Privacy Policy

Who we are

Mentor is an AI-assisted learning platform. Anyone may create an account with a magic link sent to their email. We act as the controller of personal data processed in connection with your account and use of the Service. Privacy requests, questions, and complaints may be submitted via the Contact link in the site footer or the in-app feedback form in Settings.

The controller is Netanel Harush, operating Mentor from Israel. Contact us for privacy and consumer requests via the Contact link in the site footer (email netanel@my-mentor.app). We are not a public body. We do not collect personal data in order to sell it or to transfer it to others as a business. We are not a data broker and we do not operate direct-mailing services.

Under Amendment 13 to the Protection of Privacy Law 5741-1981, database registration with the Privacy Protection Authority applies to public bodies and to databases whose main purpose is providing personal data to others for business or consideration above statutory thresholds. We have not registered a database for Mentor on that basis. If those facts change, we will register or notify as required. We have not appointed a Data Protection Officer because Mentor is not a public body, not a data-trading business, and does not process highly sensitive data as its core activity at the scale that currently triggers that duty. If that changes, we will appoint one.

Notice when we collect data (Israeli Privacy Protection Law)

• Email is required to create an account. Without it we cannot provide the Service.
• Other data listed in this Policy is collected so we can operate the features you use (spaces, materials, mentor chat, billing). If you refuse, those features will not work.
• You have the right to access, correct, and delete personal data about you, subject to the Protection of Privacy Law 5741-1981 and its regulations (including the Data Security Regulations 5777-2017).
• Use Settings to export or delete your account, or email netanel@my-mentor.app.
• You may complain to the Privacy Protection Authority (הרשות להגנת הפרטיות).

Scope

This Policy applies to registered users who access the Service, including sign-in, onboarding, learning spaces, materials import, mentor chat, practice assessments, billing, feedback, and related support communications. It does not govern third-party websites, payment overlays, or content hosts that you choose to open outside the Service. The in-app interface is English and Hebrew, including right-to-left layout for Hebrew. Store listings may appear in additional storefront languages; the product UI stays English or Hebrew. The iOS App Store and Google Play listings are enabled for every country those stores currently offer for this app. We do not keep a country table on this page because Apple and Google change those storefront lists.

Data we collect

Depending on how you use the Service, we may process the following categories of personal data:

• Account and profile data: email address, display name, preferred language (English or Hebrew), theme preference, onboarding and intake answers, and account status.
• Learning and workspace data: learning goals, learner context, spaces/courses, learning plans, quiz and assessment attempts, mastery or progress records, and in-app preferences (including optional web-research settings, Mentor memory, and Help improve Mentor eval sharing, which is on by default and can be turned off in Settings).
• User content: files you upload (PDF, DOCX, PPTX, TXT, Markdown), website pages you import, YouTube links and derived transcripts or captions, and text chunks and vector embeddings generated from that material for retrieval and mentoring.
• Conversation and agent data: mentor chat messages, conversation titles, per-course Mentor memories you choose to save (or that Mentor saves when you ask it to remember something), agent run metadata, tool-invocation traces needed to operate and debug the Service, and related timestamps.
• Billing data: subscription status, plan identifiers, billing provider, and billing lifecycle events. Web payments are processed by Polar. iOS purchases are billed by Apple. Android purchases are billed by Google. We do not store full payment card numbers.
• Feedback data: feedback text and optional screenshots you submit from Settings, which may be routed to our issue tracker when configured.
• Technical and security data: authentication session cookies, rate-limit counters, IP-related and request metadata in standard server logs, device/browser signals reasonably needed for security and reliability, and content-safety decision metadata (for example, that material or a message was blocked) without intentionally retaining disallowed content payloads beyond operational needs.

How we use data

We process personal data to:

• Provide, authenticate, and administer accounts, onboarding, learning spaces, mentor chat, plans, practice, materials, and progress tracking.
• Ingest, index, embed, and retrieve your materials so AI mentoring and assessments can be grounded in sources you supply.
• Apply safety and acceptable-use controls, including automated moderation of uploads, imported websites or videos, and chat content.
• Enforce plan limits, detect abuse, secure the Service, troubleshoot incidents, and maintain operational logs.
• Process subscriptions, display billing status, and communicate about payment or account issues.
• Respond to feedback and improve product quality, reliability, and accessibility.
• Store per-user Mentor memories in your account so later chats in that course can stay personal. Memories are isolated to your account; they are not mixed with other learners.
• By default, store redacted copies of turns that look like Mentor failures (for example wrong tool, circuit sketch, or language routing) so we can add golden evals and fix prompts. You can turn this off anytime in Settings. We strip emails, IDs, URLs, and phone numbers from the snippet, but the record stays linked to your account for export and deletion. This does not authorize training of public foundation models.
• Comply with law, enforce our Terms of Use, and protect the rights, safety, and property of users and Mentor.

Legal bases (where applicable)

Where data-protection laws require a legal basis, we typically rely on: (a) performance of a contract with you (providing the Service); (b) legitimate interests in operating, securing, and improving a SaaS learning product, balanced against your rights; (c) consent where we expressly request it (for example, optional features you enable); and (d) legal obligation where processing is required by applicable law. If you are in a jurisdiction with additional mandatory bases or rights, those rules apply to the extent required. For users in Israel we also rely on the Protection of Privacy Law 5741-1981 as amended (including Amendment 13, in force 14 August 2025).

