Privacy Policy

Mentawe is operated by Mentawe.com, a trading name based in the United Kingdom at [REPLACE: Your Contact Address, UK]. Mentawe is not currently incorporated as a registered company. This policy will be updated upon incorporation.

We are the data controller for the personal data you provide when using Mentawe. As a UK-based operator we are subject to UK GDPR. We are in the process of registering with the Information Commissioner's Office (ICO) and will update this policy with our registration number once complete.

Questions about this policy or your personal data should be directed via our contact form.

We collect the following categories of personal data:

• Account data: your email address and a password (stored as a secure hash — we never have access to your plain-text password).
• Profile and onboarding data: career goals, success vision, perceived blockers, motivations, and your company's stated objectives — information you voluntarily provide during onboarding and through continued use.
• Workplace situation data: descriptions of workplace situations you type into the coaching console. These are sent to an AI model to generate coaching responses and stored as part of your session history.
• Stakeholder data: names, roles, influence levels, and inferred characteristics of colleagues you add to your influence map.
• Meeting recordings and transcripts: if you use the meeting recording feature, your audio is processed in real time by OpenAI's Whisper API to produce a text transcript. The audio file itself is not stored by Mentawe. The resulting text transcript and AI-generated meeting analysis (structured notes and political insights) are stored in your account. By using this feature you confirm you have the consent of all meeting participants.
• Google Calendar data: if you connect Google Calendar, Mentawe reads your primary calendar events in your browser session to display upcoming meetings. Calendar event data (titles, times, attendees) is not stored on Mentawe's servers and is not sent to OpenAI unless you explicitly choose to prep a meeting, at which point only the meeting title and attendee names you select are included in the AI prompt.
• Payment data: we do not store card details. Payment is handled by Stripe, who acts as a separate data controller under their own privacy policy. We receive only subscription status, plan details, and an anonymised customer reference.
• Technical data: IP address, browser type, and device information collected automatically by our authentication provider for security purposes.

• To create and manage your account and deliver the Mentawe service.
• To generate AI coaching responses and meeting analyses by sending your situation descriptions, meeting transcripts, and relevant profile context to OpenAI. Your data is processed by OpenAI but is not used to train OpenAI's models via the API by default.
• To transcribe meeting audio: audio recordings are sent to OpenAI's Whisper API, converted to text, and the audio file is discarded. The text transcript is stored in your account for your reference.
• To calculate and store your Navigator Score and track your progress over time.
• To manage your subscription and process payments via Stripe.
• To send you essential service communications (account confirmations, subscription notices). We do not send marketing emails without your separate consent.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

We process your personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b)): account creation, service delivery, and subscription management.
• Legitimate interests (Article 6(1)(f)): security monitoring, fraud prevention, and service improvement, where these interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): financial record-keeping and responding to lawful requests from authorities.

We do not sell your personal data. We share data only with the following sub-processors who are contractually required to protect it:

• OpenAI Inc. (San Francisco, USA) — processes your workplace situation descriptions, meeting transcripts, and audio recordings to generate AI coaching responses and transcriptions. OpenAI does not use data submitted via the API to train its models by default.
• Supabase Inc. (San Francisco, USA) — provides database and authentication infrastructure. All data is encrypted at rest and in transit.
• Stripe Inc. (San Francisco, USA) — processes subscription payments. Stripe is an independent data controller for payment card data under their own privacy policy.

We may also disclose your data where required by law, court order, or to protect the rights, property, or safety of Mentawe, its users, or the public.

Our three sub-processors (OpenAI, Supabase, Stripe) are based in the United States. The UK does not have an adequacy decision with the United States. We ensure appropriate safeguards for these transfers through reliance on each sub-processor's Data Processing Agreements, which incorporate the UK's International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses with a UK Addendum.

• Account and profile data: retained for as long as your account is active, then permanently deleted within 30 days of account closure.
• Session and coaching data: retained for the lifetime of your account to support the Navigator Score trend and your history view.
• Payment records: retained for 7 years to comply with UK financial record-keeping requirements.
• Technical/security logs: typically retained for up to 90 days.

Under UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data where we no longer have a lawful basis to retain it.
• Restriction: ask us to limit how we process your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.

To exercise any of these rights, use our contact form. We will respond within one month. You also have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.

We use only essential cookies required to keep you signed in. No advertising or analytics cookies are set. See our Cookie Policy for details.

Mentawe is a professional service intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with their data, please contact us so we can delete it.

We may update this policy from time to time. We will notify you of material changes by email or by displaying a notice in the app. Continued use of Mentawe after changes take effect constitutes acceptance of the updated policy.

Mentawe.com
[REPLACE: Your Contact Address, UK]
mentawe.com/contact