Privacy Policy
1. At a glance
- We are Mokka Labs Ltd, a company registered in Limassol, Cyprus (HE 628679), operating the HonestWriter service — “we”, “us”.
- We collect your account details (name, work email, company), the brands, keyphrases and domains you ask us to track, the content we generate for you, technical logs, and — only if you accept in the cookie banner — analytics and advertising cookie data.
- We use this data to run the service: measure how AI assistants mention your brand, generate and publish content, provide support, keep the service secure, and improve it.
- We do not sell personal data. We share it only with providers that help us operate HonestWriter — listed in Section 7.
- Your account data is stored in the EU; a small number of US-based AI and infrastructure providers process queries for us under GDPR safeguards (Section 8).
- You can access, correct, export or delete your data, object to processing, and withdraw consent at any time — Section 11, or just write to [email protected].
2. Who we are; scope of this policy
This policy is issued by Mokka Labs Ltd, a limited liability company registered in the Republic of Cyprus (registration no. HE 628679, VAT ID CY60033081U), with its registered office at 28 October Avenue 367, Mediterranean Court, 1st Floor, Office A5, 3107 Limassol, Cyprus. Mokka Labs Ltd operates HonestWriter and is the data controller for the personal data described here.
This policy covers our marketing website (honestwriter.ai), the free teaser tool, the HonestWriter application and dashboard (app.honestwriter.ai), our API, the emails we send you, and our business communications.
It does not cover third-party services we do not operate — the AI assistants we measure (ChatGPT, Claude, Gemini, Grok, Perplexity), Sign in with Google, Calendly, or websites we link to. Those are governed by their own policies.
Questions about privacy: [email protected], or by post to the registered office above.
3. Data we collect
3.1 Account and authentication data
Your name, work email address, company and role; your Google account identifier, name and profile picture if you use Sign in with Google; and one-time sign-in codes if you sign in by email. We never ask for or store a password.
3.2 Brand and tracking data
The brands, website domains, keyphrases and competitor names you ask us to track, the settings of your workspace, and the results of our measurements — mentions, scores, trends and reports. Tracking results may incidentally contain names of individuals (for example people an AI assistant mentions when answering a question about a brand). Team members you invite contribute their own account data.
3.3 Content data
Drafts and edits of generated articles, publishing history, and the connection details for the blog or custom domain you connect for automatic publishing.
3.4 Teaser tool data (no account needed)
When you use the free teaser on the landing page, we record the domain you enter, the measurement results, your IP address and the time of the request. We use this to rate-limit and prevent abuse; it is not linked to an account.
3.5 Technical and usage data
IP address, device and browser type, pages and events within the product, server logs, and first-party session records of how visitors use the site. These records are kept server-side and do not depend on cookies.
3.6 Communications
Emails and messages you send us (support, feedback, demo requests), bookings you make through Calendly, and our replies.
3.7 Marketing data
Cookie-based analytics and advertising data — collected only if you accept in the cookie banner (see Section 6).
4. How we use data, and why (legal bases)
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Provide, maintain and secure the service: account setup, sign-in, brand measurements, content generation and publishing, dashboards and reports | Account, brand & tracking, content, technical data | Performance of a contract |
| Keep the service safe and available: rate limiting, abuse prevention, logs, incident response | Technical data, teaser data | Contract; legitimate interests (service security and integrity) |
| Support and account management | Account data, communications | Contract; legitimate interests |
| Improve the service using aggregated or de-identified usage analysis | Usage and technical data | Legitimate interests |
| Send service emails: sign-in codes, weekly reports, account notices | Account data | Contract |
| Direct marketing to existing business contacts | Contact data, engagement data | Legitimate interests (existing business relationship); consent where required by law. Every marketing email carries an unsubscribe link. |
| Analytics and advertising cookies | Cookie data | Consent (Section 6) |
| Meet legal obligations: accounting, tax, responding to lawful requests | Billing records, contracts | Legal obligation; legitimate interests (legal claims) |
When we rely on legitimate interests, those interests are operating, securing and improving a business-to-business software product, and communicating with its business users — balanced against your interests as described in this policy. You may object at any time (Section 11).
