Legal
Privacy Policy
Mentorise is operated from the United Kingdom. This policy explains what personal data we collect, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are based in California, additional rights under the CCPA are described on our Data & Compliance page.
1. Who we are
Mentorise ("we", "us", "our") is a career buddy: an AI companion you can talk to about what's going on in your career. It helps you see your situation differently by drawing on real, anonymised stories from people who have been through similar moments. People further along in their careers can also share their own stories, so that they help someone going through the same thing now.
We are the data controller for the personal data described in this policy.
Contact: hello@mentorise.co.uk
2. Data we collect and why
Your account
| Data | Purpose | Legal basis |
|---|---|---|
| Name and email address, from your Google account when you sign in | Create and identify your account; reply to you if you ask for help | Contract performance |
| Settings: where you want to get to, and your buddy's colour | Personalise your conversations and how Mentorise looks | Contract performance |
| Your mobile number, only if you choose to leave it for follow-up texts, with a record of when you agreed and to what wording | Text you to follow up on your next steps once texts are switched on (we don't send any texts yet), and see how many people want them | Consent |
| Whether you said yes or no to follow-up texts | Decide whether to build follow-up texts | Legitimate interests |
You sign in with Google through our sign-in provider, Clerk. We never see or store your Google password.
Your conversations with your buddy
| Data | Purpose | Legal basis |
|---|---|---|
| The messages you send and the replies you receive | Provide the service, and let your buddy pick up where you left off | Contract performance |
| What your buddy remembers about you, drawn from your conversations by AI: why you're using Mentorise, what's going on for you now, where you want to get to, your career path, the hard moments along it (such as low points and turning points) and how they turned out, what motivates you, and how you like to write | Make replies relevant to you, match you with stories from people who've been through similar moments, and follow up on what you talked about last time | Contract performance |
| Your answers to "Did this help you see it differently?", and whether you reply to follow-ups | Understand whether Mentorise is actually helping, and improve it | Legitimate interests |
You can see what your buddy knows about you under Your story. To correct it, just tell your buddy. To have it deleted, email us.
Sensitive information. Career conversations can touch on personal things such as stress or health. We don't ask for this kind of information. If you share it, we only use it to respond to you, and you can ask us to delete it at any time.
Stories you share
You can share a moment from your career, either in a conversation with your buddy or through a story link someone sends you (no account needed).
| Data | Purpose | Legal basis |
|---|---|---|
| Your story: the moment, what happened, where it led, and what you'd tell someone going through it now | Show it to people using Mentorise, and use it without your name to help your buddy answer career questions | Consent |
| How you're shown: role, industry, years of experience and seniority, and your name only if you choose to show it | Give your story context, in the way you chose | Consent |
| A record of your consent (the wording you agreed to and when) | Show that you agreed to share | Legal obligation / legitimate interests |
| For story links: a draft saved as you type, when the link was opened, and how far through it you got | So you don't lose your answers, and so we can see where people get stuck | Legitimate interests |
| Voice notes (story links only) | Turn what you say into text for you to check and edit | Consent |
Every story is read by us before it goes live. You can remove your story at any time, either by reopening your story link or by emailing us. Voice notes are sent to OpenAI to be transcribed. We don't keep the audio, only the text you confirm.
What people need stories about
We label what people looking for help are going through with broad categories, such as "bad manager" or "thinking of quitting". This lets us see which kinds of stories are most needed. From these categories we write general questions for people sharing their stories (for example "Has a manager ever taken credit for your work?"). These questions never include names or details that could identify anyone. We only show them to people sharing once at least two people are going through the same kind of situation. Legal basis: legitimate interests.
Analytics
| Data | Purpose | Legal basis |
|---|---|---|
| Anonymous ID (stored in your browser's local storage, not a cookie) | Understand overall usage without identifying you | Legitimate interests |
| When you visit, for how long, and the last screen you viewed | Product analytics and improvement | Legitimate interests |
| Your user ID linked to your visits once you're signed in | Understand how people use the product | Legitimate interests |
Feedback and help requests
If you send feedback or ask for help, we store your message, any rating you give, and your name. If you ask for a reply, the message is also emailed to our inbox. We use it only to improve Mentorise and to help you.
