MentorWay App Privacy Policy
This policy explains how MentorWay collects, uses, stores, and shares personal information when you use the MentorWay application, including our web app and mobile app experiences.
Who controls your data
MentorWay is the data controller for personal data processed through the app. If you have questions or privacy requests, contact hello@mentorway.co.uk.
If we are unable to identify you from the information provided, we may request additional information to verify your identity before acting on a request.
App permissions we request
| Permission | Why we need it | Required? |
|---|---|---|
| Camera | To let you join video mentoring sessions and appear on video during calls. | Required for video calls; not required for non-video features. |
| Microphone | To allow two-way audio during mentoring sessions. | Required for live call participation. |
We do not request permissions unrelated to core app functionality, such as contacts access or precise location.
Data we collect
- Account data: name, email address, role (mentor/mentee/admin), and authentication identifiers.
- Profile and onboarding data: profile details, goals, and mentorship preferences you add in the app.
- Mentoring activity data: session schedules, session participation records, notes, achievements, and messages.
- Video session data: call metadata and session-related artifacts needed to run and improve mentoring sessions.
- AI feature inputs and outputs: transcript-derived content and prompts used to generate summaries, tips, and insights.
- Technical and security data: device/browser information, IP address, logs, and error diagnostics.
How we use your data
- To provide and secure your account and app access.
- To match mentors and mentees and deliver mentorship programme features.
- To run video sessions and communications between mentors and mentees.
- To generate AI-powered mentoring insights and preparation guidance.
- To monitor reliability, detect abuse, and improve product performance.
- To comply with legal obligations and enforce our terms.
Legal bases for processing (UK GDPR / EU GDPR)
| Purpose | Legal basis |
|---|---|
| Account creation, sign-in, service delivery | Performance of a contract |
| Security monitoring, abuse prevention, platform improvement | Legitimate interests |
| Compliance, record keeping, law enforcement requests | Legal obligation |
Where data is stored and who it is shared with
We use trusted service providers that process data on our behalf. Depending on the feature you use, your data may be stored or processed by:
- AWS (including database and application infrastructure) for secure hosting and storage.
- Auth0 for user authentication and identity management.
- Daily.co for real-time video call infrastructure.
- AWS Bedrock for AI model processing used by app intelligence features.
We do not sell your personal data. We only share data with processors as needed to provide the service, meet legal requirements, or protect users and the platform.
Where personal data is transferred outside the UK or EEA, we use appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses, with additional technical and organizational safeguards where needed.
Data retention
- Account and profile data: retained while your account is active and for a limited period afterward to meet legal and operational requirements.
- Session and messaging records: retained for service delivery, support, safeguarding, and dispute handling, then deleted or anonymized.
- Security and audit logs: retained for a limited period for fraud prevention and security investigations.
- Backups: retained on a rolling schedule and automatically overwritten according to backup lifecycle settings.
Exact periods can vary by data category and legal requirements. If you request deletion, we will delete or anonymize data unless we must retain it by law.
Security measures
- Encryption in transit (TLS) and at rest for core infrastructure.
- Role-based access controls and authentication checks.
- Monitoring, rate limiting, and secure development practices.
Your privacy rights
Depending on your location, your rights may include:
- Access to a copy of your personal data.
- Rectification of inaccurate or incomplete data.
- Erasure of your data in certain circumstances.
- Restriction of processing in certain circumstances.
- Data portability for data processed by automated means on contract/consent basis.
- Objection to processing based on legitimate interests.
- Withdrawal of consent at any time where processing is based on consent.
To exercise your rights, contact hello@mentorway.co.uk.
We aim to respond within one month. In complex cases, this may be extended as permitted by law.
You also have the right to lodge a complaint with your local supervisory authority. UK users can contact the Information Commissioner's Office (ICO).
Automated decision-making and profiling
MentorWay may use AI assistance features to generate summaries and guidance, but we do not use solely automated decision-making that produces legal or similarly significant effects on you without meaningful human oversight.
Children's privacy
MentorWay is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe this has happened, contact us and we will take appropriate action.
Changes to this policy
We may update this policy over time. If we make material changes, we will update the effective date and post the updated policy here.