Privacy policy

1. Who we are

MentorsConnect is a mentorship platform operated by Metaguard Mobitech Private Limited, trading as MemofaceAI, with its registered office at Block BE, Hari Nagar, New Delhi, Delhi 110064, India (“MemofaceAI”, “we”, “us”).

The platform is provided to institutes — coaching centres, academies and training organisations — who use it to run their own mentorship programmes. This distinction matters for your rights, and section 2 explains it.

2. Our role, and your institute's role

When an institute uses MentorsConnect to run its programme, the institute decides what information to collect about its students and mentors and why. We process that information on the institute's instructions, to provide the platform.

In data protection terms the institute is the data fiduciary / controller and we are the data processor.

In practice: if you are a student or mentor, your relationship is with your institute. Requests to see, correct or delete your information should go to them first — they can action most of it themselves in their portal. If you contact us directly, we will refer you to them, or act on their instruction.

We act as controller in our own right for a narrow set of things: our account records for institutes, our billing, our security logs, and enquiries sent to us through this website.

3. What we collect

We collect only what the platform needs to work. We do not buy personal information, and we do not collect it from sources other than you and your institute.

Students

Mentors

Name, photograph, professional title, biography and areas of expertise, availability and time zone, session history, and the ratings and written feedback students leave.

Institute staff

Name, work email and assigned role. We also record significant administrative actions — changes to categories, session types, pricing, fee heads and chat policy, and changes to admin accounts — and, for a cash collection, which staff member approved it.

Collected automatically

Sign-in times, IP address, the device and platform you signed in from, and diagnostic information when something fails. We use these to keep accounts secure, to show you your own active sessions, and to fix faults. We also record who joined each session and when, so an institute can resolve attendance questions.

What we do not collect

• We do not ask for or store your card details. Card numbers are entered on the payment provider's own secure page, not on ours. We keep only the transaction outcome, the amount and the provider's reference.
• We do not record your video sessions. The platform creates the meeting link; it does not join, record or transcribe the session. It does record who joined and when, so attendance questions can be answered.
• The platform does not show your messages to your institute. Administrators can see that a conversation exists, how many messages it holds and when it was last active — enough to answer “was my mentor responsive?” — but not what was said.
• We do not use advertising trackers, and we do not build advertising profiles.

4. Why we use it, and on what basis

We use personal information to:

• create and secure accounts, and sign people in;
• take bookings, hold slots and prevent double-booking;
• process payments and maintain accurate financial records;
• create and control access to session meeting links;
• send transactional messages — confirmations, reminders, changes;
• provide institutes with reporting on their own programme;
• detect and investigate misuse, fraud and security incidents;
• meet legal, tax and accounting obligations.

Where the law requires a legal basis, we rely on: performance of a contract (providing the service you or your institute signed up for), legitimate interests (securing the platform, preventing fraud), legal obligation (tax and accounting records), and consent where consent is specifically asked for — such as push notifications, which you can switch off in your device settings at any time.

5. Who we share it with

We do not sell personal information. We share it only with the following, and only as far as needed:

We may also disclose information where we are legally required to, or to establish or defend legal claims. If we are ever involved in a merger or acquisition, information may transfer as part of that — we would tell you before it happened.

6. Keeping institutes separate

Each institute's data is held in its own isolated space. The platform is designed so that one institute cannot reach another's students, mentors, bookings or figures: the institute a request belongs to is taken from the signed session, never from anything the caller sends, and separation is enforced in the database itself as well as in the application — so it does not depend on the interface choosing what to display.

7. How we protect it

• Our services are served over HTTPS, so traffic between your device and the platform is encrypted in transit.
• Passwords are stored only as salted one-way hashes, never recoverable.
• Payment gateway credentials are stored encrypted, separately per institute.
• Access to production systems is restricted to staff who need it.
• Portal access is role-based, so staff see only what their role allows.
• Meeting links are not included in our API responses; access is checked at the moment of joining, against the booking and the time window.

