Legal · Privacy
Privacy Policy
Last updated: October 29, 2026
This page explains what MentorDrop does with data when you visit mentordrop.com, use a professional’s client pages or manage an account. The account holder is the mentor, expert, coach or business that uses MentorDrop to provide services to its clients.
The essentials
Controller
Jose Ramon Leon Rodriguez, sole trader established in Poland. Egipska 5/69, 03-977 Warszawa, Poland · hello [at] mentordrop.com.
When you use a professional’s services
The account holder is the controller and MentorDrop processes data on its instructions (Terms, §11). MentorDrop is the controller for its own customer accounts, billing, security, support and site measurement.
Optional measurement
Analytics and advertising follow your preferences. We never send questions, answers or account content to DataFast or Meta.
Who is responsible for what
Activity on a professional’s client pages: participants, questions, answers, audio, videos, events, Qualify applications, articles, sales, event registrations and email capture (Kit).
The account holder (our customer). MentorDrop is its processor. Exercise your rights with the account holder first; its contact appears in its notices.
Customer accounts and Studio users, billing, security, support, and measurement of mentordrop.com.
MentorDrop.
Sales by account holders
When an account holder sells courses or Spaces, the account holder is the seller and the controller of its buyers’ data. Payment runs through a Stripe account in the account holder’s name, under Stripe’s terms with the account holder; we never see full card numbers. MentorDrop stores the purchase and access records (buyer, offer, amount, status, what the buyer accepted at checkout) on the account holder’s behalf while the MentorDrop account exists; deleting the buyer’s account erases the email and checkout acceptance stored with their purchases and, while the account holder’s Stripe account that took the sale is still connected, cancels their live subscriptions and instalment plans in Stripe, without a refund. The content of Stripe’s payment notifications is deleted after 90 days.
Why and on what basis
Provide the service to the customer: accounts, client pages, Studio, notifications.
Contract (art. 6.1.b GDPR).
Process participants’ and applicants’ data on a professional’s client pages.
The account holder’s instructions; the account holder states its own basis in its notices.
Security, abuse prevention, incident investigation.
Legitimate interest (art. 6.1.f).
Billing, invoices, accounting.
Contract and legal obligations (art. 6.1.b and c).
Support and service messages.
Contract and legitimate interest.
Measure acquisition and advertising on mentordrop.com.
Consent (art. 6.1.a) where the law requires it; elsewhere our legitimate interest (art. 6.1.f) in knowing which pages and campaigns bring customers, until you disable it. Withdraw any time in Cookies or in Studio › Settings › General.
Account and billing data are needed to open and bill an account; without them we cannot provide the service. Accessing a professional’s client pages needs an email address. Measurement and the support chat are optional.
Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Write to hello [at] mentordrop.com; we may verify your identity and, for account data, pass the request to the account holder.
You may complain to Poland’s UODO or to the authority where you live or work. Submit a complaint to UODO
What we process
Accounts
Name, email, password hash (Studio only), role, language, time zone, access grants, sign-in codes and links, and the IP and browser of security checks.
Account content
Questions, answers, comments, files, audio and its transcripts, videos, sessions, events and registrations, who entered each event while signed in, articles, Qualify applications (contact details, recordings, transcripts, automatic assessment, campaign tags) and their metadata.
Billing
Plan, subscription and payment identifiers and status, amounts, currency, invoices. Polar is the merchant of record and issues the invoices; we never see full card numbers.
Support
Name, email and the conversation when you open the chat or write to us.
Technical
IP address, user agent, logs, audit records, security signals.
Measurement (optional)
Pseudonymous identifiers, campaign and referrer, and the milestones listed in the Cookie Policy.
Besides what people give us themselves, account holders add participants’ email and name by hand, by CSV or from their own platforms through an access link, and a buyer’s email and payment status come from the account holder’s Stripe checkout.
Providers and transfers
Hetzner Online
Servers, database, load balancer and backups.
Germany (Falkenstein)
Wasabi Technologies
Private files: audio, images.
Germany (Frankfurt)
Bunny.net (BunnyWay d.o.o.)
Store, encode and play Library videos.
Slovenia (EU); worldwide delivery network
Cloudflare
DNS and proxy for all traffic; Turnstile anti-bot checks on public forms; email delivery.
USA
AssemblyAI
Audio transcription.
EU endpoint; company in the USA
OpenAI
Text generation and assessment: answers assembled from mentors’ answers, question titles, Qualify assessments and follow-ups, article drafts, knowledge indexing.
USA
DeepInfra
Text embeddings for search.
USA
Cohere
Ranking of search results.
Canada (adequacy decision)
Polar
Checkout, payments, subscriptions and invoices as merchant of record.
USA
Crisp
Support chat, only when you open it.
