Privacy Policy

1. What we collect

Account details

Your name and email address. If you use a password, we store only a salted hash of it, never the password itself. If you sign in with Google, we receive your Google account identifier, name and email address.

Your learning

The topics you enter, your course setup answers, the courses and lessons generated for you, your answers to questions and quizzes, scores, progress, highlights, review cards, skill map and preferences such as reading style.

Payments

Stripe processes your card details; we never see or store your full card number. We keep your Stripe customer and subscription identifiers, plan status, trial and renewal dates, and can show you your card’s brand, last four digits and expiry date, and your invoices.

We may assign new accounts to different introductory lesson offers. We save the offer assigned to your account so it stays consistent, and compare saved lesson progress and confirmed subscription outcomes in our internal reports. This does not share your course content with advertisers.

Feedback

What you write when you cancel a subscription or contact support.

Usage

How people find and use Mentoro: the page you arrive on, the referring site or campaign, the general types of page you view, how long each is in use, how many clicks, taps and bursts of typing it receives, how far down you scroll, whether you use a phone, tablet or computer, and when you reach steps such as previewing a course, signing up or starting a trial. We never record what you type. See section 3.

2. How we use it, and our legal bases

• To provide Mentoro, including generating, grading and saving your courses, and running your account and subscription. This is necessary for our contract with you.
• To keep Mentoro secure and fair, for example rate limits, preventing abuse and fixing problems. This is our legitimate interest.
• To understand and improve Mentoro, using our own analytics, Google Analytics, Google Ads conversion measurement, Reddit conversion measurement and your feedback. This is our legitimate interest.
• To meet legal obligations, such as keeping payment and tax records.

3. Analytics

We use our own analytics and Google Analytics. For our own analytics, a random visitor ID in the mentoro_visitor cookie links the steps a browser takes, such as visiting, previewing a course and signing up. When you create an account, these steps are linked to it. We also measure each visit: the general page types you view, how long each is in use while visible, and counts of clicks, taps and bursts of typing, without recording what you type or select. We may show new visitors one of two homepage versions at random to learn which helps more people start a course, and record which version your browser was first shown. Our analytics do not store IP addresses.

Google Analytics helps us understand visits, page navigation, engagement, referring sites and general device and location information. Google receives browser and connection information when its tag loads and uses cookies to distinguish browsers and sessions. We send general page categories, without course titles, learning content, account identifiers or private URL parameters. Standard campaign tags and advertising click identifiers help attribute visits, completed registrations and activated trials to ads. These conversion events are shared with our linked Google Ads account. Personalised advertising, Google signals, and automatic form and search tracking are disabled. See how Google uses information from sites that use its services.

Our server shares page visits, completed registrations, when you finish your first lesson, activated trials and your first successful subscription payment with Reddit Ads. It sends general page categories, a Reddit ad click identifier when present, your IP address, browser user agent, country and a random event identifier. Payment events include the amount and currency paid. We do not send your email, account identifier, course titles, learning content or private URL parameters. No Reddit script scans your pages or forms. We request Reddit’s Limited Data Use mode and do not create personalised advertising audiences from this data. Matching data expires after seven days without a visit and is removed during our next cleanup. See Reddit’s privacy policy.

Our server also shares page visits, the first course you preview, completed registrations, when you open checkout, activated trials, when you finish your first lesson and your first successful subscription payment with Meta, for Facebook and Instagram ads. It sends general page categories, a Meta ad click identifier when present, a random browser identifier, your IP address, browser user agent, a hashed country code and a random event identifier. Payment events include the amount and currency paid. We do not send your email, account identifier, course titles, learning content or private URL parameters, and no Meta script runs on our pages. We request Meta’s Limited Data Use mode where US state law applies and do not create personalised advertising audiences from this data. Matching data expires after seven days without a visit. See Meta’s privacy policy.

Analytics and conversion measurement apply to every visitor. You can block or delete cookies in your browser settings, or email support@mentoro.pro to object to this use of your data. Essential account, payment and learning records operate independently of analytics.

4. AI processing

To generate courses, lessons, images, read-aloud audio and explanations, and to grade written and code answers, we send the relevant text (such as your topic, course context, the passage you ask about or your answer) to AI models through OpenRouter, which routes requests to model providers. They process it to return a result under their own terms. Please don’t include sensitive personal information in topics or answers.

5. Who we share it with

We share information only with service providers we rely on:

• Stripe: payments, subscriptions, invoices and fraud prevention.
• OpenRouter and AI model providers: generating and grading course content.
• Google: sign-in, if you choose it, and Google Analytics and Google Ads conversion measurement.
• Reddit: ad conversion measurement.
• Meta: Facebook and Instagram ad conversion measurement.
• Transactional email provider: delivering verification and password-reset messages when email delivery is enabled.
• Hosting and infrastructure providers: running the site and storing its database and files.

We may also share information with professional advisers, or when the law requires it. Some providers process data outside the European Economic Area or the UK; where they do, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Account and learning data: while your account is open. When you ask us to delete your account, we delete it within 30 days.
• Course previews made before signing up: your browser can reopen a preview for 24 hours. Unless you add it to an account, we keep its topic, your setup answers and the generated outline for up to 90 days to understand and improve Mentoro, then delete it.
• Payment and invoice records: as long as tax and accounting law requires.
• Analytics: while they help us understand how Mentoro is used. The visitor cookie and Google Analytics cookies expire after up to 13 months and may be renewed during later visits.

7. Cookies and local storage

Mentoro sets these cookies:

Stripe sets its own cookies on the checkout form to process payments and prevent fraud. Mentoro also uses your browser’s local storage for preferences, a random session ID for our own analytics, and to keep answers safe until they are saved.

8. Your rights

You can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent at any time. Email support@mentoro.pro from your account’s email address and we will respond within one month.

You can also complain to the data protection authority where you live.

9. Security

Mentoro uses encrypted connections, hashed passwords, secure session cookies and encrypted storage for service credentials. No system is perfectly secure; if something goes wrong that affects your data, we will tell you as the law requires.

10. Children

Mentoro is not intended for children under 16 without a parent’s or guardian’s permission. If you believe a child has given us personal data without that permission, contact us and we will delete it.

11. Changes to this policy

We will update this page when our practices change, and tell you in advance about significant changes. The date at the top shows the latest version.