Last updated: October 14, 2026
This policy explains what personal data AiMentoring handles when you visit aimentoring.com, try the demo, hold an account or use a seat provided by your employer, why we handle it, who else touches it and what you can ask us to do with it. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
1. Who is responsible for your data
The controller of personal data processed through the service is the administrator of the aimentoring.com service. You can reach the administrator about anything in this policy at [email protected]. We answer privacy requests from that address and do not use any other channel for them.
On Teams and Enterprise plans the picture is different for seat data, as described in section 7.
2. What this policy covers
It applies to the public website, the one-time demo roadmap, the web app you use after signing in, the emails we send you (sign-in codes, Friday check-ins, billing notices) and support conversations by email. It does not apply to other websites you reach through links on our pages.
3. What we collect
We collect only what the service needs to work. Depending on how you use AiMentoring, that includes the following categories.
- Account data. Email address, the name you choose to show, a hashed password, your time zone and business hours for check-in emails, your plan and role (owner, admin or member) and, on company plans, the workspace you belong to.
- Goals and roadmaps. The goal you type in free text, the horizon you pick (3, 6 or 12 months), your stated current level, the milestones, weekly tasks and due dates generated for you, and whether you completed them.
- Assessments. Your answers to the adaptive level questions and the resulting skill radar scores from 0 to 5.
- Sessions. The messages you exchange with an AI mentor and the mentor's replies.
- Mentor memory. Structured notes each session writes about you so the mentor does not start from zero next time: facts you shared, wins, blockers and preferences.
- Uploaded materials. Files and text you submit for review, such as a pitch deck, CV, call transcript, code snippet or essay, together with the inline comments produced about them.
- Usage counters. How many mentor messages, material reviews and active goals you have used in the current billing period and today.
- Billing metadata. Plan, billing period, number of seats, amounts, invoice numbers, the last four digits and brand of your card, its expiry month and country, and the status of each payment. Full card numbers are entered directly with our payment operator and never reach our servers.
- Technical logs. IP address, browser and device type, pages requested, timestamps, error reports and security events such as failed sign-in attempts.
- Demo inputs. If you try the demo without an account, the goal, mentor, horizon and level you entered, the fragment of roadmap produced and a hashed form of your IP address used to keep the demo to one try.
- Campaign attribution. If you arrive by clicking one of our own ads or a link with campaign parameters, the campaign identifiers and the first page you landed on (see the Cookie Policy).
Please do not put special categories of data (health, religion, sexual orientation, political opinions and similar) or other people's personal data into goals, sessions or uploads unless you truly need to and are entitled to share it.
4. Why we use it and on what legal basis
Under Article 6 of the GDPR every use needs a legal basis. Ours are these.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account, generating assessments, roadmaps, tasks, mentor replies and material reviews | account, goals, assessments, sessions, mentor memory, uploads, usage counters | performance of a contract, Art. 6(1)(b) |
| Enforcing plan limits and daily caps | usage counters, account data | performance of a contract, Art. 6(1)(b) |
| Taking payments, issuing invoices, keeping accounting records | billing metadata, account data | contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Friday check-ins, task reminders and service notices | account data, tasks | performance of a contract, Art. 6(1)(b) |
| Running the anonymous demo once per visitor | demo inputs, hashed IP | legitimate interest in offering a fair preview without abuse, Art. 6(1)(f) |
| Keeping the service secure, detecting fraud and abuse, fixing faults | technical logs, billing metadata | legitimate interest, Art. 6(1)(f) |
| Measuring which of our own campaigns lead to paid subscriptions | campaign attribution, plan purchased | legitimate interest, Art. 6(1)(f), and consent where local law requires it, Art. 6(1)(a) |
| Answering your emails and handling disputes or legal claims | correspondence, account and billing data | legitimate interest, Art. 6(1)(f), and legal obligation where applicable |
Where we rely on legitimate interest, we have weighed it against your rights, and you can object as described in section 10. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. Skill radar scores, weekly scores and drill scores are coaching aids for you, not assessments of you for an employer.
5. How AI processes your content
Mentor replies, roadmaps, assessments, weekly task plans and material reviews are generated by sending the relevant part of your content (your goal, recent session messages, mentor memory, the file under review) to an AI model provider. That provider acts as our processor under a written agreement: it may process the content only to return a result to us and may not use it for its own purposes.
We use your content solely to provide the service to you. We do not use your goals, sessions, mentor memory or uploads to train public or general purpose AI models, and we do not sell them. Only the content needed for a given request is sent, and the result is stored in your account.
AI output can be wrong or incomplete. How to treat it is covered in our Terms of Service.
6. Who receives your data
We do not publish a list of individual suppliers, but we do tell you which kinds of recipients handle your data. Each of them acts as our processor, bound by a contract that limits its use of the data to the service it provides to us.
- A hosting provider that runs our servers and databases.
