Privacy Notice

1. Who Is the Data Controller

MENTORR, Inc., headquartered in Dallas, Texas, is the data controller for personal data processed through the platform. Contact us at privacy@mentorr.io.

2. Personal Data We Collect

3. Legal Basis for Processing

• Contract performance — processing necessary to provide the platform services.
• Legitimate interests — platform security, fraud prevention, and aggregated analytics.
• Consent — marketing emails and optional analytics cookies (withdrawable at any time).
• Legal obligation — where required to retain or disclose data by law.

4. How We Use Your Data

• Running the Synergy Match algorithm to generate compatibility scores
• Delivering platform features: scheduling, messaging, goal tracking, progress reports
• Sending transactional communications (match notifications, password resets)
• Sending marketing communications where you have opted in
• Detecting and preventing fraud and security incidents
• Improving the platform using anonymised, aggregated analytics

5. Who We Share Data With

We do not sell your personal data. Sharing is limited to:

• Other users — your public profile (name, role, skills, industry) is visible to matched users.
• Supabase — authentication and database provider, operating under a data processing agreement.
• Accelerator partners — profile data may be shared with investor partners under confidentiality obligations if you join the Accelerator.
• Legal authorities — where required by law, court order, or to protect user safety.

6. International Transfers

MENTORR operates from the US and may process data in the US, EU, and Rwanda. For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) to ensure adequate protection.

7. Retention

Data is retained while your account is active. Upon deletion, personal data is removed or anonymised within 30 days, except where legal obligations require longer retention (e.g., financial records for 7 years).

8. Your Rights

To exercise any right, email privacy@mentorr.io. We respond within 30 days.

9. Security

All data in transit is encrypted via TLS 1.2+. Data at rest uses AES-256. Authentication is managed by Supabase (SOC 2 Type II compliant). We promptly notify affected users of any breach as required by law.

10. Changes to This Notice

Material changes will be communicated by email or in-app notification at least 14 days before taking effect. Continued use of the platform constitutes acceptance.

11. Contact