Mentorhog
Sign inBecomeBe a Mentor

Privacy Policy

Last updated: October 9, 2026

This Privacy Policy explains how MentorHog ("MentorHog," "we," "us," or "our") collects, uses, discloses, and protects personal data when you use our website, and the MentorHog platform that connects mentees with vetted, paid mentors for structured, long-term mentorship (together, the "Service"). It applies whether you're browsing as a guest, signed in as a mentee, or signed in as a mentor.

If you don't agree with this policy, please don't use the Service. If you have questions, contact us at [email protected].

1. Who We Are

MentorHog operates a web-based marketplace connecting mentees with independent, vetted mentors. We are the "data controller" for the personal data described in this policy unless stated otherwise.

2. Information We Collect

Account & profile information

When you create an account, we collect your name, email address, and a password (stored hashed, never in plain text). Depending on your role and how far you complete your profile, we may also collect: years of experience, level of education, an avatar and/or background image, a short bio and tagline, your current company and position, and a location (city, region, country, and coordinates, resolved through Mapbox's place-search — your location search queries go directly from your browser to Mapbox, not through our servers), and your timezone.

We no longer ask for your date of birth or gender. If you gave us either earlier, it is still stored with your account, and you can ask us to delete it at any time (see Your Rights & Choices below).

If you apply to become a mentor, we additionally collect: your discipline/specialty, a LinkedIn profile URL (required), an optional portfolio URL, a résumé (either a link or an uploaded PDF), up to five skills, up to three industries, up to ten languages, and your job history (past positions, employers, and dates).

If you sign up as a mentee, we collect your discipline or area of interest and, if you choose to complete it, a short "goals" questionnaire (what you bring, what you're aiming for, blind spots, resources, and timeline) that you and your mentor use to shape your action plan.

We do not ask for or collect your phone number, Social Security Number, or other government tax ID directly — see §4 on how payment- and identity-verification data is handled by Stripe instead.

What's public

Mentor profiles are discoverable by anyone, signed in or not, through our search: your name, avatar, tagline, city/region/country, timezone, current employer, years of experience, discipline, skills, rating, and session pricing are all visible publicly. Mentee profiles are not publicly browsable, but if you leave a review of a mentor, your name and avatar are shown alongside it on that mentor's public profile.

3. How We Use Your Information

  • To create and administer your account, and to operate mentor search and matching.
  • To process bookings, payments, and mentor payouts.
  • To run video sessions and, where both parties consent, produce a session summary and transcript.
  • To sync a mentor's external calendar for availability, if they choose to connect one.
  • To send transactional emails — booking confirmations, payment receipts, reminders, and account-security notices.
  • To detect and prevent fraud, abuse, and security incidents.
  • To comply with legal obligations.

We do not use your personal data for third-party advertising, and we do not sell your personal data. We use PostHog, a third-party observability and product-analytics provider, to understand how the Service is used, evaluate configured features and surveys, and diagnose errors. PostHog is not used for third-party advertising.

PostHog observability and support

PostHog Cloud receives technical information about your browser and session, pages and product events, and error details generated while you use the Service. When you are signed in to the dashboard, we send your internal account identifier, email address, and name so that support conversations and tickets can be linked to the correct account. Those dashboard identity fields do not include your password or payment details.

4. Payments (Stripe)

We use Stripe, Inc. to process payments and mentor payouts. When you pay for a session or plan, your card details are entered directly into Stripe's own hosted fields — they never pass through or touch our servers.

Mentors are paid out through Stripe Connect. Onboarding — including identity verification and bank account details — happens entirely on Stripe-hosted pages; we only ever receive back a status (verified, pending, action required) and the currency your payouts are made in. We never see or store your bank account number or government ID.

MentorHog takes a 20% platform fee from what a mentor charges for sessions and action plans. Payouts are made weekly, after a short hold period following each session, and are subject to a minimum payout balance.

5. Video Sessions, Recording & AI Summaries (Daily.co)

Live sessions run through Daily.co's video infrastructure. Daily receives each participant's name and an internal session identifier — not your account password or payment details.

