Privacy Policy

We collect information you provide directly to us, information we collect automatically when you use our Services, and information from third-party sources.

Information you provide: - Account registration data (name, email address, job title, organization) - Profile information (biography, skills, areas of expertise, profile photos) - Program data (mentoring goals, session notes, feedback submitted through the platform) - Payment information (processed securely through our payment processors; we do not store full card details) - Communications you send to us (support tickets, contact form submissions)

Information collected automatically: - Log data (IP address, browser type, pages visited, time stamps) - Device information (device type, operating system, unique device identifiers) - Usage data (features used, time spent on pages, clicks, search queries within the platform) - Cookies and similar tracking technologies (see our Cookie section below)

Information from third parties: - Single Sign-On (SSO) providers, if your organization enables SSO integration - Integration partners (calendar services, HRIS platforms) where you explicitly connect them

We use the information we collect to:

• Provide and improve our Services — operate the platform, process transactions, and deliver mentoring program features
• Personalize your experience — tailor matching recommendations, surface relevant resources, and adapt the interface to your role
• Communicate with you — send service-related notifications, respond to support requests, and (where you have opted in) share product updates and educational content
• Ensure security and integrity — detect fraud, investigate misuse, and enforce our Terms of Service
• Comply with legal obligations — respond to lawful requests from public authorities and meet applicable regulatory requirements
• Conduct research and analytics — understand aggregate usage patterns to improve product quality (always in de-identified or aggregated form where possible)

We do not sell your personal information to third parties. We do not use your data to train third-party AI models without your explicit consent.

If you are located in the European Economic Area or the United Kingdom, our legal basis for processing your personal data depends on the context:

• Contractual necessity — processing required to deliver the Services you have requested (account management, program participation, payment processing)
• Legitimate interests — improving product quality, preventing fraud, and ensuring platform security, where those interests are not overridden by your rights
• Consent — marketing communications and optional analytics; you may withdraw consent at any time
• Legal obligation — compliance with applicable laws and responding to lawful government requests

Within your organization's program: Profile information and participation data is visible to administrators of your mentoring program and, where relevant, to your matched mentor or mentee, according to your program's privacy settings.

Service providers: We share data with trusted vendors who process it on our behalf under strict contractual obligations — including cloud hosting, payment processing, email delivery, and analytics. These providers may not use your data for their own purposes.

Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred. We will notify you via email or prominent notice on our platform before your data is subject to a different privacy policy.

Legal requirements: We may disclose information when required by law, court order, or government authority, or when we believe disclosure is necessary to protect rights, property, or safety.

With your consent: We may share information for any other purpose with your explicit consent.

We retain your personal information for as long as necessary to provide our Services and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Active accounts: Data is retained for the duration of your subscription plus 90 days to allow account reactivation
• Deleted accounts: Personal data is purged within 60 days of account deletion, except where retention is required by law (e.g., financial records for 7 years)
• Backup systems: Data may persist in encrypted backups for up to 90 days following deletion

Program-level data (anonymized aggregate outcomes, completion statistics) may be retained indefinitely in de-identified form for product research.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Deletion — request erasure of your personal data, subject to certain legal exceptions
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or direct marketing
• Restriction — request that we limit how we use your data in certain circumstances
• Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, email privacy@mentorahq.com. We will respond within 30 days. We may need to verify your identity before processing your request.

California residents (CCPA/CPRA): You have the right to know what personal information is collected, the right to delete, the right to opt out of sale (we do not sell personal data), and the right not to be discriminated against for exercising your rights.

We use cookies and similar technologies to operate our platform, remember your preferences, and analyze how our Services are used.

Essential cookies — required for the platform to function (authentication, session management). Cannot be disabled.

Analytics cookies — help us understand how visitors interact with our website. We use privacy-first analytics that do not track individuals across sites.

Preference cookies — remember settings like your preferred language or collapsed sidebar state.

You can control non-essential cookies via our cookie preferences banner. Note that disabling certain cookies may affect platform functionality. Most browsers also allow you to manage cookies through browser settings.

We implement industry-standard technical and organizational measures to protect your personal data, including:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: Databases and backups are encrypted using AES-256
• Access controls: Role-based access controls limit internal data access on a need-to-know basis
• Regular audits: We conduct periodic security reviews and penetration testing
• Incident response: We maintain an incident response plan and will notify affected users within 72 hours of discovering a qualifying breach

No system is completely secure. If you believe your account has been compromised, contact us immediately at security@mentorahq.com.

Mentora HQ is headquartered in the United States. If you are located outside the US, your information may be transferred to and processed in the US or other countries where our service providers operate.

For transfers from the EEA or UK to the US, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data receives an adequate level of protection.

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have inadvertently collected such data, we will delete it promptly. If you believe we have collected data from a child, contact us at privacy@mentorahq.com.

We may update this Privacy Policy periodically. When we make material changes, we will notify you by email or by displaying a prominent notice on our platform at least 14 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

The date at the top of this page reflects when this policy was last revised.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Mentora HQ Privacy Team Email: privacy@mentorahq.com

If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.