- An AI model provider that generates mentor content, as described in section 5.
- A payment operator that processes card payments and stores card details. You see this operator on the checkout screen.
- An email delivery provider that sends sign-in codes, check-ins and billing emails.
Beyond these, we disclose data only where the law obliges us to (for example to a tax authority or a court), to defend legal claims, or to a successor if the service is transferred, in which case this policy continues to protect your data.
We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are defined in the CCPA/CPRA. When a subscription follows a click on one of our own ads, we report that conversion to the advertising platform where the ad ran, using the click identifier that platform itself created, so that we can measure our campaigns. We do not upload your goals, sessions or files for this, and you can ask us to stop at any time by writing to [email protected].
7. Company plans and seat data
When your employer or another organisation buys Teams or Enterprise seats and invites you, that organisation is the controller of the data relating to your seat: who holds a seat, roles, invitation status and the aggregated reports it receives. We process that data on its behalf as a processor. Enterprise customers can sign a data processing agreement and choose an EU or US data region.
The HR panel is built so that an employer sees patterns, not people:
- it shows only aggregated figures such as adoption, number of active goals, average progress and skill gaps by team,
- no number is shown for any group of fewer than 5 people,
- it never shows your conversations, your uploaded files, your mentor memory or your individual scores.
Workspace owners and admins can see the list of seat holders and their seat status in order to manage seats. If you have questions about how your employer uses the aggregated reports, ask your employer first; we will help it respond.
8. International transfers
Our suppliers may process data outside the country where you live, including in the United States and the European Economic Area. Where personal data of people in the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum), together with additional measures where needed. You can ask for a copy of the relevant safeguards at [email protected].
9. How long we keep data
| Data | Retention |
|---|---|
| Account data, goals, roadmaps, assessments, sessions, mentor memory and uploads | while your account is active, then deleted within 30 days of your deletion request or account closure |
| Billing records and invoices | as long as tax and accounting law requires, typically 5 to 10 years depending on the jurisdiction |
| Technical logs | 90 days, longer only for a log tied to a specific security incident or dispute while it lasts |
| Demo inputs and hashed IP addresses | 30 days, unless you create an account and claim the demo roadmap, in which case it becomes part of your account |
| Correspondence with support | up to 3 years after the matter is closed, to handle follow-up questions and claims |
Backups are overwritten on a rolling basis, so deleted data can remain in an encrypted backup for a short additional period before it disappears.
10. Your rights
If the GDPR or UK GDPR applies to you, you have the right to:
- access the personal data we hold about you and receive a copy,
- have inaccurate data corrected,
- have data deleted where there is no reason for us to keep it,
- restrict processing in certain situations,
- receive data you gave us in a structured, machine-readable format (portability), including your goals, roadmaps and session history,
- object to processing based on legitimate interest, including any measurement of campaigns,
- withdraw consent where processing relies on it,
- complain to the data protection authority in your country of residence or work.
If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, use and disclose, to request deletion and correction, to opt out of the sale or sharing of personal information (we do neither), to limit the use of sensitive personal information (we use it only to provide the service), and not to be discriminated against for exercising these rights. You may use an authorised agent. Residents of other US states with similar laws have comparable rights, and we honour them the same way.
To exercise any right, email [email protected] from the address linked to your account. We may ask you to confirm the request from that address so that nobody else can obtain your data. We reply within one month (GDPR) or 45 days (CCPA/CPRA), and we tell you if we need to extend that period as the law allows. Many actions, such as deleting a goal or closing your account, are also available directly in the app.
Seat holders on company plans can contact us directly, but some requests concern data controlled by the employer, and we may pass them to it.
11. Children
AiMentoring is meant for adults and working professionals. It is not directed to anyone under 16, and you must be at least 16 to create an account or use a seat. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, write to [email protected] and we will delete it.
12. How we protect data
We protect data with measures proportionate to the risk, including encryption in transit (TLS) and at rest, hashed passwords, sign-in codes sent by email, role based access inside workspaces, restricted and logged staff access to production systems, separation of each workspace's data, regular backups and monitoring for unusual activity. Enterprise workspaces can add single sign-on through their identity provider, SCIM provisioning and an audit log. More detail is on our Security page.
No system is perfectly secure. If a breach affects your personal data in a way that creates a risk to you, we will notify you and the competent authority as the law requires.
13. Cookies
We use only cookies that are needed for the site and the app to work, plus a first-party cookie that records which of our campaigns brought you to the site. We do not use analytics or advertising cookies. The Cookie Policy lists every cookie, its purpose and how long it lasts.
14. Changes to this policy
We update this policy when the service or the law changes. The date at the top always shows the current version. If a change materially affects how we use data you have already given us, we will tell account holders by email before it takes effect.
15. Contact
Questions, requests and complaints about privacy go to the administrator of the aimentoring.com service at [email protected].