Recording is audio-only, and off by default. A session is only recorded if both the mentor and the mentee explicitly opt in for that specific session; declining never blocks you from joining the call. If both parties consent, we use AI (via Daily's own processing — no session audio is currently sent to a separate third-party AI provider) to generate a written summary and a verbatim transcript.

Retention: the raw audio recording is deleted from Daily's servers once processing finishes — we don't keep the audio itself. The verbatim transcript is kept for 30 days after the session and then permanently deleted. The AI-generated summary is kept as part of your booking history so you and your counterpart can refer back to what was discussed. Sessions that last under a minute (e.g., a dropped call) are never recorded or processed at all.

6. Calendar Integration (Google Calendar & Microsoft Outlook)

Mentors may optionally connect a Google Calendar or Microsoft Outlook calendar so the platform can show accurate availability and avoid double-booking. This feature is mentor-only and entirely opt-in — mentees cannot connect a calendar, and nothing about this feature is required to use MentorHog.

What we access

When a mentor connects Google Calendar, we request access to read their calendar list and events, and — only for the specific calendar they designate for MentorHog bookings — to create and remove events on their behalf (so a confirmed session appears on their calendar automatically, and disappears if the session is cancelled). We request their basic Google account email so we know which account is connected. The equivalent applies for Microsoft Outlook/Microsoft 365 calendars.

We store the title, start/end time, and status of external calendar events (so we can compute "busy" blocks) — we do not read event descriptions, guest lists, attached files, or locations.

How we use and protect it

Calendar data is used solely to power availability and booking-sync within MentorHog. We do not use it for advertising, we do not use it to train AI or machine-learning models, and we do not sell it or share it with data brokers.

Specifically, this data is protected as follows. It is transmitted only over HTTPS with TLS. The OAuth access and refresh tokens that authorise the connection are encrypted with AES-256-GCM, using a key held separately from the database and a unique nonce per record, and are decrypted only in memory for the synchronisation the mentor enabled. The cached event times we derive are stored in a managed database encrypted at rest, and are readable only by that mentor's own account after a server-side authorisation check. Internal access is limited to the people who operate and support the service. Disconnecting a calendar deletes the stored connection and cached events and, where the provider supports it, revokes MentorHog's access at Google or Microsoft directly; deleting your account does the same. Section 12 sets out these measures in full.

Google API Services User Data Policy. MentorHog's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Google Sign-In (coming soon)

We plan to offer "Sign in with Google" as an alternative to a MentorHog password. When available, it will request only the minimal, standard scopes needed to authenticate you — your name, email address, and profile photo — and will be used exclusively to create or log you into your MentorHog account. It will not have access to your Google Calendar, Gmail, Drive, or any other Google product; that's governed separately by §6 above, and only for mentors who separately choose to connect a calendar.

8. Email Communications

We use a transactional email provider to send booking confirmations, payment receipts, password resets, and account-security notices. We do not send marketing email you haven't asked for, and email delivery is not used for tracking or advertising purposes.

9. File Storage & Uploads

Files you upload — avatars, background images, résumés, and files attached to action plan comments — are stored with a cloud storage provider. Private files (like a résumé) are served through short-lived, expiring links rather than public URLs.

10. Session Notes, Chat & Reviews

Session notes are private: a mentor's notes and a mentee's notes on the same session are stored separately, and each party can only see their own. Direct messaging between a matched mentor and mentee, where enabled, is not visible to anyone outside that conversation. If you leave a public review of a mentor, that review — including your name and avatar — is shown on their public profile, as described in §2.

11. Cookies & Similar Technologies

We use a small number of strictly functional cookies: one to keep you signed in (HttpOnly, so it can't be read by page scripts), and one first-party device identifier used only for account-security purposes like showing you which devices are signed in and letting you sign a specific one out. PostHog may use cookies or similar technologies for its client-side identifier and service operation. We do not use cookies or similar technologies for third-party advertising.

