1. Introduction and Scope

For a personal account, Mentrast determines why and how information is used to operate the service. Where data-protection law uses the term, this is the role of a controller. Institutional responsibilities depend on any separate written arrangement.

This notice explains our handling of information. Accepting the Terms does not replace consent where a particular use of information requires it.

2. Information We Collect

We collect information in three categories: Information you provide, information collected automatically, and information from third parties.

2.1 Information You Provide

Account information: We process your email, account identifier, sign-in method, verification status, optional profile and settings. Firebase handles authentication; readable passwords are not saved in your Mentrast profile.
Profile and goals: We process the background, learning goals and availability you choose to share.
Learning and support content: We process curricula, conversations, drafts, code, writing, submissions, attachments, feedback and support messages. Drafts may be saved before submission. Learning observations and graph reflections can be inaccurate and can need correction.
Billing information: Paddle handles payment details and provides relevant customer, transaction, subscription and billing-status information. Full payment-card numbers are not stored in your learning profile.

2.2 Information Collected Automatically

Technical and usage information: Application and infrastructure records can include request times, sessions, errors, feature use and security events. They support sessions, usage limits, security and diagnosis. An editor may identify a large paste within that editor; this does not access your general clipboard or prove authorship.
Device information: IP addresses and browser or device details may be processed for service operation, reliability and security.
Cookies: Session tokens and preference settings. See Section 11.

2.3 Information from Third Parties

Sign-in providers: Google or Apple, when available and chosen, provide the account information you authorize. We do not receive your Google or Apple password.

3. How We Use Your Data

We process your data for specific, limited purposes:

Service Delivery

To create and save goals, curricula, conversations, practical work and learning progress, and to restore drafts and respond to requests.

Security and reliability

To protect accounts, investigate failures or misuse and apply reasonable usage limits.

AI and learning features

Relevant messages, lesson context, history, enabled memory and submitted work are sent to AI infrastructure to deliver tutoring and reviews. Current model processing uses Microsoft Azure AI. Dictation sends recorded audio to the configured speech provider; read aloud sends the selected text. Deepgram and Google Cloud are supported speech integrations. Audio is processed for the request rather than saved to the learning profile; provider handling is subject to its own terms and is not promised to have zero retention.

Communication

To send essential account, requested-action, security and billing messages. Settings control optional learning notifications; consent is sought for optional marketing where required.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), our processing is based on the following grounds:

Contractual Necessity: Processing is required to fulfill our Terms of Service (e.g., maintain your account, provide core service functionality).
Legitimate Interests: For security, fraud prevention, product improvement, and internal analytics, provided these interests do not override your fundamental rights and freedoms.
Consent: For optional marketing communications, non-essential cookies, or specific data processing activities where consent is explicitly requested and can be withdrawn at any time.
Legal Obligation: To comply with tax laws, law enforcement requests, and other legal requirements.

5. Data Sharing and Disclosure

We do not sell your personal data. We only share data in the following circumstances:

Service providers: Current integrations include Firebase/Google for identity, Azure AI for model processing, configured Deepgram or Google Cloud speech, Vercel and Render hosting, database/cache infrastructure, Resend email and Paddle payments. The data shared depends on the feature. Some providers also process information for their own legal or security purposes. Ask info@mentrast.com about the providers relevant to your data.
Legal Requirements: We may disclose data if required by law, subpoena, or valid court order. We will attempt to notify you of such requests unless prohibited by law.
Business Transfers: If Mentrast is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Service of any change in ownership or uses of your personal data.
With Your Consent: We may share your information for any other purpose with your explicit consent.

6. International Transfers

Cloud providers may process information outside your country, depending on the provider, region and feature. Where law requires transfer safeguards, an applicable lawful mechanism must be used; this notice does not itself create those safeguards. Contact the team about the arrangements relevant to your information.

7. Security Measures

We use technical and organizational measures to protect the service. No service can guarantee absolute security.

Network protection: Encrypted network connections support secure communication.
Access control: Authenticated access, ownership checks and restricted service credentials limit access.
Review and response: Operational checks and investigation help us address errors and suspected misuse.
Your account: Keep passwords and sign-in codes private and protect access to your email.
Incident response: Report suspected unauthorized access promptly. Legally required breach notifications will be made.

8. Data Retention

Retention depends on the information, its purpose, your choices, legal requirements and any current dispute, security investigation or billing obligation. There is not one fixed period for every category.

Learning records: Account and learning information is kept while needed for your account, ongoing learning and history, unless deleted or removal is requested.
Deletion and backups: Copies in backups or expiring caches may remain temporarily until replaced or expired. Legally required records may need to be retained.
Operational records: Security, email, payment and provider records can have different retention arrangements from active learning data. Contact us about a particular category.
De-identified data: Information no longer needed for an applicable purpose should be deleted or de-identified.

9. Your Data Rights

Depending on applicable law, you may have rights to access, correct, delete, export, restrict or object to processing. Some actions are available in account settings; contact the team for other requests or if a control fails.

Download Your DataExport supported goals, conversations, lessons, work, notes and preferences. The export may not include every original attachment or provider record.

ACCOUNT DATA CONTROLS

Delete AccountRequest account and learning-data deletion. In-progress work or unresolved billing can require attention before the process finishes.

ACCOUNT DATA CONTROLS

To make a privacy request, contact info@mentrast.com. Describe the information or action concerned without sending a password or sign-in code. We may verify identity and will respond within the period required by applicable law.

10. Your California Privacy Rights (CCPA)

If you are a California resident, you have specific rights regarding your personal information under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rights include:

Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell.
Right to Delete: You have the right to request the deletion of personal information that we have collected from you.
Right to Opt-Out: You have the right to opt-out of the sale or sharing of your personal information. Mentrast does not sell or share personal information as defined by CCPA/CPRA.
Right to Correct: You have the right to request the correction of inaccurate personal information.
Sensitive information: Share only what is needed for learning or a support request. Avoid unnecessary sensitive personal information.

Contact the team to exercise applicable rights. We may verify your identity proportionately, explain a lawful exception and provide information about complaint options. Exercising your rights will not result in unlawful discrimination.

11. Cookies Policy

We use essential cookies to authenticate users, maintain session state, and prevent fraudulent use of user accounts. These cookies are strictly necessary for the operation of the Service.

The public website uses Vercel Analytics. The learning application does not currently load optional browser analytics scripts. Essential hosting, authentication, security and operational requests still occur. Any new nonessential tracking requiring consent must have a separate choice.

Browser controls let you remove or block cookies and storage, although blocking essential storage can prevent sign-in or draft recovery. Lessons may load external documentation or YouTube video. Video playback position and intervals can be saved for resume and tutor context; this is activity, not proof of attention or understanding. Relevant lesson queries can be sent to search providers for documentation, images or videos.

12. Children's Privacy

Mentrast is for people aged 13 and above, subject to a higher minimum where law requires it. Under-13 use is not permitted, even with parental permission. We do not routinely collect full birth dates or independently verify every age. Contact info@mentrast.com about suspected underage use so it can be investigated and addressed.

13. Changes to This Privacy Policy

We may update this notice for changes to the service, law or processing. The date identifies this version. Material changes will be communicated where required, and consent obtained when a new use requires it.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Mentrast
Privacy requests
Nigeria
Email: info@mentrast.com