Privacy policy

1. Overview

At Menteasy, we believe in data minimisation. We only ask for the information we absolutely need to make your mentorship programme work. This policy outlines how we handle your data under EU GDPR and UK GDPR standards.

2. Data collection & usage

We categorise the data we collect into these areas:

• Account identity: we collect your email address (and optionally your name) to create your account and manage your login. This is stored in our secure database managed by Supabase.
• Calendar integration (OAuth): if you choose to sync your Google or Microsoft calendar, we request read-only access to your free/busy availability via OAuth.
  • We do not read your emails.
  • We do not access your contacts.
  • We do not read event titles, descriptions, or attendees, and we cannot create, edit, or cancel events on your calendar.
  • We only use this connection to check when you are busy so Menteasy bookings avoid conflicts.
• In-app video sessions (Daily): mentorship sessions can take place in Menteasy via Daily. We create a room for each session and may store session metadata and transcripts to generate programme insights.
• AI insights (OpenAI):with your programme's settings, session transcripts may be processed by OpenAI to produce summaries, themes, and goal progress. We send only the content needed for that analysis.
• Email notifications (Resend): we send transactional emails such as invites and session reminders using Resend.

3. Our tech stack (sub-processors)

To run this service, we share specific data with the following providers:

4. Lawful basis for processing

• Contractual necessity: we process your email and programme data to provide the service you signed up for.
• Consent: we read your Google/Microsoft free/busy availability only after you give explicit permission via the OAuth popup. You can withdraw this consent at any time by disconnecting your calendar.
• Legitimate interest: we process session transcripts to deliver the core mentorship insights you expect from the platform, subject to programme and sharing settings.

5. Data retention & deletion

• Retention: we keep your data as long as your account and programme memberships are active.
• Right to be forgotten: you may request full deletion of your data at any time. Since we currently process these requests manually, please email support@menteasy.com. We will purge your record from Supabase, revoke OAuth tokens, and delete associated programme data within 30 days.

6. International transfers

Your primary database is located in the United Kingdom. For our US-based partners (Daily, OpenAI, Resend, Google, Microsoft, and aspects of Vercel's global infrastructure), we rely on the EU–U.S. Data Privacy Framework and the UK Extension where transfers to the United States occur, so your data remains protected to European standards.