France (EU)
DataFast (JustShipIt Pte. Ltd.)
Site analytics, optional.
Singapore
Meta Platforms Ireland
Advertising measurement, optional.
Ireland, USA
Kit
The account holder’s own account: the name and email of people who subscribe to its emails through its video or event form, or by entering one of its free open spaces, to get access (see its notices), and of its buyers, who can say no with one click on the thank-you page after paying. Someone already subscribed to the account holder’s emails is recognised and tagged with what they watched or joined.
USA
Stripe
The account holder’s own account: payments for its sales.
Ireland, USA
Authorities and advisers
When the law requires it or to defend rights.
—
Transfers
Providers process data under their data-protection terms. Transfers outside the EEA are covered by the EU-US Data Privacy Framework or standard contractual clauses where applicable. Ask for a copy of the safeguards at hello [at] mentordrop.com.
CookiesAutomatic features and retention
Automatic features
- The automatic features use an artificial intelligence system: they transcribe audio, prepare answers, assess applications and draft articles.
- A participant may see an answer put together automatically from the account holder’s mentors’ answers, labelled as such. It may be wrong; the participant can always ask the mentor.
- Qualify assesses transcribed answers, together with the name and company typed, against the account holder’s criteria, may ask follow-up questions and write a personalized response. Depending on the account holder’s settings, the outcome is shown automatically or waits for human review. Where an outcome significantly affects a person, the account holder must explain its consequences and provide human review (art. 22 GDPR).
- Articles are drafted automatically from answered questions; the account holder reviews and publishes them.
- We do not train models with your content. The providers of these features receive only the audio or text needed for each request; OpenAI is asked not to store it.
Retention
- Accounts: while active. Deleting your account anonymises your profile and deletes your audio and files as participant; your written text and your answers as mentor stay in the account.
- Account content: as long as the account holder keeps it. Read-only status deletes nothing. If the account holder asks us to close their account, or the contract is terminated, we delete its data within 30 days unless the law requires keeping it (Terms §11).
- Sign-in codes and links: 30 days after use or expiry.
- Open spaces: if you ask to enter one and never confirm your email with the code, we delete the account created 30 days after the last code you asked for, as long as it holds no access or other data.
- Qualify: audio according to the policy shown when applying (deleted when the assessment ends, after 30 days, or kept with the application); the recordings of a failed application 7 days after it failed; test applications 30 days; real applications, with any recording kept, 365 days after completion or, if never completed, 365 days after their last update, sooner if the account holder deletes them.
- Email capture: the name and email go to the account holder’s Kit (for an event or an open space, while it has Kit connected). A contact queued for the list (someone entering an open space, a buyer, a buyer’s unsubscribe) or whose delivery failed waits in an encrypted cache for up to 10 hours, then is deleted. Each subscription at a video, an event or an open space leaves a consent record (the email, what the person saw, the privacy link, where, their IP and when), the account holder’s proof while its account exists: the account holder can download and delete an email’s records, and deleting your account only unlinks them from it. An email typed to check access to a recording is looked up and not kept.
- Event registrations: those of an event that asks for email (name, email, when, and which lives were entered) are kept in MentorDrop while the event exists and, while the account holder has Kit connected, also go to their Kit; the account holder can download those that did not reach it, and download or delete an email’s registrations, and deleting your account deletes yours.
- Event attendance: the signed-in people who entered an event, with the date, while the event exists; the account holder’s team sees how many entered each live; deleting your account deletes them. A visitor who enters leaves a mark in their browser (a cookie, 12 months); at an event that does not ask for email that is all; at one that does, the entry is also kept with their registration and adds the attended tag to them in the account holder’s Kit while they are still subscribed.
- Signing up for a live: a member who signs up for the next live of a space’s event stays signed up while the event exists; the account holder sees how many signed up, not who; deleting your account deletes it.
- Failed background jobs: 7 days. Search vector cache: 24 hours.
- Measurement: Meta attribution is used for up to 90 days after it was allowed; its pseudonymous identifiers then stay in the account’s settings, unused, as a record of the choice while the account exists. DataFast identifiers: until you withdraw.
- Support conversations: while needed to handle your request; deleted when you ask us.
- Invoices and tax records: statutory period. Technical logs: 14 days.
Security, children and changes
Security
Isolation between accounts, access controls, encrypted transport, private storage, audit records. Protect your credentials and tell us if you suspect unauthorised access.
Children and sensitive data
The service is for mentors, experts, coaches and their teams. If minors participate, the account holder must give understandable information and meet the applicable requirements. Do not submit sensitive data unless necessary and lawful.
Changes
We update this page when the product, providers or law change; material changes are notified to customers. Questions: hello [at] mentordrop.com.