Privacy Policy

We collect information you provide directly to us, information we collect automatically when you use our Services, and information from third-party sources.

Information you provide: - Account registration data (name, email address, job title, organization) - Profile information (biography, skills, areas of expertise, profile photos) - Program data (mentoring goals, session notes, feedback submitted through the platform) - Payment information (processed securely through our payment processors; we do not store full card details) - Communications you send to us (support tickets, contact form submissions)

Information collected automatically: - Log data (IP address, browser type, pages visited, time stamps) - Device information (device type, operating system, unique device identifiers) - Usage data (features used, time spent on pages, clicks, search queries within the platform) - Cookies and similar tracking technologies (see our Cookie section below)

Information from third parties: - Single Sign-On (SSO) providers, if your organization enables SSO integration - Integration partners (calendar services, HRIS platforms) where you explicitly connect them

We use the information we collect to:

• Provide and improve our Services — operate the platform, process transactions, and deliver mentoring program features
• Personalize your experience — tailor matching recommendations, surface relevant resources, and adapt the interface to your role
• Communicate with you — send service-related notifications, respond to support requests, and (where you have opted in) share product updates and educational content
• Ensure security and integrity — detect fraud, investigate misuse, and enforce our Terms of Service
• Comply with legal obligations — respond to lawful requests from public authorities and meet applicable regulatory requirements
• Conduct research and analytics — understand aggregate usage patterns to improve product quality (always in de-identified or aggregated form where possible)

We do not sell your personal information to third parties. We do not use your data to train third-party AI models without your explicit consent.

If you are located in the European Economic Area or the United Kingdom, our legal basis for processing your personal data depends on the context:

• Contractual necessity — processing required to deliver the Services you have requested (account management, program participation, payment processing)
• Legitimate interests — improving product quality, preventing fraud, and ensuring platform security, where those interests are not overridden by your rights
• Consent — marketing communications and optional analytics; you may withdraw consent at any time
• Legal obligation — compliance with applicable laws and responding to lawful government requests

Within your organization's program: Profile information and participation data is visible to administrators of your mentoring program and, where relevant, to your matched mentor or mentee, according to your program's privacy settings.

Service providers: We share data with trusted vendors who process it on our behalf under strict contractual obligations — including cloud hosting, payment processing, email delivery, and analytics. For the MentoraHQ Insights email list specifically, that provider is Brevo (Sendinblue SAS) — see section 13. These providers may not use your data for their own purposes.

Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred. We will notify you via email or prominent notice on our platform before your data is subject to a different privacy policy.

Legal requirements: We may disclose information when required by law, court order, or government authority, or when we believe disclosure is necessary to protect rights, property, or safety.

With your consent: We may share information for any other purpose with your explicit consent.

We retain your personal information for as long as necessary to provide our Services and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Active accounts: Data is retained for the duration of your subscription plus 90 days to allow account reactivation
• Deleted accounts: Personal data is purged within 60 days of account deletion, except where retention is required by law (e.g., financial records for 7 years)
• Backup systems: Data may persist in encrypted backups for up to 90 days following deletion

Program-level data (anonymized aggregate outcomes, completion statistics) may be retained indefinitely in de-identified form for product research.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Deletion — request erasure of your personal data, subject to certain legal exceptions
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or direct marketing
• Restriction — request that we limit how we use your data in certain circumstances
• Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, email privacy@mentorahq.com. We will respond within 30 days. We may need to verify your identity before processing your request.

California residents (CCPA/CPRA): You have the right to know what personal information is collected, the right to delete, the right to opt out of sale (we do not sell personal data), and the right not to be discriminated against for exercising your rights.

We use cookies and similar technologies to operate our platform, remember your preferences, and analyze how our Services are used.

Essential cookies — required for the platform to function (authentication, session management). Cannot be disabled.

Analytics cookies — help us understand how visitors interact with our website. We use privacy-first analytics that do not track individuals across sites.

Preference cookies — remember settings like your preferred language or collapsed sidebar state.

You can control non-essential cookies via our cookie preferences banner. Note that disabling certain cookies may affect platform functionality. Most browsers also allow you to manage cookies through browser settings.

We implement industry-standard technical and organizational measures to protect your personal data, including:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: Databases and backups are encrypted using AES-256
• Access controls: Role-based access controls limit internal data access on a need-to-know basis
• Regular audits: We conduct periodic security reviews and penetration testing
• Incident response: We maintain an incident response plan and will notify affected users within 72 hours of discovering a qualifying breach

No system is completely secure. If you believe your account has been compromised, contact us immediately at security@mentorahq.com.

MentoraHQ is headquartered in the United States. If you are located outside the US, your information may be transferred to and processed in the US or other countries where our service providers operate.

For transfers from the EEA or UK to the US, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data receives an adequate level of protection.

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have inadvertently collected such data, we will delete it promptly. If you believe we have collected data from a child, contact us at privacy@mentorahq.com.

We may update this Privacy Policy periodically. When we make material changes, we will notify you by email or by displaying a prominent notice on our platform at least 14 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

The date at the top of this page reflects when this policy was last revised.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

MentoraHQ Privacy Team Email: privacy@mentorahq.com

If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

This section covers the MentoraHQ Insights email list only. It is separate from emails about an enquiry you send us, from emails about an account you hold on the platform, and from any job application — none of those ever subscribes you to marketing email, and subscribing is never automatic.

What we collect: your email address, your name if you choose to give it, the time of your request, and the page you submitted it from. We also record the exact consent wording you were shown, as a version number and a cryptographic hash of the text, so that what you agreed to can be produced later rather than reconstructed from memory. The consent wording in force at the time of writing is version 2026-10-v1. Separately, and only to detect automated abuse, we record the IP address, browser user agent and spam-check score of the submission.

Our lawful basis is your consent (Article 6(1)(a) UK GDPR and EU GDPR), given by ticking the box on the sign-up form and then confirming by email. We rely on nothing else for this list — not legitimate interests, and not an existing customer relationship.

We confirm before we send (double opt-in). Submitting the form does not subscribe you. We email you a confirmation link, and your address joins the list only when you click it. Until then we send you nothing further. This is why nobody can add you to the list by typing your address into our form.

Who processes it: the list and the emails are handled on our behalf by Brevo (Sendinblue SAS), a company established in France, under their data processing terms. Brevo holds the record of your subscription and of your confirmation; we hold the record of the consent wording you were shown. Brevo may not use your data for its own purposes. We do not sell your personal data, and we do not share this list with anyone else.

How to withdraw: every email we send carries an unsubscribe link. One click, no sign-in, and it takes effect immediately. You can also write to privacy@mentorahq.com. If you later want to rejoin, you will be asked to confirm by email again — we do not reinstate a withdrawn consent on your behalf.

How long we keep it. Two different periods, because two different things are being kept. While you are subscribed, we keep your address for as long as the subscription lasts. The consent record — the wording version, the hash, the timestamp and the source — is kept for 6 years after your subscription ends, because it is the evidence that we had your permission and is needed precisely when that is questioned after the fact. The anti-abuse data (IP address, user agent, spam-check score) is kept for 12 months and then deleted, because it has no evidential value once a submission is no longer disputed and keeping it longer would not be proportionate.

A note on erasure. If you ask us to erase your data from this list, we keep a minimal record that your address has unsubscribed. That record exists only so that we do not email you again — including if your address is later re-imported from an older file. Erasing it completely would remove the very thing that keeps the withdrawal effective. We will tell you if you ask us to do that, and you can still ask us to erase the consent evidence described above.

Your rights in section 6 apply to everything described here, and you can exercise them by writing to privacy@mentorahq.com.