MENTORALegal
Privacy Policy
Last updated: 2026
This is a starting template. Because Mentora handles data of minors and their parents under India’s DPDP Act 2023, have it reviewed by a qualified lawyer before you rely on it publicly. Replace the bracketed placeholders.
Who we are
Mentora (“we”, “us”) operates the Mentora learning platform at [your domain]. For any privacy question, contact us at [privacy@yourdomain].
What we collect
Account details you provide when registering: student name, email, phone, class level, stream and target exams. For students under 18 we also collect a parent/guardian’s name, relationship, email and phone in order to obtain verifiable parental consent. We record consent events (including a timestamp and IP address) as an audit trail. When you take tests we store your answers, scores and attempt history. If you purchase Premium, our payment processor (Razorpay) handles your card/UPI details — we do not store them; we retain only the order and payment reference.
Why we collect it
To create and secure your account, obtain and record parental consent, deliver learning content and tests, show your results and progress, process payments, and comply with legal obligations.
Parental consent (minors)
Students under 18 can register but cannot access gated content until a parent/guardian confirms consent via the link we email them. You (the parent) can withdraw consent or request deletion at any time by contacting [privacy@yourdomain].
Who we share it with
We share data only with service providers that help us run the platform — our cloud host (DigitalOcean), email provider, and payment processor (Razorpay) — and only as needed to provide the service, or where required by law. We do not sell personal data.
Data retention
We keep account and attempt data while your account is active. You may request deletion; we will remove your data unless we are required to retain certain records (e.g. payment records) by law.
Your rights
Under the DPDP Act you (or a parent, for a minor) may access, correct, or request deletion of personal data, and withdraw consent. Contact [privacy@yourdomain] to exercise these rights.
Security
We use industry-standard measures (encrypted connections, hashed passwords, access controls). No system is perfectly secure; we will notify affected users and authorities of a breach as required.
Changes
We may update this policy; material changes will be posted here with a new “last updated” date.