12. How We Protect Your Information

We apply the following safeguards to all personal data we hold, including the sensitive data described in sections 5, 6 and 7 — calendar data, session recordings and transcripts, and any information received from Google or Microsoft APIs.

Encryption

  • In transit. Every connection to MentorHog — the website, the application, and our API — is served over HTTPS with TLS. We send HTTP Strict Transport Security headers so browsers refuse to connect over plain HTTP. Connections between our application servers and our database are also encrypted.
  • At rest. Our database is a managed database service whose storage and backups are encrypted at rest by the provider. Uploaded files are stored in encrypted object storage.
  • Calendar and third-party access tokens. OAuth access and refresh tokens for Google Calendar and Microsoft Outlook are encrypted with AES-256-GCM using a key held separately from the database, with a unique nonce per record, before being written to storage. They are decrypted only in memory, only for the specific synchronisation the mentor has enabled.
  • Passwords. Account passwords are never stored. We keep only a salted Argon2id hash, which is designed to be impractical to reverse. Nobody at MentorHog can read or recover your password.

Access controls

  • Every request to our API is authenticated and authorised on the server before any data is returned. Being able to guess an identifier is never enough to read a record — the server independently checks that the signed-in account is a participant in the mentorship, booking or action plan concerned.
  • Internal access to production systems and data is limited to the small number of people who need it to operate and support the service, is individually authenticated, and is used only for operating MentorHog, investigating a fault, or responding to a support request or legal obligation.
  • Credentials, API keys and encryption keys are held as encrypted secrets in our hosting platform, separate from source code. They are never committed to our code repository.

Data minimisation

  • We request the narrowest third-party permissions the feature needs. For calendars we read event times and status to compute availability, and we do not read or store event descriptions, guest lists, attachments, or locations.
  • We do not use sensitive data — including anything received from Google APIs — for advertising, and we do not use it to train artificial-intelligence or machine-learning models. We do not sell personal data or share it with data brokers.
  • When you disconnect a calendar or delete your account, the stored connection and the cached calendar data are deleted and, where the provider supports it, our access is revoked with the provider directly. See section 13 for retention periods.

Vendors and incidents

  • The third parties listed in this policy process data on our behalf under their own published security commitments. We share with them only what their function requires — for example, our payment processor receives payment details directly and we never see or store your full card number.
  • If we become aware of a breach affecting your personal data, we will investigate promptly and notify affected users and the relevant supervisory authorities where the law requires it and within the timeframes it sets.

No online service can promise perfect security, and we will not pretend otherwise. What we can commit to is the specific set of measures above, keeping them current, and being straight with you if something goes wrong.

13. Data Retention

  • Session transcripts — deleted 30 days after the session.
  • Session summaries — kept as part of your booking history.
  • In-app notifications — kept for 90 days.
  • Inactive chat conversations — archived (not deleted) after 90 days of inactivity.

Other account and profile data — bookings, payments, reviews — is kept for as long as your account is active, or as needed to meet our legal and financial record-keeping obligations, whichever is longer. We don't currently offer automatic, self-service deletion of your account from within the app — see §14 for how to request it.

14. Your Rights & Choices

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, or to object to or restrict certain processing. To exercise any of these rights, email [email protected] — we'll verify your identity and respond within a reasonable time. Some information (for example, transaction records we're legally required to keep, or a review you've publicly posted) may not be fully deletable, and we'll tell you if that's the case for your request.

15. International Data Transfers

We and our service providers — including our payment processor (§4), video and recording infrastructure (§5), calendar integrations (§6), PostHog (§3), and our email and cloud storage providers (§8, §9) — operate infrastructure in multiple countries, which means your data may be processed outside the country where you live. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

16. Children's Privacy

MentorHog is a professional mentorship platform and is not directed at, or intended for use by, anyone under 18. We do not knowingly collect personal data from children.

17. Changes to This Policy

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you directly.

18. Contact Us

Questions about this policy or how we handle your data? Email [email protected]. If you'd like the specific name of a provider we've described by category above (for example, which email or cloud storage provider we use), email us and we'll tell you.