Menteco Privacy Policy

Effective Date: August 6, 2026 Version: 1.0 (Draft — for legal review)

1. Who We Are

Menteco is a college counseling and mentorship platform operated by Menteco Private Limited ("Menteco," "we," "us"). This Privacy Policy explains how we collect, use, protect, and share personal information when you use the Menteco mentor and student applications, our websites, and related services (together, the "Service").

This Policy applies to:

· Mentors — Independent Educational Consultants (IECs), school counselors, and counseling firms who subscribe to Menteco;

· Students — individuals invited to the Service by a Mentor;

· Visitors to our websites.

If you are under 18, please also review the Student Terms & Consent Notice with your parent, guardian, or counselor.

2. Our Core Commitments

These commitments apply to all student data on Menteco, without exception:

1. We never sell personal information. Not student data, not mentor data, not to anyone, ever.

2. We do not show advertising in the Service and we never use student data for advertising, ad profiling, or marketing to students.

3. Student data is used for one purpose: delivering the counseling and mentorship experience the student's Mentor set up. It is not used to evaluate students, build profiles for non-educational purposes, or train AI models.

4. Your data stays in the United States. All personal information is stored on infrastructure located in US AWS regions.

5. You can get your data out. Mentors and students can request export or deletion at any time (Section 9).

3. Information We Collect

Account information. Name, email address, role (mentor or student), password credentials (stored hashed — we never see your password), and profile details you choose to add.

Student educational information. Provided by students or their Mentors as part of the counseling relationship: grade level, academic goals, college and career interests, application progress, transcripts, test scores, essays or writing samples, and other documents students choose to upload. Uploading documents such as transcripts is always optional.

Communications. Messages between mentors and students within the Service, session notes and summaries, goal and milestone records, and announcements.

Usage and log data. Device and browser type, IP address, pages viewed, actions taken, and timestamps. We keep audit logs of access to sensitive records (such as student profiles and academic records) as a security measure.

Payment information (Mentors only). Subscription payments are processed by Stripe. Menteco does not store full card numbers; we receive limited billing details (such as plan, payment status, and last four digits) from Stripe.

We do not collect: precise geolocation, biometric data, or data from students for advertising purposes. Students are never asked for payment information.

4. How We Use Information

We use personal information to:

· Provide, maintain, and secure the Service;

· Enable mentor–student communication, goal tracking, scheduling, and document sharing;

· Generate AI-powered features such as daily briefings and smart reminders (see Section 5);

· Process Mentor subscription payments and manage accounts;

· Provide customer support;

· Monitor for security incidents, abuse, and fraud;

· Comply with legal obligations.

We do not use personal information for targeted advertising, and we do not use student data for any commercial purpose beyond providing the Service.

5. How Our AI Features Work

Menteco includes AI-assisted features, such as a daily briefing that summarizes student progress and upcoming deadlines for mentors, and smart reminders for students.

To generate these, relevant information from your account (for example, goals, deadlines, and recent activity) is processed by a large language model. We currently use Anthropic's Claude models accessed through AWS Bedrock, running in US AWS regions.

What this means for your data:

· Your data is transmitted securely and processed only to generate your output;

· Your data is not used to train AI models — our configuration with AWS Bedrock does not permit model training on customer inputs or outputs;

· We may change or add AI providers in the future; any provider must meet the same standards (US processing where required, no training on your data, no retention beyond what is needed to provide the feature), and we will update the subprocessor list in Section 7 accordingly.

AI-generated content is informational assistance for the counseling relationship. It may contain errors, and important items such as application deadlines should always be verified.

6. FERPA and Working with Schools

When Menteco is used by a school or district and receives personally identifiable information from education records covered by the Family Educational Rights and Privacy Act (FERPA), Menteco operates as a "school official" with a legitimate educational interest, under the direct control of the school with respect to that data. In that capacity we:

· Use education records only for the purposes authorized by the school;

· Do not disclose education records except as permitted by the school or required by law;

· Delete or return education records at the school's direction or at the end of our agreement.

Schools and districts may request our Data Privacy Agreement (including SDPC National Data Privacy Agreement terms) at privacy@menteco.co.

Independent counseling practices (IECs) are generally not FERPA-covered entities; we nonetheless handle all student data to the same standard.

7. When We Share Information

We share personal information only with:

Subprocessors — service providers who process data on our behalf, under contracts restricting their use of it:

Within the counseling relationship — a student's information is visible to the Mentor(s) who invited them, per the Service's role-based access controls. Mentors and firms can only access their own students; cross-access between firms is not permitted.

Legal requirements — if required by law, subpoena, or to protect the rights, safety, or property of users or others. Where legally permitted, we will notify the affected Mentor (and school, if applicable) before disclosing student data.

Business transfers — if Menteco is involved in a merger or acquisition, personal information may transfer to the successor, who must honor the commitments in this Policy. Student data commitments (Section 2) bind any successor.

We never share personal information with data brokers or advertisers.

8. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will delete it promptly.

For students aged 13–17, an account may only be created with:

· the verifiable consent of a parent or legal guardian, or

· authorization from the student's school or counseling organization, where that organization has obtained appropriate consent or has authority to consent on the parent's behalf (for example, a school acting under FERPA's school-official framework).

Mentors are responsible for confirming this consent exists before inviting a student (see Terms of Service). Students 18 and older may consent for themselves.

Parents and guardians may review, correct, or request deletion of their child's information at any time by contacting privacy@menteco.co or the student's Mentor.

9. Data Retention and Deletion

· Active accounts: data is retained while the account is active.

· Account deletion: mentors and students (or parents of minor students) may request deletion at any time. We delete personal information within 30 days of a verified request, except where retention is legally required.

· Subscription end: when a Mentor's subscription ends, their data and their students' data is retained for 90 days to allow export or reactivation, then deleted.

· Backups: deleted data may persist in encrypted backups for up to 35 days before rotation.

· Logs: security and audit logs are retained for up to 12 months.

10. Security

We protect personal information with measures including:

· Encryption in transit (TLS/HTTPS) and at rest (including AWS RDS encryption);

· Network isolation (VPC) and restricted database access;

· Strict role-based access control — users see only the data their role permits;

· Audit logging of access to sensitive student records;

· Vendor access limited to least-privilege roles.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify affected users and, where applicable, schools and regulators, consistent with applicable law.

11. Your Rights

Depending on your state, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. Regardless of where you live, Menteco honors requests to:

· Access and export your personal information;

· Correct inaccurate information;

· Delete your information (Section 9).

To exercise these rights, contact privacy@menteco.co. For students in a school-managed relationship, some requests may be routed through the school per FERPA. We will respond within 30 days and will never discriminate against you for exercising your rights.

12. Data Location

All personal information is stored and processed in United States AWS regions.

13. Changes to This Policy

We will post any changes to this Policy with an updated effective date. For material changes affecting student data, we will notify Mentors by email at least 30 days before the change takes effect, so schools and parents can be informed.

14. Contact Us

Menteco — Privacy Email: privacy@menteco.co [US mailing address once entity is formed]