MENTAT PRIVACY POLICY
1. Two roles.
For the data your organization's users put into Mentat, we act as a processor on your organization's behalf, and that data is governed by the Cloud Service Agreement and the Data Processing Addendum. For our own account, billing, and website data, we act as a controller.
2. Data we process as a processor, on your organization's behalf.
Handled only to deliver the service, under your organization's instructions and the DPA:
- Technician voice input, the audio memo itself, which contains the technician's voice and may contain spoken job or customer details.
- Transcripts of that audio, plus confidence and duration.
- The recommendations extracted from the transcript.
- Technician identifiers: name for attribution and phone number for matching call-in recordings.
- Job and estimate data synced with your field-service system.
3. Data we process as a controller, for our own purposes.
- Authorized-user account data: names and work emails, and authentication handled through our identity provider.
- Billing and contract contacts.
- Support communications you send us.
- Analytics on mentathq.com and in the Mentat application. We use PostHog for product analytics on both our website and the app, and Cloudflare Web Analytics for traffic measurement on the website. PostHog stores an identifier on your device so we can tell a returning visit from a new one. In the app we also record how the product is used, including masked session recordings, so we can see where it works and where it does not. Text and form input are masked before anything leaves your browser, so the content of your screens, including your customers' details, is not sent to PostHog. We do not track you across other sites, and we do not sell or share this data.
Rate limiting.
To protect the service from abuse, our rate limiter temporarily holds the IP address of incoming requests in memory (Redis) for approximately 60 seconds, after which it is discarded. These IP addresses are not written to durable storage and are not joined to your account data.
4. AI processing.
Mentat's recommendations are generated by a large language model and always pass through human operator review before they become a customer-facing estimate. We do not train models on identifiable customer data.
5. Subprocessors.
We use a small set of service providers that process personal data on our behalf to deliver the service. The current list, including each provider's role and the categories of data it touches, is maintained at mentathq.com/subprocessors. We update that page when the list changes and give organizations with a signed Data Processing Addendum advance notice per its terms.
Your field-service system, such as Jobber or ServiceTitan, is your own system that Mentat connects to under your authorization. It is not our subprocessor.
6. Retention.
- Voice audio: we delete the raw recording 30 days after capture. It is kept only to complete processing and provide a short quality-and-dispute buffer. We keep no long-term audio archive.
- On termination or trial expiry, your account becomes read-only and your data is retained in that state. You can request deletion of your data at any time by written request to the contact address below, and we will complete the deletion and confirm it to you. A self-serve export surface is planned; until it ships, export requests are handled the same way.
- Account data: retained while your account is active and for a reasonable period afterward for legal and administrative purposes.
7. Security.
Data is encrypted in transit. Access to your data is scoped and tenant-isolated. Every AI output passes a human review gate before it acts on anything.
8. Your rights and your users' rights.
For service data, where we act as a processor, requests from individuals are directed to your organization as the controller, and we assist you in responding. For account data, where we are the controller, contact us at the address below.
9. International transfers.
We operate in the United States, and our service is built for US businesses. If any personal data originates in the EU or UK, transfers are handled under the DPA and its standard contractual clauses. We expect this to be minimal.
10. Children.
Mentat is a business tool, not directed to children, and we do not knowingly collect their data.
11. Changes and contact.
We version this policy and date each version. Material changes are announced and, for in-product acceptance, re-accepted at sign-in. Contact: [email protected]. Fieldcraft Systems, Inc.