AI and third-party processors

To deliver AI mentoring, Mentor transmits relevant prompts, excerpts of your uploaded or imported materials, conversation context, per-course Mentor memories when enabled, and related instructions to AI providers. Depending on deployment configuration, this may be OpenAI directly and/or via the Vercel AI Gateway. Under the providers' standard API terms applicable to our use, we do not authorize use of your Service content to train public foundation models. AI outputs can be inaccurate; see our Terms of Use.

Help improve Mentor is on by default. We may store redacted chat snippets that match known failure patterns so we can add eval cases and improve prompts and tools. Turn it off anytime in Settings. We strip emails, IDs, URLs, and phone numbers, but rows remain associated with your account so you can export or delete them. Automated review payloads omit your user id. We do not use this to train a public foundation model, and we do not authorize AI providers to train public models on your Service content. Per-course Mentor memories stay in your account under row-level security and are used only to personalize mentoring to you.

We use subprocessors to host and operate the Service, including:

• Supabase - authentication, Postgres database, file storage, and row-level security isolation.
• OpenAI and/or Vercel AI Gateway - chat completions, embeddings, content moderation, and optional YouTube speech-to-text transcription when captions are unavailable.
• Polar - subscription checkout, customer portal (invoices and payment methods), and payment processing for Mentor Pro on the web.
• Apple App Store - In-App Purchase billing for Mentor Pro on iOS.
• Google Play - Play Billing for Mentor Pro on Android.
• Vercel - application hosting, edge delivery, and operational telemetry.
• Sentry - production error monitoring and privacy-masked session replay (text and media masked by default) used to diagnose failures and optional in-app feedback context.
• GitHub - optional routing of in-app feedback submissions to repository issues when configured.

If you enable optional web research, a search query may be sent to a configured search provider. Your private documents are not uploaded to that provider as a corpus; research is query-based and may still expose the substance of the query you ask.

YouTube, website publishers, and other third-party content sources remain subject to their own terms and privacy practices when we fetch material you request to import.

Cookies and similar technologies

We use essential cookies and similar technologies (including those provided through Supabase Auth) to authenticate sessions and keep you signed in. We do not use advertising cookies or third-party marketing analytics cookies in the current product build. On production, Sentry may store a privacy-masked session replay when diagnosing errors or when you submit in-app feedback (inputs and on-screen text are masked by default).

Your browser may also store local preferences such as theme, language, and accessibility-toolbar settings you choose on your device.

We do not send advertising emails or SMS without prior consent, as required by the Communications Law (Bezeq and Broadcasts) (Amendment 40). Account, billing, security, and service messages are not advertising.

Retention

We retain personal data for as long as your account remains active and as needed to provide the Service, resolve disputes, enforce agreements, and meet legal, tax, or security requirements. You may export a machine-readable (JSON) copy of your learning data from Settings while your account is active. Deleting your account permanently removes your profile, spaces, documents, conversations, and related records from our primary systems, and deletes uploaded files from storage, subject to residual copies in encrypted backups that are rotated out in the ordinary course and any retention required by law.

Your rights and choices

Subject to applicable law, you may:

• Access and export your learning data from Settings.
• Update profile, locale, theme, and certain learning preferences in the app.
• Delete your account from Settings.
• Disable optional features you control (such as web research, Mentor memory, and Help improve Mentor eval sharing).
• Use the Contact link in the site footer or the in-app feedback form in Settings to request correction, additional information about processing, or other privacy rights available under your local law.

We may need to verify your identity before fulfilling certain requests. Some rights may be limited where we must retain data for legal compliance, security, or dispute resolution. Depending on where you live, you may have additional rights. Examples include access, correction, deletion, and portability in the EEA, United Kingdom, Israel, Brazil, Canada, Australia, Japan, and South Korea, and certain opt-out rights in California. We do not sell personal information. We do not maintain a local legal entity, DPO, or privacy policy in every storefront country. Mandatory privacy law where you live is not waived. Use the Contact link in the site footer to exercise these rights. We will not treat you differently for doing so.

Israeli users' access, correction, and deletion rights under the Protection of Privacy Law are in addition to in-app Settings export and delete.

Security

Mentor uses magic-link authentication, HTTPS encryption in transit, Supabase Row Level Security so authenticated users can access only their own rows under normal operation, and private storage for uploaded files. We also apply automated content-safety checks on materials and chat. We aim to meet the Privacy Protection (Data Security) Regulations 5777-2017 for the systems we control. No method of transmission or storage is completely secure. You are responsible for securing access to your email account and magic links. Report suspected unauthorized access or security issues promptly via the Contact link in the site footer or the in-app feedback form in Settings.

Children

We do not market Mentor to children under 13. Native app listings are rated 13+ (Apple Age 13+; Google Play target audience 13 and older). Mentor is not Made for Kids and is not in Google Play Families. The web and native apps do not ask for your age at sign-up. If we learn that an account belongs to a child under 13, or a parent or guardian asks us to, we will delete that account and related data. If you believe we have data about a child under 13, use the Contact link in the site footer or the in-app feedback form in Settings.

International transfers

Our subprocessors may store or process data in the United States, the European Economic Area, Israel, or other regions where they maintain infrastructure. By using the Service, you understand that your data may be transferred to and processed in jurisdictions that may have different data-protection laws than your place of residence. Where required, we rely on appropriate contractual and organizational safeguards offered by our providers.

Changes to this policy

We may update this Privacy Policy to reflect product, legal, or operational changes. We will revise the "Last updated" date at the top of this page. Material changes may also be communicated in-product or by email where appropriate. Continued use of the Service after the effective date of an update constitutes acceptance of the revised Policy, except where applicable law requires a different standard.