Last updated: 19 October 2026
mentorhero connects people with mentors for 30-minute conversations. To do that we need to know some things about you. This policy explains what we collect, why, who sees it, and what you can do about it.
We have tried to write it in plain English rather than legal language. If anything is unclear, ask us and we will explain it properly.
Read it alongside our Cookie Policy, which covers what we store in your browser.
1. Who we are
Mentorhero Limited is the data controller for the personal data described in this policy. We are registered in England and Wales (company number 16861069) at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office (registration number ZC043248).
You can reach us about anything in this policy at privacy@mentorhero.com.
Our Data Protection Officer is Leon Juice, who you can contact at privacy@mentorhero.com.
Your account belongs to you. Even where you joined through an employer, a university or another organisation, your account is yours. We are the data controller for it, and the relationship is between you and us rather than between us and that organisation.
If you leave, your account, your profile and your mentoring history stay with you, and you can carry on using a personal email address. The organisation cannot require us to delete your account, because it is not theirs to delete. What ends is your access to that organisation's program and anything connected to it.
2. Who this policy is for
This policy covers everyone whose data we hold:
- Mentors, who volunteer their time through their employer
- Mentees, whether you come through an employer, a university, a public sector body, or directly
- Parents and guardians, where a mentee is 16 or 17
- Contacts at partner organisations who run mentoring with us
- Anyone who fills in a form on our website, such as joining our waiting list
3. What we collect
When you sign up
Your first and last name, your email address, and a backup email address if you sign up with a work or student one. We record which policies you agreed to, exactly which version, and the date, time, IP address and browser you agreed from. We also keep the signature you draw.
When you verify your identity
Your date of birth, your home address, your country, and your time zone. Optionally, your gender, your ethnicity, and whether you consider yourself to have a disability. Section 5 explains how we treat the sensitive parts of this.
When you build your profile
Your work and education history, your industries and departments, your employment status, your years of experience, your LinkedIn profile, languages you speak, topics you can help with or want help with, your mentoring style, personality traits and a few fun facts. Mentors tell us what they are proud of and why they want to mentor. If you upload a CV or a profile photo, we keep those too.
When you mentor or get mentored
Your availability, your booking preferences, the sessions you book, whether they happened, and the question a mentee submits ahead of a session.
When you fill in a form on our website
When you use a form on mentorhero.com, such as joining our waiting list or asking about working with us, we keep your answers. Usually that is your name, your email address, your organisation and what you would like from us. If you join the waiting list as a mentee, we also ask for your current situation, where you work and your job title or where you study, your CV, and your LinkedIn profile if you choose to give it. Every file is checked for viruses before we keep it, and only our team can open it. A form is saved as you go, so if you give us your email address and leave before sending it, our team may still see what you entered and get in touch.
When we contact you
A record of every email and text we send you, including whether it was delivered, whether it failed, and whether it was opened.
Mentors matched with under-18s
If you may be matched with a 16 or 17 year old, we record your background check: the type, the level, the certificate number, the issue and expiry dates, whether a barred list was checked, and notes from our verification. See section 5.
Parents and guardians
Your name, your email address, your relationship to the young person, and your decision on consent, with the date and the version you were shown.
4. Where we get your data from
Most of what we hold comes directly from you, when you sign up, build your profile, set your availability or book a session.
Some of it reaches us another way:
- From your employer, university or organisation, if they invited you to take part. Usually this is your name and work email address, so we can send you an invitation.
- From an organisation you applied to for a job, if you were referred to us after an unsuccessful application. They pass us your name and email address so we can offer you a mentor.
- From a parent or guardian, where they have given consent for a 16 or 17 year old.
- From our own systems, such as records of the emails we send you and whether they arrived.
If your data reached us from someone else rather than from you, we will tell you where it came from when we first get in touch. You can ask us about this at any time.
5. Sensitive information, and why we ask
Some of what we collect gets extra protection in law. We want to be straightforward about it.
Ethnicity and disability. We ask because our whole purpose is widening access to careers, and we cannot show a partner or a funder that we are reaching underrepresented people if we never ask. These questions are genuinely optional. You can skip them, or answer "prefer not to say", and it will make no difference to your account, your matches, or anything else. We use them for aggregated reporting, not to decide who gets mentored.
Date of birth. We need it to apply our age rules. Mentors must be 18 or over. Mentees must be 16 or over, and mentees aged 16 or 17 need a parent or guardian to consent before they can be matched. We are not able to accept anyone under 16.
