Privacy policy

1. Overview

At Menteasy, we believe in data minimisation. We only ask for the information we absolutely need to make your mentorship programme work. This policy outlines how we handle your data under EU GDPR and UK GDPR standards.

2. Data collection & usage

We categorise the data we collect into these areas:

• Account identity: we collect your email address (and optionally your name) to create your account and manage your login. This is stored in our secure database managed by Supabase.
• Calendar integration (OAuth): if you choose to connect a Google or Microsoft calendar, we request read-only access to your free/busy availability. For Google, those permissions are https://www.googleapis.com/auth/calendar.freebusy and https://www.googleapis.com/auth/calendar.calendarlist.readonly, plus your basic profile (openid, email, and profile) so we can show which account is connected. We do not request access to read, create, change, or delete events on your calendar.
  • We do not read your emails.
  • We do not access your contacts.
  • We do not read event titles, descriptions, attendees, or locations.
  • We store the connected account address, the names of the calendars you choose to include, and encrypted access tokens so we can check availability later.
  • When someone views bookable times, we ask Google or Microsoft for busy intervals on those calendars and use the start and end times to hide conflicting slots. We do not show other people why a slot is busy.
  • You can disconnect the calendar at any time. We then revoke the token with Google or Microsoft and delete the stored credentials.
  • Session invitations are sent from Menteasy's own calendar. Accepting an invitation adds that session to your calendar. That does not give Menteasy permission to change your other events.
• In-app video sessions (Daily): mentorship sessions can take place in Menteasy via Daily. We create a room for each session and may store session metadata and transcripts. Raw transcripts are visible only to the mentor and mentee in that session. Programme organisers can see session metadata and derived notes, not the verbatim conversation.
• AI insights (OpenAI): session transcripts may be processed by OpenAI to produce summaries, themes, and goal progress. We send only the transcript content needed for that analysis. Programme organisers can see those derived notes; they cannot open the raw transcript. Google and Microsoft calendar data is not sent to OpenAI or to any other AI provider.
• Google user data and Limited Use: the use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use Google user data, including free/busy data and calendar names, to create, train, or improve generalized or foundational machine learning or artificial intelligence models. We do not sell Google user data or use it for advertising.
• Email notifications (Resend): we send transactional emails such as invites and session reminders using Resend.

3. Our tech stack (sub-processors)

To run this service, we share specific data with the following providers:

4. Lawful basis for processing

• Contractual necessity: we process your email and programme data to provide the service you signed up for.
• Consent: we read your Google/Microsoft free/busy availability only after you give explicit permission via the OAuth popup, and we only set analytics cookies (PostHog) if you accept them in the cookie banner. You can withdraw calendar consent by disconnecting your calendar. We do not use that calendar data for any purpose other than availability, and we do not transfer it to our AI provider.
• Legitimate interest: we process session transcripts to deliver session notes to mentors and mentees, and derived programme insights to organisers. Raw transcripts are not shared with programme organisers.

5. Cookies

We use two kinds of cookies and similar storage:

• Strictly necessary: authentication and security cookies from Supabase, so you can sign in and stay signed in. These are required to use the service.
• Analytics: if you click Accept, PostHog may use cookies and similar storage to measure how the product is used, including page views and session recordings. If you click Reject, we do not run this analytics. We store your choice in your browser.

6. How we protect your data

We protect Google and Microsoft calendar data, and the other personal data described in this policy, as follows:

• In transit: connections to Menteasy and to our providers use HTTPS (TLS).
• Calendar tokens: Google and Microsoft access and refresh tokens are encrypted with AES-256-GCM before they are stored. The encryption keys are held separately from the database. Those token records are not readable by other users of the application.
• At rest: account and programme data is stored in our database in the United Kingdom (London, eu-west-2), and our database provider encrypts stored data at rest.
• Access: calendar data is used on our servers to calculate availability for the person who connected the calendar. We do not give other members of a programme access to your calendar contents.
• Purpose limitation: we use Google user data only to show which calendar is connected and to avoid double-booking. We do not use it for advertising, and we do not sell it.
• Disconnect and deletion: disconnecting a calendar revokes the OAuth token and deletes the stored credentials. If you ask us to delete your account, we revoke remaining OAuth tokens and delete the associated programme data, as described below.

7. Data retention & deletion

• Retention: we keep your data as long as your account and programme memberships are active.
• Right to be forgotten: you may request full deletion of your data at any time. Since we currently process these requests manually, please email support@menteasy.com. We will purge your record from Supabase, revoke OAuth tokens, and delete associated programme data within 30 days.

8. International transfers

Your primary database is located in the United Kingdom. For our US-based partners (Daily, OpenAI, Resend, Google, Microsoft, and aspects of Vercel's global infrastructure), we rely on the EU–U.S. Data Privacy Framework and the UK Extension where transfers to the United States occur, so your data remains protected to European standards. Product analytics with PostHog are processed in the EU.