Global Privacy Policy

Welcome to Mentofy. This Privacy Policy outlines how Mentofy ("Mentofy," "we," "our," or "us") collects, uses, discloses, and protects personal information when you access or use our platform, services, websites, mobile applications, and related offerings (collectively, the "Services").

This Policy is designed to comply with global data protection laws, including but not limited to the GDPR (EU), UK GDPR, CCPA/CPRA (USA), PIPEDA (Canada), Privacy Act (Australia), PDPA (Singapore), POPIA (South Africa), PDPO (Hong Kong), DPDP (India), and Vietnam's Law on Cybersecurity and Decree 13/2023/ND-CP.

Mentofy is a global EdTech company that provides intelligent exam systems, learning platforms, and data-driven education solutions to individuals, educators, and institutions worldwide.

This Policy applies to:

• Visitors to our websites
• Registered users of Mentofy services
• Institutional clients and their users
• Contractors, educators, and examiners

Information You Provide

• Name, email, phone number, address
• Institution name and role
• Student and teacher data (enrollments, scores, etc.)
• Uploaded content (quizzes, exams, documents)
• Payment and billing details
• Communications with support or other users

Information We Collect Automatically

• IP address, location (country based not approx)
• Device type, browser, operating system
• Session logs, activity logs
• Cookies and usage tracking (e.g., pages viewed, clicks)

Information From Third Parties

• Social media accounts (if linked)
• Integrated platforms (e.g., LMS, payment systems)
• Marketing affiliates and referrers

We use personal data for the following purposes:

• To provide and maintain our Services
• To personalize user experience and recommendations
• To process payments and manage subscriptions
• To provide customer support and service updates
• To conduct analytics, research, and development
• To fulfill legal, contractual, and compliance obligations
• To detect and prevent fraud or security threats
• To communicate service announcements and promotions

We rely on the following legal bases:

• Consent
• Performance of a Contract
• Legal Obligation
• Legitimate Interest
• Vital Interest (in emergency scenarios)

We may share data with:

• Cloud hosting providers (e.g., Cloudflare, Google Cloud)
• Payment processors (e.g., DODO Payments, PayPal, Xendit)
• Email and notification services
• Educational institutions and administrators (when applicable)
• Authorized resellers or affiliates (under strict contracts)
• Legal authorities or regulators (if required by law)

All data-sharing is governed by Data Processing Agreements (DPAs) or equivalent safeguards.

We operate globally. Your data may be transferred to and processed in countries outside your jurisdiction. Where required, we use:

• Standard Contractual Clauses (SCCs)
• International Data Transfer Agreements (IDTAs)
• Binding Corporate Rules (where applicable)
• Adequacy decisions under GDPR

Mentofy implements strong technical and organizational measures:

• End-to-end encryption (TLS 1.3, AES-256)
• Regular vulnerability assessments and penetration testing
• Role-based access controls and audit logs
• 24/7 infrastructure monitoring
• Secure software development practices (DevSecOps)

We retain data only as long as necessary for the purposes outlined or to comply with legal, regulatory, or contractual obligations:

• Account data: Until deletion request or inactivity period (24 months)
• Exam records: As agreed by institutional contract
• Financial data: Minimum 7 years (compliance)

Mentofy does not knowingly collect personal information from users under the age of 13, or the equivalent minimum age in relevant jurisdictions, without parental or institutional consent.

Depending on your jurisdiction, you may have the following rights:

• Access your personal data
• Rectify inaccurate or incomplete data
• Erase your data ("Right to be Forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

Requests should be sent to [email protected].

Mentofy uses cookies and similar technologies to:

• Maintain sessions
• Analyze user behavior
• Improve performance
• Provide personalized content

Cookie preferences can be adjusted via browser or our Cookie Settings panel.

Third-party services linked through Mentofy (e.g., Google Docs, YouTube, LMS tools) are governed by their own privacy policies. We are not responsible for their practices.

We may use machine learning models to provide insights and recommendations. These do not produce legal effects or similarly significant impacts unless explicitly required and contractually agreed upon.

We reserve the right to update this Privacy Policy. Material changes will be communicated via email or platform notifications. Continued use of Mentofy Services indicates acceptance of the updated terms.