Background checks. Where a mentor may be matched with a 16 or 17 year old, we verify a criminal record check appropriate to their country. This is information about criminal offences, and the law is strict about it. We hold the minimum needed to confirm a check is valid and current, and access is restricted to the small number of staff responsible for safeguarding.
6. Why we use your data, and our legal basis
To create and run your account, match you, and arrange your sessions. Our basis is performance of a contract. This is simply the service you asked us for.
To email and text you about your next steps. Performance of a contract. These messages are how mentorhero works.
To apply our age rules and seek guardian consent. Legal obligation, and our safeguarding duties.
To verify and hold background checks. Safeguarding of children and individuals at risk, under Schedule 1 of the Data Protection Act 2018. We do not rely on consent for this, because a check either exists and is valid or it does not.
To report anonymised impact to partners. Legitimate interests. Partners fund mentoring and need to see what it achieved.
To keep the platform secure and prevent misuse. Legitimate interests.
To record and transcribe mentoring sessions. Safeguarding of children and individuals at risk under Schedule 1 of the Data Protection Act 2018 for the safeguarding purpose, and legitimate interests for improving the service. Section 7A explains this in full, including how to object.
To ask about ethnicity and disability. Your explicit consent, and nothing else. Withdraw it at any time and we delete those answers.
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded ours does not override yours. You can ask us for that assessment.
Where we rely on your consent, you can withdraw it at any time. Withdrawing does not undo anything we lawfully did beforehand, and it changes nothing else about your account.
7. Decisions made automatically
We use software to suggest which mentor might suit a mentee, based on the topics you have chosen, your availability, the languages you speak and the safeguarding rules that apply.
Matches are generated automatically. If you are unhappy with a match, you can ask us to review it and a member of our team will look at it personally. Email privacy@mentorhero.com.
Matching only decides who you are offered a conversation with. It does not affect your legal rights, your job, your studies or your access to anything outside mentorhero. You can decline any match, and you can ask us why one was suggested.
We do not sell your data, and our suppliers are contractually prevented from using it for their own purposes. We do use session transcripts to improve how matching works, which is explained in section 7A. We do not use your data to build or train any model that is sold, licensed or made available outside mentorhero.
7A. Session recordings and transcripts
We record mentoring sessions. Recording is part of how the service works rather than something you switch on, because it is one of the main ways we keep mentees safe.
Why we record.
- Safeguarding and protection. A recording is the only reliable account of what happened in a session if something goes wrong, for the mentee and for the mentor. Our basis is safeguarding of children and individuals at risk under Schedule 1 of the Data Protection Act 2018.
- Quality and training. So we can see what good mentoring looks like and support mentors who need it. Our basis is legitimate interests.
We also transcribe sessions, and use the transcripts to:
- give you and the person you spoke to a summary of your own session, and the points from it worth remembering;
- improve how we match mentees to mentors, so the next conversation is a better fit;
- understand what people are asking for, where demand outstrips supply, and which themes come up most often;
- report those themes in aggregate, so partners and funders can see what young people actually need; and
- look at how sessions go in general, so we can make them better - for example how the time is shared between the mentor and the mentee, or how much of a session is spent on questions.
Our basis for that is legitimate interests. We have weighed it against your rights and concluded ours does not override yours, and you can ask us for that assessment.
One of those needs to know who said what, and the rest do not. A summary of your own session is only useful if it knows which of you said something, so that one is produced from identified text and is shown only to the two people who were in that session. Everything else - matching, themes, aggregate reporting, and how sessions go in general - is done on de-identified text, and nobody reading those results can tell who you were.
We use an AI supplier to do some of this work, on our instructions and under contract. It is named in section 8 alongside everyone else, it cannot use what it is given for its own purposes, and it does not train on it.
What we do not do. We do not sell recordings or transcripts. We do not give your employer, your university or the partner that referred you access to a recording, a transcript or the content of your conversation, and section 8 sets out exactly what they can see. We do not use your recordings or transcripts to build or train a model that is sold, licensed or made available outside mentorhero.
Joining from somewhere shared. Because sessions are recorded, anyone who may be seen or heard during one should know that. If you join from a shared space, tell the people around you before the session starts, and where you can, find somewhere they will not be in shot or within earshot. That is your responsibility rather than ours, because you are the only one who knows who is in the room with you.
