitimate interest in answering business enquiries |
| Creating and managing accounts, providing the Services, support | Performance of a contract |
| Billing, accounting and tax obligations | Legal obligation |
| Updates, newsletters and commercial communications about Mentally Digital services | Consent, which you can withdraw at any time; for existing customers, legitimate interest where permitted by law |
| Communications to business contacts about our services | Legitimate interest in business-to-business communication; you can object at any time |
| Security, fraud prevention, abuse prevention and enforcement of our terms | Legitimate interest; legal obligation where applicable |
| Website analytics and advertising measurement | Consent collected through the cookie banner |
| Testing, improving and developing our services and technologies, including artificial intelligence and machine learning, and producing statistics | Legitimate interest |
| Establishing, exercising or defending legal claims | Legitimate interest |
Fields marked as mandatory in our forms are necessary to fulfil your request; without them we cannot provide what you asked for.
5. Recipients
We share personal data only as needed for the purposes above, with:
- service providers acting on our behalf, in the following categories: cloud hosting and infrastructure; data processing and artificial intelligence; analytics; payments; email and communications; customer relationship management, lead generation and outreach tools; customer support; security;
- professional advisors, auditors and insurers;
- public authorities, where required by law;
- a buyer or successor in case of merger, acquisition or transfer of business.
Providers we may use include, among others:
- Cloud hosting and infrastructure: Microsoft Azure, Amazon Web Services, Google Cloud Platform, DigitalOcean, OVHcloud, Hetzner, Hostinger, netcup, Contabo, Aruba, Seeweb, Scaleway, IONOS, STACKIT, UpCloud, Leaseweb, Infomaniak.
- Data processing and artificial intelligence: Opper, Regolo.ai, Mistral AI, Aleph Alpha, DeepInfra, Microsoft Azure AI, Amazon Bedrock, Google Cloud AI (Vertex AI), Anthropic, OpenAI, Scaleway Generative APIs, OVHcloud AI Endpoints, IONOS AI Model Hub, Berget AI, Nebius.
- Analytics: Google Analytics, Mixpanel, Firebase.
- Payments: Stripe, PayPal and other payment processors.
- Email and communications: Google Workspace, Mailchimp, AWeber, SendGrid, Twilio.
- CRM, lead generation and outreach: Snov.io, LinkedIn and related tools.
- Customer support: Zendesk, Intercom.
- Advertising: Google Ads, LinkedIn Ads, Meta (Facebook) Ads, Microsoft (Bing) Ads, X (Twitter) Ads, Pinterest Ads.
We do not sell personal data.
6. International transfers
Mentally Digital is based in the United States, and some of our providers are located outside the European Economic Area. Personal data may therefore be transferred to and processed in the United States and other countries. Where required, transfers rely on appropriate safeguards under Chapter V GDPR, such as adequacy decisions of the European Commission (including, where applicable to the recipient, the EU-U.S. Data Privacy Framework) or Standard Contractual Clauses approved by the European Commission. You may request information on the safeguards used by writing to legal@mentally.ai.
7. Retention
- Data collected through contact and download forms: 24 months from collection, unless a contractual relationship begins.
- Account and contract data: for the duration of the relationship and afterwards for as long as necessary to fulfil legal obligations and to establish, exercise or defend legal claims.
- Billing and tax data: for the periods required by applicable tax and accounting laws.
- Marketing data: until you withdraw consent or object.
- Anonymized or aggregated data, which no longer identifies you, may be kept without time limit.
8. Your rights
Under the GDPR you have the right to access your personal data, to rectify it, to have it erased, to restrict its processing, to data portability, to object to processing based on legitimate interest (including at any time to direct marketing), and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise your rights, write to legal@mentally.ai. We answer within one month, extendable where permitted by law. You also have the right to lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it).
9. Automated decisions
We do not make decisions producing legal or similarly significant effects on Website visitors or business contacts based solely on automated processing.
10. Security
We apply technical and organizational measures appropriate to the risk, including encryption in transit and at rest and access controls. No system is completely secure.
11. Minors
The Website and the Services are intended for businesses and professionals and are not directed at persons under 18.
12. Cookies
For information on cookies and similar technologies, and to change your preferences, see the Cookie Policy. Our Website does not respond to Do Not Track (DNT) signals.
12-bis. California residents
If you are a California resident, under the California Consumer Privacy Act as amended (CCPA) you have the right to know what personal information we collect, use and disclose, to request its deletion and correction, to opt out of the "sale" or "sharing" of personal information, and not to be discriminated against for exercising these rights. We do not sell personal information for monetary consideration. Sharing data with advertising and analytics partners through cookies may constitute "sharing" under the CCPA; you can opt out through the cookie settings or by writing to legal@mentally.ai. We respond to verifiable requests within 45 days.
13. Changes
We may update this Privacy Policy. The current version is always published on this page with its date of last update. Material changes are communicated through the Website or by email where appropriate.
14. Language
Translations of this Privacy Policy may be provided. In case of discrepancy, the English version prevails.
