Legal
Data & Compliance
This page is a full inventory of the personal data Mentorise collects, our legal bases for processing it, and your rights under UK GDPR and the California Consumer Privacy Act (CCPA). For a plain-English overview, see our Privacy Policy.
Full data inventory
Every personal data point Mentorise collects, where it comes from, and why.
Identity & account data
| Data point | Source | Stored as | Purpose |
|---|---|---|---|
| Name | Your Google account (via Clerk) | Text | Account identity; how your buddy addresses you |
| Email address | Your Google account (via Clerk) | Text (unique) | Account identity; replies to help requests |
| Account creation timestamp | System | ISO timestamp | Record-keeping |
| Where you want to get to | You (Settings, or your first conversation) | Text | Personalise your buddy's replies |
| Your buddy's colour | You (Settings) | Colour name | How your buddy looks |
Conversations with your buddy
| Data point | Source | Stored as | Purpose |
|---|---|---|---|
| Messages you send and replies you receive | You / generated by OpenAI | Text, with timestamps | Provide the conversation; continuity across sessions |
| Follow-up ("check-in") messages | Generated by OpenAI when you return | Text | Follow up on what you talked about last time |
| What your buddy remembers: why you're here, what's going on now, where you want to get to, career path, hard moments and how they turned out, what motivates you, how you like to write | Drawn from your conversations by OpenAI | JSON | Relevant replies; matching you with similar stories |
| Labels for what you're going through now (e.g. "bad manager") | Drawn from your conversations by OpenAI | Fixed list of categories | Matching stories; seeing which stories are most needed |
| "Did this help you see it differently?" answers | You | Yes / no | Measure whether Mentorise helps |
Stories you share
| Data point | Source | Stored as | Purpose |
|---|---|---|---|
| The moment, what happened, where it led, your advice | You (in a conversation or through a story link) | Text | Shown to people using Mentorise; used without your name to help the AI answer |
| Role, industry, years of experience, seniority | You | Text / fixed options | Context for your story, shown the way you chose |
| Your name (only if you choose to show it) | You (story links) | Text | Shown with your story if you choose |
| Consent version and time | System | Text + ISO timestamp | Record of your agreement to share |
| Labels for the kind of moment (e.g. "missed promotion", "anxious") | Generated by OpenAI | Fixed list of categories | Match stories to people going through the same thing |
| Story link drafts, open times and progress through the questions | System (story links) | JSON + timestamps | Save your answers as you go; see where people get stuck |
| Voice notes (story links) | You | Not stored: sent to OpenAI for transcription, only the text you confirm is kept | Let you speak instead of type |
Aggregated insight
| Data point | Source | Stored as | Purpose |
|---|---|---|---|
| Count of people going through each kind of situation vs. stories that cover it, plus general questions for people sharing | Derived from the labels above; questions written by OpenAI | Counts and general questions, with no names or personal details | Ask people sharing for the stories that are most needed (only shown once at least two people share a situation) |
Analytics data
| Data point | Source | Stored as | Purpose |
|---|---|---|---|
Anonymous session ID (_anon_id) | Generated in browser, stored in local storage | Random string | Distinguish unique visitors before sign-in |
| Page visit entry timestamp | System | ISO timestamp | Usage analytics |
| Session duration (updated every 60s) | System (heartbeat) | Integer (seconds) | Engagement analytics |
| Last screen viewed | System | Screen name string | Funnel analytics |
| User ID linked to visit (once signed in) | System | User ID reference | Understand how people use the product |
Support data
| Data point | Source | Stored as | Purpose |
|---|---|---|---|
| Feedback and help messages, optional rating, your name | You (Feedback & help) | Text | Improve Mentorise; reply if you asked for help |
Data from earlier versions
Earlier versions of Mentorise asked for a CV and built a career profile from it. We no longer collect this data. If you used an earlier version, the following may still be linked to your account until you ask us to delete it: career history, education and skills extracted from your CV, your answers to profile questions, questions you asked other profiles and their answers, and signals and match scores derived from these.
Third-party processors
| Processor | Country | Data shared | Purpose | Safeguard |
|---|---|---|---|---|
| OpenAI | United States | Conversation content, what your buddy remembers, stories, voice notes | Buddy replies, memory, story drafting and labelling, general questions for people sharing, transcription | Data Processing Agreement + Standard Contractual Clauses (SCCs) |
| Clerk | United States | Name and email from your Google account | Sign-in | Data Processing Agreement |
| Render | See Render's documentation for hosting regions | All data stored by Mentorise | Application hosting and database | Data Processing Agreement |
| Sentry | United States | Technical error details (set up not to send personal data) | Error monitoring | Data Processing Agreement |
| Email provider (SMTP) | Configurable | Name, email address, message content | Replies to help requests | Encrypted SMTP (TLS) |
We do not sell, rent or share your personal data with advertisers or data brokers.
UK GDPR compliance
Mentorise is operated from the United Kingdom. UK GDPR and the Data Protection Act 2018 apply to all processing of personal data.