If you appear in someone else's session. A recording can pick up somebody who is not taking part, such as a family member who walks past or speaks in the room. If that is you, we keep it for the same reasons and on the same basis as the rest of this section, we do not try to find out who you are, and you have the same rights over it as anyone in the session. You can ask what we hold about you, or ask us to remove the part you appear in, at privacy@mentorhero.com, and we will act on it unless we have a safeguarding, legal or insurance reason not to.
How long we keep them. We keep session recordings and their transcripts for as long as we operate the service. We do not delete them on a fixed schedule, because a safeguarding concern about a session can surface years after it happened, and a recording that has been deleted cannot protect anyone.
You can still ask us to delete a recording of a session you were in, and we will consider it properly and act on it unless we have a safeguarding, legal or insurance reason to keep it. If we refuse, we will tell you why. Closing your account does not by itself delete recordings of sessions you took part in, because another person was in that conversation too.
Objecting. You can object to the use of your transcripts for service improvement and trend analysis at any time, and we will act on it. Email privacy@mentorhero.com. We cannot switch off recording itself while you use the service, because it is a safeguarding measure that protects everyone in the session, but you are always free to close your account.
7B. Messages you write during a session
You can write to each other during a session, and we keep what is written. The chat sits beside the video on the session page, and what you send is saved.
Why we keep it.
- So you can both look back at it. A link somebody shared, a book they recommended, the name of a course - it is still there on the session page afterwards, for both of you. Our basis is that we need it to provide the service you signed up to.
- Safeguarding and protection. What was typed in a session is part of what happened in that session, in the same way the recording is. Our basis is safeguarding of children and individuals at risk under Schedule 1 of the Data Protection Act 2018.
Who can see it. The two of you, and the small number of people in our team who handle safeguarding. We do not give your employer, your university or the partner that referred you access to what you wrote, any more than we do to a recording or a transcript. Section 8 sets out everyone who can see your data.
The chat closes when the session does. You can write to each other while the session is open and for a short time afterwards, and then it becomes something you can read but not add to. That is deliberate rather than a limitation: mentoring happens in the session, and a channel that never closes is a different thing from a conversation.
How long we keep them. The same as recordings - for as long as we operate the service, and for the same reason, which is set out in section 7A. You can ask us to delete a message you sent, and we will consider it properly and act on it unless we have a safeguarding, legal or insurance reason to keep it. If we refuse, we will tell you why.
What we do not do. We do not sell messages. We do not use what you write to build or train any model that is sold, licensed or made available outside mentorhero.
8. Who sees your data
Your mentor or mentee. Before a match is confirmed we show only the challenge, the topic and the question, with no name and no photo, so that matching is not influenced by who someone appears to be. Once a session is confirmed, you each see the other's name, profile and photo. Before the session we also send each of you a briefing about the other, prepared from your profiles and the question asked. A mentor's briefing also draws on the mentee's CV, which the mentor can already see. We keep a copy of each briefing we send, as a record of the session (see section 10). We use AI to help prepare these briefings, and to read a CV our own software cannot, for example a scan.
Your employer, university or organisation, if you joined through one. They can see the mentor, your full name, the country you are in, the topic, the question you submitted, and the details of the session such as when it took place and whether it was completed. They can see this individually only where there is enough activity to keep individuals from being identifiable; below that, they see aggregate numbers only.
They cannot see the conversation itself or any notes from it, your contact details, or your ethnicity, disability or date of birth.
Redirect is different. If you came to mentorhero after an unsuccessful job application, the organisation that referred you is shown aggregate numbers only. They are never told whether you signed up, whether you took a session, or anything else about you individually.
Parents and guardians. Where a mentee is 16 or 17, their guardian is told enough to give informed consent, and can choose to receive session notifications.
Companies that help us run mentorhero. We use a small number of suppliers who process data on our instructions and cannot use it for their own purposes:
- Supabase stores our database and files, hosted in London
- Vercel hosts our websites
- Resend sends our emails
- AttachmentScanner checks every file uploaded to mentorhero for viruses and malware before we accept it
- PDFShift turns the briefing each of you receives before a session into a PDF document, on servers in France. It processes only what we send it, keeps nothing once the document is made, and cannot use it for its own purposes
- Twilio sends verification texts
- Daily runs the video sessions, and provides the recording and transcription behind section 7A
- Anthropic provides the AI we use to understand what a mentee is asking for, to work with session transcripts as described in section 7A, to read a CV our own software cannot, and to prepare the briefing each of you receives before a session. It processes only what we send it, cannot use it for its own purposes, and does not train on it
- Whereby ran the video sessions before Daily and has been retired
- Stripe processes partner payments
- Earthly plants a tree for each completed session, and receives no personal data
Regulators and authorities. We will share data where the law requires it, for example with a court, the police, a local authority safeguarding team, or the Information Commissioner's Office.
