Legal

Privacy Policy

Last updated: 27 April 2026

1. Who we are

MentorPath Ltd ("MentorPath", "we", "us", "our") operates the MentorPath platform at mentorpath.co.uk. We are the data controller for the personal data described in this policy. If you have any questions, contact us at privacy@mentorpath.co.uk.

2. What data we collect

We collect:

  • Account information — name, email address, role (student or mentor), profile photo.
  • Academic information (students) — university choices, A-levels, GCSEs, school name.
  • Professional information (mentors) — university, degree, expertise, hourly rate, credential documents.
  • Booking & session data — dates, times, session notes, video meeting links.
  • Payment data — processed by Stripe; we store only payment status and amounts, not full card details.
  • Messages — content sent between users on the platform.
  • Usage data — pages visited, browser type, IP address, session duration (for platform improvement).

3. How we use your data

  • To provide and operate the MentorPath service.
  • To process bookings and payments.
  • To send transactional emails (booking confirmations, session reminders, receipts).
  • To verify mentor credentials and ensure platform safety.
  • To improve the platform through aggregated analytics.
  • To comply with legal obligations.

4. Legal basis (UK GDPR)

We process your data on the following bases: performance of a contract (providing the service), legitimate interests (platform safety, fraud prevention, analytics), legal obligation (where required by law), and consent (marketing communications, optional cookies).

5. Sharing your data

We share data only where necessary: with mentors/students as part of the booking service, with payment processor Stripe, with email provider Resend, with hosting provider Vercel, and with our database provider Supabase. We do not sell your data to third parties.

6. Data retention

We retain account data for as long as your account is active. Booking and payment records are retained for 7 years to comply with UK tax and accounting obligations. You may request deletion of your account at any time; we will delete or anonymise your data within 30 days, subject to legal retention requirements.

7. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Request erasure ("right to be forgotten").
  • Object to or restrict processing.
  • Receive your data in a portable format.
  • Withdraw consent at any time.

To exercise any right, email privacy@mentorpath.co.uk. You may also lodge a complaint with the Information Commissioner's Office (ICO).

8. Cookies

We use strictly necessary cookies for authentication and session management. We use optional analytics cookies to improve the platform. You can control cookie preferences via the banner displayed on your first visit.

9. Security

We use industry-standard security measures including TLS encryption, row-level security on all database tables, and regular security audits. However, no method of transmission over the internet is 100% secure.

10. Changes to this policy

We may update this policy periodically. We will notify you by email or in-app notification for material changes. Continued use of the platform after changes constitutes acceptance.

11. Contact

MentorPath Ltd
Email: privacy@mentorpath.co.uk