Legal bases for processing
| Processing activity | Legal basis |
|---|---|
| Providing your conversations with your buddy, including its memory of you | Contract: core service delivery |
| Sharing your story with other users and using it to help the AI answer | Consent: given when you agree to share; can be withdrawn at any time |
| Transcribing voice notes | Consent: only when you choose to record one |
| Labelling what people are going through, and working out which stories are most needed | Legitimate interests: matching people with relevant stories and improving the service, using broad categories only |
| "Did this help?" answers, story link progress, and analytics | Legitimate interests: understanding whether the product helps and where it falls short |
| Sending conversation and story content to OpenAI | Contract: necessary to provide AI features |
| Keeping a record of story-sharing consent | Legitimate interests: being able to show consent was given |
Your rights
Under UK GDPR you have the right to:
- Access: obtain a copy of your personal data
- Rectification: have inaccurate data corrected (you can also just tell your buddy)
- Erasure: request deletion of your account and all associated data
- Restriction: limit how your data is processed in certain circumstances
- Portability: receive your data in a structured, machine-readable format
- Object: object to processing based on legitimate interests
- Withdraw consent: take down a story you've shared at any time
To exercise your rights, email hello@mentorise.co.uk. We respond within one calendar month.
You may also complain to the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113.
International transfers
When your data is processed by our US-based providers (such as OpenAI, Clerk and Sentry), it leaves the UK. We rely on Standard Contractual Clauses (SCCs) and the providers' data processing agreements as the lawful mechanism for these transfers, consistent with ICO guidance on UK GDPR international transfers.
Data retention schedule
| Data category | Retention period | Reason |
|---|---|---|
| Account data (name, email) | Until account deletion request | Required to operate the service |
| Conversations and your buddy's memory | Until account deletion request | Continuity of the service |
| Shared stories and consent records | Until you remove the story or delete your account | Core service content; record of consent |
| Unsent story link drafts | Until sent, or deleted on request | So contributors don't lose their answers |
| Voice note audio | Not retained | Only the confirmed text is needed |
| Data from earlier versions (CV-based profiles) | Until account deletion request | Held for existing accounts only |
| Analytics page visits | Indefinite (aggregated use) | Product analytics |
| Feedback and help requests | Until resolved or account deleted | Issue resolution |
CCPA - California Consumer Privacy Act
If you are a California resident, you have additional rights under CCPA. Mentorise does not sell personal information.
Categories of personal information collected
| CCPA category | Examples from Mentorise | Collected? |
|---|---|---|
| Identifiers | Name, email address, user ID | Yes |
| Personal information (Cal. Civ. Code § 1798.80) | Name, email | Yes |
| Internet / network activity | Page visits, session duration, screens viewed | Yes |
| Professional / employment information | Career path, hard moments, current situation, stories you share (and, for earlier-version accounts, CV-derived career history) | Yes |
| Audio information | Voice notes, transcribed and not stored | Processed, not retained |
| Inferences drawn from personal information | What your buddy remembers about you; labels for what you're going through | Yes |
| Geolocation data | None | No |
| Biometric information | None | No |
| Financial information | None | No |
| Sensitive personal information | Not requested. You may choose to mention things such as health in a conversation; if you do, it's used only to respond to you | Not requested |
How personal information is used
Personal information is used for the following business purposes:
- Providing and improving your conversations with your buddy
- Matching you with stories from people who've been through similar moments
- Sharing stories you've agreed to share, in the way you chose
- Replying to feedback and help requests
- Analytics and product improvement
Your CCPA rights
- Right to know: You may ask what personal information we have collected about you, its sources and purposes, and any third parties it was shared with in the past 12 months.
- Right to delete: You may request deletion of your personal information. We will delete your account and associated data within 30 days, subject to any legal obligations.
- Right to correct: You may request correction of inaccurate personal information.
- Right to opt out of sale or sharing: We do not sell or share personal information with third parties for cross-context behavioural advertising, so this right does not apply.
- Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.
To exercise your CCPA rights, email hello@mentorise.co.uk with the subject line "CCPA Request". We will respond within 45 days.
Security measures
| Measure | Detail |
|---|---|
| Sign-in | Google sign-in via Clerk: Mentorise never handles or stores passwords |
| Transport encryption | HTTPS/TLS on all connections |
| Session cookie | session_token: HttpOnly, Secure, SameSite=Lax, 7-day expiry |
| Security headers | X-Content-Type-Options, X-Frame-Options: DENY, Strict-Transport-Security, Content-Security-Policy |
| Admin access | Single named account verified on the server |
| Rate limiting | Sign-in, messaging, story link and voice-note endpoints are rate-limited |
| Story review | Every shared story, and every edit to one, is reviewed before anyone else sees it |
| Error monitoring | Sentry, set up not to send personal data |
| Database | PostgreSQL with parameterised queries throughout |
Contact & requests
For all data-related enquiries, access requests, deletion requests or complaints:
Email: hello@mentorise.co.uk
We aim to respond to all requests within 30 days (45 days for CCPA requests). If you are unhappy with our response, you may contact the ICO (UK users) or your state Attorney General (US users).