If you used an earlier version of Mentorise
Earlier versions of Mentorise asked people to upload a CV and built a career profile from it. We no longer ask for this. If you used an earlier version, the information from that time stays linked to your account until you ask us to delete it. That includes your career history, your answers to profile questions, and your conversations with profiles.
3. Cookies and local storage
| Name | Type | Duration | Purpose |
|---|---|---|---|
session_token | HTTP cookie (HttpOnly, Secure, SameSite=Lax) | 7 days | Keeps you signed in |
| Clerk sign-in cookies | Cookies set by our sign-in provider | Set by Clerk | Handle signing in with Google |
_anon_id | Browser local storage | Until cleared | Anonymous analytics identifier |
| Story drafts and small preferences | Browser local storage | Until cleared | Keep a backup of a half-written story, and remember choices such as story cards you've dismissed |
We do not use advertising cookies or tracking cookies from Google, Meta or other ad networks.
4. Who processes your data for us
We use these service providers: OpenAI (AI), Clerk (sign-in), Render (hosting and database), and Sentry (error monitoring, set up so that it doesn't send personal data or conversation content). We also use an email provider to send replies to help requests.
How we use AI (OpenAI)
We use OpenAI's API (GPT-4.1-mini and GPT-4o-mini, plus GPT-4o-mini-transcribe for voice notes) to:
- Write your buddy's replies
- Keep your buddy's memory of what you've told it up to date
- Draft your story from your own words when you choose to share one, and label stories by the kind of moment they describe
- Write the general questions for people sharing stories (see "What people need stories about")
- Turn voice notes into text
To do this, we send the relevant parts of your conversations, what your buddy remembers about you, and stories to OpenAI's API. OpenAI is based in the United States. We rely on OpenAI's Data Processing Agreement and Standard Contractual Clauses for this international transfer. OpenAI's privacy practices are described at openai.com/privacy.
Your data is not used to train OpenAI's models: OpenAI's API terms don't allow training on data sent through the API by default.
5. Email
We don't send marketing emails. We email you if you ask for a reply through Feedback & help. If you opted in to email summaries in an earlier version of Mentorise, you may occasionally still get one; to stop them, email hello@mentorise.co.uk.
6. How long we keep data
| Data | How long |
|---|---|
| Account, conversations and what your buddy remembers | Until you ask us to delete your account |
| Your mobile number | Until you remove it in Settings or ask us to delete your account |
| Stories you've shared | Until you remove them or ask us to delete your account |
| Unsent story drafts from story links | Until the story is sent, or until you ask us to delete them |
| Voice note audio | Not kept: only the transcribed text is stored |
| Data from earlier versions (such as CV-based profiles) | Until you ask us to delete your account |
| Analytics (page visits) | Kept indefinitely and used in aggregate |
| Feedback and help requests | Until resolved, or until you ask us to delete your account |
7. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Ask us to correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): Request deletion of your account and all associated personal data.
- Restriction: Ask us to limit how we process your data in certain circumstances.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Where we rely on consent (for example, sharing your story), you can withdraw it at any time. We'll take your story down. This doesn't affect processing that happened before you withdrew.
To exercise any of these rights, email hello@mentorise.co.uk. We will respond within one month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
8. Data security
We use appropriate technical and organisational measures to protect your personal data, including:
- Sign-in through Google, so we never handle or store passwords
- Sign-in cookies that are HttpOnly, Secure and SameSite=Lax
- HTTPS/TLS encryption on all connections
- Admin access restricted to a single named account, checked on our servers
- Security headers (X-Frame-Options, X-Content-Type-Options, HSTS, CSP) on all responses
- Every shared story read by us before anyone else can see it
9. Children
Mentorise is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us their data, contact us and we will delete it promptly.
10. Changes to this policy
We may update this policy from time to time. We will tell you about material changes by email or with a notice on the platform. If you keep using Mentorise after changes take effect, you accept the revised policy.
11. Contact
For any privacy questions or requests: hello@mentorise.co.uk