GDPR compliance statement

At Menteasy, we are committed to high standards of information security and data privacy.

1. Lawful basis for processing

We process user data under the lawful bases of Contractual Necessity (to provide the mentorship platform) and Explicit Consent (specifically for OAuth-based calendar integrations).

2. Data minimisation & purpose limitation

We only collect the minimum data required to operate the service (email, name, calendar availability, and session content needed for insights).

• No intrusive access: we do not read emails or access contact lists.
• Scoped access: calendar access is read-only and limited to your free/busy availability - we do not read event details and cannot write to or cancel events on your calendar. It is used exclusively to prevent scheduling conflicts in Menteasy.
• Session insights: video sessions and transcripts are used to generate mentorship notes. Raw transcripts are visible only to the mentor and mentee in that session. Programme organisers see derived notes (summaries, actions, and goals), not the verbatim conversation.

3. Data sovereignty & transfers

• Primary storage: our core database is hosted by Supabase in the United Kingdom (London: eu-west-2 region).
• International transfers: where we use sub-processors located in the US (such as Daily, OpenAI, Resend, Google, or Microsoft), we ensure data protection via the EU-U.S. Data Privacy Framework and the UK Extension, ensuring a level of protection equivalent to European standards.

4. Data subject rights

We fully support the rights of our users under the GDPR, including:

• The right to access: users can request a copy of their data at any time.
• The right to be forgotten: users can request full deletion of their account, OAuth tokens, and programme data by contacting support@menteasy.com.
• Withdrawal of consent: users can revoke calendar access instantly via their account settings.

5. Security & sub-processors

We use industry-leading sub-processors (Supabase, Vercel, Daily, OpenAI, Resend) that maintain rigorous security certifications. We maintain Data Processing Agreements (DPAs) with our vendors to ensure your data remains encrypted and secure.

For more detailed information, please refer to our full Privacy policy. For privacy inquiries, contact support@menteasy.com.