Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect your:

• Name and email address
• Password (stored as a cryptographic hash, never in plain text)
• Organization (tenant) membership and role
• Display name, avatar, and theme preference

1.2 Learning and Content Data

As you use the Service, we collect:

• Courses, documents, and other content you create or upload
• Quiz and assessment responses, scores, and progress
• Conversations with the AI mentor
• Time spent on learning activities
• Assessment profiles (e.g., skills assessments and role classifications)

1.3 Connected Accounts

If you connect a third-party account (Google Drive or Microsoft OneDrive), we store an OAuth token that grants read-only access to your files. We use this access solely to import content you select into your knowledge base. You can disconnect these integrations at any time.

1.4 Usage and Technical Data

We automatically collect:

• Pages visited, features used, and interactions with the platform
• Browser type, operating system, and device information
• IP address (used for security and rate limiting)
• Error and performance data to diagnose issues

1.5 Payment Data

Payments are processed by Stripe. We do not store your full credit card number. Stripe provides us with a customer identifier, subscription status, and billing details necessary to manage your account. See Stripe's Privacy Policy for details on how they handle payment data.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Generate personalized learning content and adaptive assessments using AI
• Process your content through our AI pipeline (embedding, retrieval, and generation)
• Manage your subscription and process payments
• Send transactional emails (account verification, password resets, course notifications, team invitations)
• Analyze usage patterns and errors to improve product quality
• Prevent abuse, fraud, and unauthorized access

3. AI and Data Processing

Mentor126 uses artificial intelligence to generate courses, quizzes, summaries, flashcards, and other learning materials. To do this, we send relevant portions of your content and learning data to third-party AI providers, including:

• Google (Gemini) for content generation, assessments, and analysis
• OpenAI for content generation, text embeddings, and text-to-speech

Data sent to these providers is used solely to process your request and return a result. We do not use your content to train third-party AI models. Each provider's data handling is governed by their own privacy policy and our data processing agreements with them.

Uploaded documents and web content may also be processed by LlamaParse (for document parsing) and Firecrawl (for web page extraction) to prepare content for your knowledge base.

4. Cookies and Tracking Technologies

4.1 Essential Cookies

We use the following cookies to operate the Service:

• Authentication tokens (access and refresh tokens) to keep you signed in (7-day expiration, httpOnly, secure)
• Session context (tenant, role) to maintain your current workspace (7-day expiration)
• Auth validation cache to reduce redundant authentication checks (5-minute expiration)

4.2 Analytics

We use PostHog for product analytics. PostHog collects page views, feature usage, click interactions, and anonymized session recordings (with form input masking enabled) to help us understand how the product is used and where to improve. PostHog may set its own cookies. You can opt out of PostHog tracking by enabling "Do Not Track" in your browser.

4.3 Error Monitoring

We use Sentry to capture and diagnose application errors. Sentry may collect technical data about your browser, device, and the error context (such as the page URL and stack trace). No passwords or payment information are captured by Sentry.

5. Who We Share Data With

We do not sell your personal information. We share data only with service providers that help us operate the platform, each bound by data processing agreements:

• Supabase for database hosting and authentication
• Vercel for application hosting
• Stripe for payment processing
• Resend for transactional email delivery
• PostHog for product analytics
• Sentry for error monitoring
• Google, OpenAI for AI processing (as described in Section 3)
• Upstash for rate limiting

We may also disclose data when required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with prior notice to affected users).

6. Multi-Tenant Data Isolation

Each organization's data is logically isolated at the database level using row-level security policies. Users in one organization cannot access another organization's content, learners, or analytics. Role-based access controls further restrict what each user can see and do within their own organization.

7. Data Security

We protect your data with:

• Encryption in transit (TLS) and at rest
• Secure, httpOnly authentication cookies
• Rate limiting on authentication and signup endpoints
• Row-level security enforced at the database layer
• Regular security audits and dependency updates

No system is 100% secure. If we become aware of a data breach that affects your personal information, we will notify you and any applicable regulators as required by law.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it by law (e.g., billing records).

Data previously sent to third-party AI providers for processing is not stored by those providers beyond what is needed to complete the request, in accordance with our agreements with them. Analytics data in PostHog and error data in Sentry are retained according to their standard retention policies.

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your personal data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Opt out of non-essential communications

To exercise any of these rights, contact us at privacy@mentor126.com. We will respond within 30 days.

10. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these locations. We ensure appropriate safeguards are in place through data processing agreements with all providers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the Service. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

13. Contact

For privacy-related questions or to exercise your data rights, contact us at privacy@mentor126.com.