If our business changes hands. If mentorhero is ever sold, restructured or merged, personal data may pass to the new owner and their advisers, under confidentiality terms. If that affects how your data is used, we will tell you.
Nobody else. We do not sell your data. We do not share it with advertisers.
9. Where your data is held
Our database is hosted in London. Some of our suppliers are based outside the UK, so your data may be transferred abroad. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Agreement issued by the Information Commissioner's Office, supported by a transfer risk assessment. Ask us and we will tell you what applies to a particular supplier.
10. How long we keep it
- Your account: while it is active, and for 2 years after you last use mentorhero. Then we delete or anonymise it.
- Session records: anonymised impact data is kept indefinitely, because partners rely on it for long-term reporting. It cannot be traced back to you.
- Policy consents and signatures: 6 years after your account closes, because they are the record of an agreement.
- Background checks: for as long as you may be matched with a young person, and 6 months after that. Certificate numbers are then deleted.
- Guardian consents: until the young person turns 18, plus 6 years, in line with safeguarding record-keeping.
- Email and text logs: 2 years.
- Website forms, and a CV sent with one: until you ask us to delete them.
- Session briefings: while your account is active, and for 3 years after, the same as a CV. Then we remove anything that identifies you or the other person, and keep the rest so we can understand what people ask for and how well matching works.
- Session recordings and transcripts: kept for as long as we operate the service, for the safeguarding reason set out in section 7A. You can ask us to delete a specific recording and we will consider it properly.
When we delete something, it disappears from mentorhero straight away. It may persist a little longer in our encrypted backups before those are overwritten in the normal course of things. Backups are never used for anything except restoring the service after a failure.
11. Emails we send you
There are two kinds, and they work differently.
Service emails are part of the mentoring itself: verifying your email, your next onboarding step, session offers, reminders and confirmations. You cannot opt out of these while your account is open, because without them mentorhero does not function. If you want them to stop, close your account.
Marketing emails are things like our newsletter and updates about what mentorhero is doing. We only send these where you have agreed, or where you are already involved with us and the law permits it. Every one has an unsubscribe link, and unsubscribing takes effect straight away. It has no effect on your service emails or your account.
We may record whether a marketing email was opened, so we can tell what is worth sending.
12. Your rights
You can ask us to:
- Show you what we hold about you
- Correct anything wrong
- Delete your data, though we may need to keep some for safeguarding or legal reasons
- Stop or limit how we use it
- Hand it over to you or another service in a portable format
- Object to anything we do on the basis of legitimate interests
- Withdraw consent for the optional diversity questions
Email privacy@mentorhero.com. We will reply within one month. If your request is especially complex, we may need up to two months more, and we will tell you within the first month if so. There is normally no charge.
We may need to check who you are before we answer, particularly where a request concerns a young person's record or sensitive information.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113. We would rather you came to us first so we can put it right.
13. If you are 16 or 17
You can use mentorhero as a mentee, but only with a parent or guardian's consent, which we ask for before you are matched with anyone.
Your mentor will have passed a criminal record check appropriate to the country you are both in. Your sessions are structured and virtual. Your guardian can ask us anything about your account, and can withdraw consent at any time, which stops future sessions.
If anything ever makes you uncomfortable, tell us straight away at privacy@mentorhero.com. You will always be taken seriously.
We cannot accept anyone under 16. If we find out an account belongs to someone under 16, we will close it and delete the data.
14. Keeping your data safe
Your data is encrypted in transit and at rest. CVs, profile photos and signatures are held in private storage that cannot be reached by a public link. We use database-level access rules so people can only see the records they are entitled to, and staff access to sensitive material is limited to those who need it for safeguarding.
We sign you in with a one-time code sent to your email rather than a password, so there is no password of yours for anyone to steal.
No system is completely secure. If you think something has gone wrong with your data, tell us immediately at privacy@mentorhero.com.
15. Changes to this policy
We may update this policy as mentorhero develops. If we make a material change we will tell you and ask you to review it. The date at the top tells you when it last changed, and we keep every previous version.
16. Contact us
Mentorhero Limited (company number 16861069) 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ privacy@mentorhero.com