No system can be guaranteed secure, and we do not claim otherwise. We keep these measures under review as the platform changes. If a breach affects your information we will notify the affected institute and, where the law requires it, the relevant authority and affected individuals, within the timeframes the law sets.

8. How long we keep it

We keep information for as long as the institute's account is active. Bookings, session history, messages, payment records and access logs are retained for the life of that account so the institute has a complete record of its own programme.

We do not delete data automatically on a fixed schedule. Deletion happens when an institute asks for it, when an individual exercises the rights in section 9, or when their agreement with us ends.

When an institute leaves the platform, we delete or return their data in line with their agreement with us, except where we must keep records by law. To request deletion, contact your institute, or write to us at loveneesh@metaguard.in.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal information held about you;
• have inaccurate information corrected;
• have information erased in certain circumstances;
• object to or restrict certain processing;
• receive your information in a portable form;
• withdraw consent where processing relies on it;
• complain to your data protection authority.

Students and mentors: contact your institute — they hold the relationship and can action most requests directly. If they need our help, they can reach us.

Institutes: contact us at metaguardai@gmail.com.

We respond within 30 days. We may need to verify your identity first.

10. Grievance officer

As required under India's Digital Personal Data Protection Act, 2023 and the Information Technology Rules, our grievance officer is:

• Name: Loveneesh Bansal
• Email: loveneesh@metaguard.in
• Address: Block BE, Hari Nagar, New Delhi, Delhi 110064, India

We acknowledge grievances within 48 hours and aim to resolve them within 30 days, and in any case no later than the period required by law.

11. Children

Institutes may enrol students under 18. Where they do, the institute is responsible for obtaining the verifiable parental or guardian consent that the law requires, and for confirming to us that they have it. We do not knowingly collect information directly from a child without that consent. If you believe a child's information has been provided to us improperly, contact us and we will act on it.

We do not use children's data for advertising, tracking or profiling of any kind.

Messaging between students and mentors

A student may exchange messages with their mentor. Mentors are not members of the public: each one is appointed by the institute the student is enrolled at, and the institute is responsible for vetting them and for supervising their conduct.

Conversations are confined to a single institute, and a conversation is only ever visible to the two people in it. A conversation is started by the student, or opened automatically when a session is booked; a mentor cannot start one and can only reply where a student has already written to them. Depending on how the institute has configured the service, a student may need a booked session with that mentor before they can send a message.

As set out above, administrators can see that a conversation exists and whether it is active, but not what was said. That protects a student's privacy in the ordinary case. It is not a bar to acting on a concern: where a student, a parent or guardian, or the institute reports a conversation, we will make its contents available to the institute, and to the police or a child-protection authority where the law requires it or a child's safety calls for it.

To report a conversation, contact the institute directly or write to our grievance officer above. Reports concerning a child's safety are treated as urgent and are not subject to the ordinary 30-day window.

12. Where your information is held

The platform is hosted on Amazon Web Services infrastructure located in the European Economic Area. Amazon Web Services operates the underlying data centres under its own security and compliance programme; we control the data held on them.

Some of the service providers listed in section 5 process information in other countries — payment gateways, the video meeting provider, and email and push notification services each operate their own infrastructure.

Where information is transferred across borders, we rely on appropriate safeguards as required by applicable law, including the transfer provisions of India's Digital Personal Data Protection Act, 2023.

Institutes with their own data residency requirements should raise them with us before onboarding, so that hosting can be arranged accordingly.

13. Changes to this policy

We may update this policy as the platform changes. The date at the top shows the latest version. For material changes we will notify institutes, who will inform their users where needed. Continued use after a change means the updated policy applies.

14. Contact us

Questions about this policy or how we handle information: metaguardai@gmail.com, or write to Block BE, Hari Nagar, New Delhi, Delhi 110064, India.