data should be minimal not theatrical
No banner when there is nothing to sell.
Collect the minimum. State it plainly. Operate it accordingly.
This page is the public privacy notice for BlackMenta Ltd. It names the controller, maps the data, states the lawful basis, fixes the retention windows, names the processors and lists the rights. If a sentence here is not enforceable in the deployed stack, the sentence is wrong — not the stack.
The accountable entity is named.
BlackMenta Ltd
The data controller is BlackMenta Ltd, a UK-incorporated company registered in England & Wales. Public record verifiable on Companies House.
Verify record№ 16988667
Companies House number 16988667. Incorporated 26 January 2026. Active. Annual filings published on the public register.
See officersprivacy@blackmenta.com
Privacy enquiries, rights requests, complaints and processor questions. The named route — not a generic inbox routed to the wrong queue.
Privacy requestUK ICO
UK Information Commissioner’s Office is the supervisory authority. Complaint rights are available through the ICO if a request is not handled appropriately.
ICO complaint routeFour lanes. Pick the right one.
privacy@
Rights requests, access, correction, deletion, restriction, portability or objection. The named route on this page.
privacy@ → PR.02 legallegal@
Formal notices, data-protection legal liaison, processor contracts, international-transfer questions, cross-border counsel.
legal@ → PR.03 securitysecurity@
Suspected privacy incident, data exposure, account takeover, leakage report — route via the security inbox for the same SLA as vulnerability reports.
security@ → PR.04 generalhello@
Privacy-page corrections, plain-English feedback, drift reports, or non-rights questions about this notice.
hello@ →Collect the minimum; state it plainly.
The ICO says privacy notices should explain why personal data is processed, how long it is kept and who it is shared with. This map is the public version of that explanation. If a category does not appear here, BlackMenta should not be collecting it.
Each purpose needs a basis.
UK GDPR Article 6 lists six bases for lawful processing. BlackMenta uses three. The fourth row below names a basis that is deliberately not used — legitimate interest as cover for behavioural advertising.
Submitted requests
Where a person submits a form or request after seeing a notice, BlackMenta may process that submission for the requested purpose. Consent is specific, informed and withdrawable.
Preview access
Session, login and profile data may be necessary to provide gated reviewer access or to take steps requested before access is granted.
Security controls
Minimal logs, rate limits, abuse prevention and vulnerability triage may be processed for security and integrity. Strictly bounded; not a catch-all.
Marketing profiling
Legitimate interest is not used as cover for behavioural advertising, cross-site tracking or surprise profiling. The basis exists in UK GDPR; BlackMenta does not stretch it here.
No banner when there is nothing to sell.
Under UK cookie rules, organisations must explain cookies and obtain consent for cookies that are not strictly necessary. BlackMenta’s public design target is strictly-necessary storage only — which is why this site does not nag you with a banner.
Do not paste secrets into public surfaces.
Where AI surfaces are exposed publicly, the privacy posture must reflect what they actually do. The three statements below mark the line between public chat input, gated reviewer disclosure, and the limit of what BlackMenta can promise about third-party AI providers.
Menta / AI
AI surfaces may process the text typed by the user to generate a response. Users should not submit secrets, legal notices, security exploits, personal data about others or investment-sensitive material into public assistant boxes.
Preview material
Reviewer-pack documents, diligence notes and private disclosures belong in gated channels, not public chat or generic inboxes. The privacy floor is set by the channel, not by the content.
Model handling
Where third-party AI providers are used, provider-specific retention and training settings must be checked before live release. This page should not promise more than the deployed configuration enforces.
Processors should be named by role.
Specific vendor names are gated to verified reviewers; the roles they play are public. The matrix below names the role, the public position, and the contractual posture (Data Processing Agreement, plus international-transfer safeguards where required).
Rights requests need a route.
Under UK GDPR, six rights apply to your personal data. Each is exercisable through the named privacy contact. No friction added on purpose. Identity verification is the only legitimate gate.
What do you hold?
Request a copy of personal data associated with your email, profile or reviewer account. The response should be machine-readable where reasonable.
Correct a record
Ask BlackMenta to correct inaccurate profile, contact or routing data. Drift in stored data is a legitimate request, not a courtesy.
Delete my data
Request account/profile deletion, subject to legal, security or record-keeping limits. Where erasure is limited, the limit is explained, not implied.
Pause processing
Request restriction while a record is checked or a dispute is resolved. Processing pauses; storage continues; the dispute gets a clock.
Export data
Where applicable, request a structured export of data you provided. Format: JSON or comparable machine-readable.
Object / opt out
Object to legitimate-interest processing or opt out of optional telemetry where available. Objection is a stop signal, not a negotiation.
Reviewer-side privacy details are gated.
This page is the public privacy posture. Specific processor list, DPA terms, transfer mechanisms, audit logs and reviewer-side data handling are released through auth.blackmenta.com — to verified counsel, security researchers and capital under NDA.
Other pages, in any order.
Home · the receipts · the voice · security · the people.
The holding entity, the legal wall, the public surface
BlackMenta Ltd · № 16988667 · the public cover sheet for the IP holding entity behind this notice.
Regulatory, jurisdictional, privacy references
Specific statutes, jurisdictional map, privacy stance summary, glossary, FAQ. The audit desk for the holding.
Responsible disclosure route
Scope, evidence standard, response SLA, security.txt, PGP status. Route, not slogan.
The assistant does not improvise authority
Bounded corpus, refusal protocol, AI input boundary. Where this page’s 05.1 rule originates.
The filter, the standard, and the anchors
The ten-year test. House rules. Counsel of record. Origin respected.
Notes.
- N.01 Security controls. TLS, least-privilege access, session protection, short-lived tokens, database access controls and documented security reporting support the privacy promises on this page. → see /security
- N.02 Not for children. BlackMenta surfaces are not directed at children. If a parent or guardian believes a child submitted data, contact privacy@blackmenta.com. → erasure route applies
- N.03 Versioned updates. Material changes are dated and, where they affect active reviewer accounts or privacy choices, notified before taking effect where practical. → current rev: A
- N.04 Draft status. This is a public privacy-notice draft for BlackMenta Ltd. It is reviewed against the actual deployed stack, processor list and UK/EU data-transfer setup before publication as final legal text. → see signature block
- N.05 Privacy questions: privacy@blackmenta.com. ICO complaint route is on the controller card above.