How Mentoor processes data on your behalf.

Roles

You (the customer) are the data controller for your end users. Mentoor is the data processor — we only process visitor data on your documented instructions, which means: drafting and serving guides inside your product.

Sub-processors

Current list of sub-processors and why we use each:

• OpenAI / AnthropicAI providers used for draft guide suggestions. Requests are scoped to the project, contain only the signals above, and never include end-user PII.
• Railwayapplication + database hosting (EU region).
• Postmarktransactional email for team invites and account notifications.

International transfers

Mentoor’s primary data center is in the EU. Where a sub-processor sits outside the EU/EEA, transfers happen under the EU Standard Contractual Clauses (SCCs).

Security and audit

Security commitments are detailed on the /security page.

We give you a security overview, our SOC 2 progress, and pen-test summaries on request. Customers on Scale plans can run their own audit once per year with reasonable notice.

Breach notification

In the event of a personal data breach affecting your project, we notify your primary contact within 72 hours of confirmation, with the categories of data affected and the steps we are taking.

Termination + deletion

On request or within 30 days of contract termination, all visitor data, guides, and project configuration are permanently deleted, with backups expiring within a further 35 days.