Privacy policy

1. Overview

At Menteasy, we believe in data minimisation. We only ask for the information we absolutely need to make your mentorship programme work. This policy outlines how we handle your data under EU GDPR and UK GDPR standards.

2. Data collection & usage

We categorise the data we collect into these areas:

• Account identity: we collect your email address (and optionally your name) to create your account and manage your login. This is stored in our secure database managed by Supabase.
• Calendar integration (OAuth): if you choose to sync your Google or Microsoft calendar, we request read-only access to your free/busy availability via OAuth.
  • We do not read your emails.
  • We do not access your contacts.
  • We do not read event titles, descriptions, or attendees, and we cannot create, edit, or cancel events on your calendar.
  • We only use this connection to check when you are busy so Menteasy bookings avoid conflicts.
• In-app video sessions (Daily): mentorship sessions can take place in Menteasy via Daily. We create a room for each session and may store session metadata and transcripts. Raw transcripts are visible only to the mentor and mentee in that session. Programme organisers can see session metadata and derived notes, not the verbatim conversation.
• AI insights (OpenAI): session transcripts may be processed by OpenAI to produce summaries, themes, and goal progress. We send only the content needed for that analysis. Programme organisers can see those derived notes; they cannot open the raw transcript.
• Email notifications (Resend): we send transactional emails such as invites and session reminders using Resend.

3. Our tech stack (sub-processors)

To run this service, we share specific data with the following providers:

4. Lawful basis for processing

• Contractual necessity: we process your email and programme data to provide the service you signed up for.
• Consent: we read your Google/Microsoft free/busy availability only after you give explicit permission via the OAuth popup, and we only set analytics cookies (PostHog) if you accept them in the cookie banner. You can withdraw calendar consent by disconnecting your calendar.
• Legitimate interest: we process session transcripts to deliver session notes to mentors and mentees, and derived programme insights to organisers. Raw transcripts are not shared with programme organisers.

5. Cookies

We use two kinds of cookies and similar storage:

• Strictly necessary: authentication and security cookies from Supabase, so you can sign in and stay signed in. These are required to use the service.
• Analytics: if you click Accept, PostHog may use cookies and similar storage to measure how the product is used, including page views and session recordings. If you click Reject, we do not run this analytics. We store your choice in your browser.

6. Data retention & deletion

• Retention: we keep your data as long as your account and programme memberships are active.
• Right to be forgotten: you may request full deletion of your data at any time. Since we currently process these requests manually, please email support@menteasy.com. We will purge your record from Supabase, revoke OAuth tokens, and delete associated programme data within 30 days.

7. International transfers

Your primary database is located in the United Kingdom. For our US-based partners (Daily, OpenAI, Resend, Google, Microsoft, and aspects of Vercel's global infrastructure), we rely on the EU–U.S. Data Privacy Framework and the UK Extension where transfers to the United States occur, so your data remains protected to European standards. Product analytics with PostHog are processed in the EU.