Shared setup
Client privacy and data
Last reviewed: · MentorDrop
Your clients leave their email, their submissions and, if there is audio, recordings and transcripts. You decide why that data is used: you are the controller and MentorDrop is your processor (Terms §11). MentorDrop is the controller only for your own account, billing, support and its website. Full text: Privacy Policy.
What you must do
Give your clients a notice that names you, states your legal basis and how long you keep their data (the sign-in form links to MentorDrop's policy, which points to you); set permissions and retention; answer their requests. If you collect sensitive data, make sure an Article 9 GDPR exception applies. If minors participate, give them understandable information and meet the applicable requirements.
How a client gets in
Email plus a one-time code, no password. The form answers every email the same way, so it does not reveal who is enrolled. A client can delete their account in My account › Delete my account, with a code we email them. Deleting it anonymises their profile, removes their access to every space, withdraws their open submissions and removes their audio, their videos, their photos and the files they attached; the text they wrote stays. Their subscriptions with you are canceled and what they already paid is not refunded; their purchases stay for your accounting, without their email. When it is done, their browser is signed out and shows Account deleted. If they ask you instead, an admin does the same from their profile: Users › Clients, the client, Data, then Delete this client's data (you type their email to confirm); their customer in your Stripe account is not changed, so delete it there if they ask you to.
If someone asks for their data, an admin downloads it from their profile (Users › Clients, the client, Data, then Download their data) or, with their email, from Settings › General › Download a client's data. It is a ZIP with a readable page and the same data as JSON: their profile and designated mentors, their access and support, the libraries they opened, their progress in the videos and the pieces they marked as read, their purchases, their submissions with their conversations, their email consents, their Qualify applications, the events they attended or signed up for and the team's note about them. It also carries the files they uploaded (their photo, their voice notes, their photos and files, and their Qualify recordings while they are kept); each of their videos comes as a link to its original that works for a week.
Email forms on videos and events
A shared video or an event can ask for name and email before playing or entering: the person subscribes to your emails in exchange for the video or their place. The form says so right above the button, before the click, the same in every country: "Subscribe to {your brand}'s emails and get this video free." with the button "Subscribe and watch the video"; on an event, "Subscribe to {your brand}'s emails and save your spot." with "Subscribe and save my spot" (while the live is on, "Subscribe to {your brand}'s emails to join the live session." with "Subscribe to enter"). Under the button: "Unsubscribe with one click whenever you like. Privacy", linking your privacy policy (on an event with no list connected: "Unsubscribe whenever you like. Privacy"). Their name and email go to your list (on an event with no list, they stay in its registrations for you to download and import); unsubscribing later never takes the video or the place away. Each subscription leaves you a consent record (the email, the words they saw, the privacy link, where, their IP and when): download them as a CSV in Settings › Integrations. There, with the email of someone who asks you, Download their data gives you their records and event registrations, and Delete erases them. While your account exists it is your proof; if the person deletes their account, the record stays, no longer linked to it. On an event we also keep their registration (name, email, when, and which lives they entered) while the event exists: its Results say how many there are, and deleting an email in Settings › Integrations deletes its registrations too. Someone who is already an active subscriber of your list is recognised and tagged with the video or event. Your privacy policy must say what you send them and that they can unsubscribe at any time.
Entering an open space also subscribes the person to your emails, whether or not your list is connected: above the button, "Join for free and get {your brand}'s emails.", under it the same line with your privacy policy (without a list, "Unsubscribe whenever you like. Privacy"), and their consent record is kept when they enter. Their name and email go to your list when it is connected; without one, the person is in Users and in the consent records CSV. Someone who asks for the code there and never confirms it is deleted 30 days after the last code they asked for, as long as the account holds no access or other data.
Subscribing through a video or event form does not grant access to a private space. A separately shared video follows its own link settings even if it is also part of a paid library. See Library.
For voice applications, the Qualify guide explains audio-retention choices, application expiry and manual review. These are separate from a client’s space access.
Who can see a submission
| Situation | Visibility outside the team |
|---|---|
| Public answers off | Each account sees only its own cases. |
| Public answers on | Answered, non-private cases can be read by anyone with access to the space. |
| Submission marked private | Only whoever sent it sees it; the admins and the space's mentors see it too. |
| Session unpublished | Clients cannot see it, including the sender. Its authorized team still can. |
"Anonymous questions", in the space's settings, hides who sent each submission in the space, its events' included, from everyone outside your team; it does not remove names written in the text. Each submission keeps what the space said when it was sent: if you change it, we ask whether earlier ones change too. A Knowledge Room lets a session reuse answers from other sessions. An article page shows answers on your website without the author field or the audio, but the text, including the original submission, can still name people: review it before publishing.
Automatic features and providers
The automatic features use an artificial intelligence system. Transcription, pre-answers assembled from your mentors' answers, Qualify assessments and article drafts use the providers in the Privacy Policy; Library videos are stored and played by Bunny.net. Pre-answers are labelled as put together automatically; Qualify may show automatic outcomes, so provide human review where they matter to a person. A read-only account keeps everything, videos included: see pricing and plan limits.