Privacy Policy

Registration and authentication

We offer account creation with email and password, and optional sign-in through Google or Microsoft when enabled.

• Direct registration — Personal Data: first name, last name, email address, password (stored in hashed form), role (mentee or mentor), timezone, preferred language, nationality (optional), phone number (optional).
• Google / Microsoft sign-in — Personal Data: email address, name, profile picture, and OAuth account identifiers managed by the provider.
• Session management — authentication cookies and session tokens so you can stay signed in securely.

Mentor profiles, discovery, and applications

Mentors create public or semi-public profiles so mentees can discover and book them.

• Profile and application data — title, company, field, skills, bio, education, experience, pricing, availability, LinkedIn URL, profile photo, intro video, InstaPay payment link, mentor application answers, and review status.
• Saved mentors — if you bookmark a mentor, we store that preference on your account.
• Reviews — ratings and written feedback you submit after sessions.

Bookings, packages, and sessions

When you book a mentor, purchase a package, or manage your schedule, we process booking-related data.

• Booking details — selected time slots, timezone, session brief, booking status, package selections, and references needed to confirm sessions.
• Video sessions — for standard sessions, Mentorees generates a Jitsi meeting link (meet.jit.si) for the booking. The link typically becomes visible to the mentee and mentor about one hour before the session starts. Video calls take place on Jitsi’s service and are subject to their terms and privacy practices.
• Session notes — rich-text notes that mentors and mentees may keep for a session or package, stored on our servers.
• Slot holds — temporary checkout holds while you complete payment.

Handling payments

InstaPay is the live payment method on Mentorees today. Card payments through Stripe may be offered when enabled in the future.

• InstaPay (live) — Personal Data: payment receipt images or screenshots, payment reference numbers, expected amount and currency, verification status, and related booking metadata.
• Automated InstaPay verification — receipt images may be processed by our automated verification service (a self-hosted processor connected to Mentorees) to read payment details and match them against the expected transfer.
• Manual InstaPay review — if a mentee, mentor, or support contact reports a payment problem, or automatic verification fails, our team may manually review the receipt, payment metadata, and related account information.
• Receipt emails — after successful verification, receipt images or payment confirmation details may be emailed to the mentor and to authorized Mentorees administrators for record-keeping and support.
• Receipt retention — receipt images are removed from active storage after automated verification completes under normal circumstances. They may be kept longer while a payment dispute or manual review is open.
• Stripe (not currently live) — if enabled later: name, email address, billing details, and payment information processed by Stripe. We would not store full card numbers on our servers.

Messaging and presence

Signed-in users can message each other in connection with mentorship relationships.

• Messages — message text, timestamps, read status, reactions, and conversation metadata.
• Real-time features — typing indicators and live message delivery through our infrastructure.
• Presence — last-active timestamps used to show online or recently active status.

Media hosting

Profile photos and mentor intro videos are stored using Supabase Storage or equivalent cloud object storage tied to your account.

• Personal Data: uploaded images and videos, file metadata, and storage paths linked to your mentor profile.

Email and SMS communications

We send transactional messages related to your account and bookings only — not marketing emails.

• Email delivery (Resend SMTP) — Personal Data: email address and message content for verification codes, password reset codes, welcome messages, booking notifications, InstaPay payment confirmations, and safety or admin alerts.
• Email routing (Cloudflare Email Routing) — inbound mail sent to addresses on our domain (for example hello@, support@, reports@) may be processed and forwarded by Cloudflare to our team inboxes.
• SMS (Twilio) — Personal Data: phone number and verification codes when you choose phone verification.

Contact, support, and safety reports

If you contact us or report a mentor, we process the information you provide.

• Contact channels — email correspondence sent to hello@, support@, colab@, media@, mentors@, or reports@ addresses on our domain.
• Mentor reports — mentor reference, reason, report details, and verified mentee account identity. Reports may be emailed to our internal reports inbox for review.

Language preference

We store your language preference in a cookie and, when signed in, on your account so the site can load in English or Arabic.

• Personal Data: locale preference (cookie: mentorees-locale).

Authorized staff and administrator access

A small number of authorized Mentorees administrators may access personal data when necessary to operate the platform. Access is limited to staff accounts on an allowlisted basis.

• Review mentor applications and approve or reject profiles.
• Investigate payment issues, InstaPay verification attempts, and payout records.
• Review safety reports, moderate abuse, and respond to support requests.
• Send operational or safety-related announcements when required.
• Access internal admin tools for bookings, users, and platform configuration.

Infrastructure, security, and platform operations

We use service providers to host the application, store data, and protect the platform.