5. How the AI engines fit in
HonestWriter measures how AI assistants answer questions, and writes content that helps your brand appear in those answers. To do this, we send queries to the commercial APIs of the AI assistants (ChatGPT, Claude, Gemini, Grok and Perplexity) through our own accounts. Three things worth knowing:
- What we send. The queries contain your brand name, website domain and the keyphrases you ask us to track — not your login details, not your personal contact information, and not other contents of your account.
- No training by us. We do not train models of our own on your data. We access these engines through commercial API agreements; where a provider offers a no-training configuration, we enable it, and we do not knowingly submit your data to services that would use it to train their public models.
- Incidental personal data. AI answers sometimes mention real people. We use those extracts only to deliver the measurement results you requested, and they are deleted together with your tracking data (Section 9). We do not collect personal data of members of the public using AI assistants.
- Humans decide. Content is generated with AI and drafted for your review and editing before publishing; you approve what goes out. Measurement results are informational, not automated decisions about you.
8. International data transfers
Your account data and tracking results are stored on Google Cloud in the European Union (Belgium region). Some providers in Section 7 are based in the United States. For those transfers we rely on:
- the EU–U.S. Data Privacy Framework, where the provider is certified under it; and
- otherwise, the European Commission’s Standard Contractual Clauses (2021), together with technical measures such as encryption in transit and at rest.
Equivalent safeguards (the UK Addendum or IDTA) apply to transfers from the United Kingdom. We review these arrangements when our provider list changes and when the European Commission updates its adequacy decisions.
9. How long we keep data
| Category | Retention |
|---|---|
| Account and profile data | While your account is active; deleted within 30 days of closure or your deletion request (backup copies expire on their regular cycle, no later than 90 days) |
| Brand and tracking data | While your account or subscription is active; same deletion as account data |
| Content (drafts, articles, publishing history) | Until you delete it, or 30 days after account closure |
| Teaser results and rate-limiting records | Up to 90 days |
| Technical and usage logs | Up to 12 months, then deleted or irreversibly aggregated |
| Communications and support records | Up to 24 months after the matter is closed |
| Billing and tax records | Up to 7 years, as required by Cyprus tax law |
| Records of consent choices | As long as needed to prove consent — up to 3 years after your last interaction |
We may retain data longer where necessary for a legal claim, but only what is necessary and still protected.
10. Security
All traffic to our services is encrypted in transit (TLS); account databases are encrypted at rest; secrets are stored in a managed vault rather than in code; access to production systems is limited to team members who need it. No system is perfectly secure: if a breach affects your data, we will notify you and the competent authorities as required by law. If you believe you found a security issue, tell us at [email protected].
11. Your rights
If you are in the European Economic Area or the United Kingdom
You have the right to: access your data; have inaccuracies corrected; have your data erased; restrict processing; receive your data in a portable format; object to processing based on legitimate interests; and withdraw consent at any time (which does not affect processing already lawfully done). You also have the right to lodge a complaint with a data protection supervisory authority — in Cyprus the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy), or the authority of your residence or workplace (in the UK, the ICO).
If you are in California
To the extent the CCPA/CPRA applies: you may request disclosure of the personal information we hold, ask us to delete or correct it, and you will not be discriminated against for exercising these rights. We do not sell or “share” (as defined by the CCPA) personal information. Requests and appeals: [email protected].
Other jurisdictions
Where similar rights exist under other US state or national laws, we honor equivalent requests even where we are not strictly in scope.
We respond within 30 days; for complex requests we may extend by up to 60 days and will tell you.
12. Children
HonestWriter is a business service and is not directed to anyone under 16. We do not knowingly collect data from children. If we learn we have, we delete it. If you believe a child provided us data, write to [email protected].
13. Changes to this policy
The effective date at the top shows the current version. We may update this policy as the service evolves; for material changes we will notify you by email or in the product before the change takes effect, where required by law. Continued use after the effective date means the updated policy applies.
14. Contact and complaints
Mokka Labs Ltd (operating HonestWriter)
28 October Avenue 367, Mediterranean Court, 1st Floor, Office A5, 3107 Limassol, Cyprus
Registration HE 628679 · VAT CY60033081U
Privacy: [email protected] · Security: [email protected] · General: [email protected]
We aim to resolve any concern directly. If we cannot, you may complain to the supervisory authority listed in Section 11.