• Database hosting — account, booking, message, and payment metadata stored in PostgreSQL.
• Supabase — database connectivity, file storage, and realtime channels where configured.
• Cloud hosting — application servers and deployment infrastructure used to run Mentorees.
• Rate limiting and abuse prevention — IP address, request metadata, and security logs used to protect accounts and APIs.

Why we process your data

Depending on your location, we rely on one or more of the following legal bases:

• Performance of a contract — to create and manage your account, bookings, messaging, and payments.
• Legitimate interests — to secure the platform, prevent fraud, improve reliability, and handle support requests.
• Consent — where you opt in to optional features such as phone verification, or acknowledge our cookie notice.
• Legal obligation — where we must retain or disclose information to comply with applicable law.

How we share personal data

We do not sell your personal data. We share data only as described below:

• Other users — mentor profiles, messages, booking details, and reviews are shared with the users involved in a mentorship interaction.
• Service providers — email and SMS providers, Cloudflare (email routing), cloud hosts, storage vendors, Jitsi (video sessions), and payment-related processors that help us operate Mentorees.
• Mentors and administrators — InstaPay receipt or payment confirmation details when a booking payment is verified.
• Safety and legal requests — when required by law, to protect users, investigate abuse, or respond to valid legal process.

Cookies and similar technologies

Mentorees uses a minimal set of cookies and similar storage:

• Authentication session cookies — required to keep you signed in securely (NextAuth / session tokens).
• Locale cookie (mentorees-locale) — remembers your English or Arabic preference.
• Cookie consent preference (mentorees-cookie-consent) — stores that you acknowledged our cookie notice.
• Local storage — may be used for short-lived client preferences on certain pages.

Third-party analytics and advertising

The Mentorees web application does not embed third-party analytics, advertising pixels, conversion trackers, or session-recording tools. These services are not integrated in our application code, and our content security policy does not load their scripts on mentorees.com.

We do not send marketing or promotional email campaigns.

• Google Analytics (Universal Analytics) — not used.
• Google Analytics 4 — not used.
• Amplitude Analytics — not used.
• FullStory — not used.
• Cloudflare Web Analytics — not used on the Mentorees website or application.
• Meta Events Manager / Meta Pixel — not used.
• LinkedIn Insight Tag, Microsoft Clarity, and similar behavioral or marketing analytics — not used.

Operational and security logging

Even without third-party analytics, Mentorees still processes limited technical and operational data to run, secure, and maintain the platform. This is first-party data used for operations and safety — not for advertising profiles, cross-site tracking, or selling usage data.

• Rate limiting and abuse prevention — IP address and request metadata processed on our servers to protect accounts and APIs.
• Server and application logs — standard web server, reverse proxy, and security logs (for example nginx access and error logs) on infrastructure that hosts Mentorees.
• Internal admin metrics — aggregated operational statistics from our database (such as user, booking, and payment counts), visible only to authorized administrators; not used for ad targeting.
• Cloudflare — we use Cloudflare Email Routing for inbound mail on our domain; we do not use Cloudflare Web Analytics in the Mentorees app.
• Indirect third-party services — when you open a Jitsi video link, sign in with Google or Microsoft, or complete a Stripe payment if enabled, those providers may process data under their own privacy policies.
• If we introduce optional third-party analytics, advertising, or marketing email in the future, we will update this policy and cookie notice before they go live.

How long we keep data

We retain personal data only for as long as needed for the purposes described in this policy, unless a longer period is required by law.

• Account data — kept while your account is active. When you delete your account in settings, we remove your user record and associated profile data subject to technical and legal limits.
• Messages and bookings — may be retained in anonymized or aggregated form where deletion cascades are blocked by legitimate operational or legal needs.
• InstaPay receipt images — removed after automated verification completes under normal circumstances, or after cleanup periods for abandoned attempts. Images may be retained longer during payment disputes or manual review.
• Security logs — kept for a limited period appropriate for fraud prevention and incident response.

Security

We use technical and organizational measures designed to protect personal data, including encrypted transport (HTTPS), hashed passwords, access controls, rate limiting, and content sanitization for user-generated content.

No method of transmission or storage is completely secure. Please use a strong password and keep your login credentials confidential.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or export your personal data, or to object to certain processing.

You can update much of your profile and account information from your account settings.

You can permanently delete your account from Account settings → Delete Account. Credential-based accounts require password confirmation; OAuth-only accounts follow the in-app confirmation flow. Deletion removes your user data from our active systems, subject to limited retention where required for payments, disputes, or legal compliance.

For other privacy requests, contact support@mentorees.com.