Privacy Policy

Account & profile — your email, name, password (stored as a one-way hash, never in plain text), college, university, branch, semester, division, WhatsApp number if you add one, a profile photo if you add one, and the weak subjects, skills, interests, goals, and placement status you tell us about yourself during onboarding.

What you create in the app — your conversations with Mentor, notes, planner entries, goals, projects, saved code, resume content, and any documents (PDF/DOCX/PPTX) or images you attach to a Mentor message, so their text can be read alongside your question.

Payment records — which plan or credit pack you bought, the amount, and the gateway used. For that purchase, we do not receive or store your card, UPI, or bank details — those go directly to our payment processors (see Section 3).

Campus Ambassador program — if you apply, the college you're representing and a phone number for coordination. If approved, the UPI ID you give us so we can pay out cash commission you've earned. This is a different case from the purchase flow above: this UPI ID does go into our own database, because there's no payment processor standing between us and a payout we're sending you — it's used only for that.

Technical data — IP address (used to slow down abuse and brute-force login attempts, not to track you), login timestamps, and session cookies that keep you signed in.

To run the actual product: answer your questions, generate notes/plans/code/resume content tuned to your branch and semester, track your monthly usage against your plan, save your work so it's there next time you log in, process a payment you initiate, and keep your account secure (rate-limiting, login-lockout protection, optional two-factor authentication).

We do not use your academic or chat data to train our own models, and we do not sell your personal information to anyone.

AI processing — your Mentor messages and any attached document text are sent to OpenRouter, which routes the request to the underlying AI model (providers include Anthropic, Google, OpenAI, and Mistral, depending on which one answers your message) purely to generate a reply. This is the same as any AI-assistant product — the request has to reach a model to get an answer.

Payments — when you pay for a plan or credits, you're handed off to Cashfree, Razorpay, or NOWPayments (for crypto), who process the transaction under their own privacy policies. We only receive confirmation that a payment succeeded, not your card or wallet details.

Infrastructure — our hosting (Vercel) and database (Prisma Postgres) providers store data on our behalf to keep the app running; they don't use it for their own purposes.

Email delivery — to send you account emails (confirming your address, password-reset links and a notice when your password changes) we pass your email address and the message to an email delivery provider, which sends it on our behalf and tells us whether it was delivered or bounced. We keep a log of which account emails were sent to which address and whether they arrived — never the message contents or links — and a short do-not-mail list of addresses that bounced or marked us as spam. These are transactional messages only; we don't send marketing email without asking you first.

We don't share your data with advertisers, and we don't run third-party ad or tracking scripts.

Regional partners: Sumantrak™ works with regional partners who help students in their district. A partner can see a read-only list showing your name, college, branch, semester, district, join date and whether you've been active recently — only if you're 18 or older and have chosen to allow it (you decide when you set up your profile and can change it any time in your profile). Students under 18 are never shown to partners. A partner never sees your email address, phone number, plan, payments, or anything you ask or write in the app. We keep a record of your choice and when you made it, we log which student lists a partner opens (how many students were shown, not who), and partners agree to confidentiality terms before they get access. We ask for your birth month and year only to apply the under-18 rule.

If you arrive through a partner's QR code or link, your browser remembers that partner's short code for the current tab only (it is not a cookie and nothing is stored after you close the tab) so we can credit them when you create your account. Partners can see how many students joined through their link — as a count — and, if you allowed it, your name in their list.

Sumantrak™ uses one essential session cookie to keep you signed in, and a CSRF token cookie to protect form submissions from forgery. Both are strictly functional — we don't use advertising, analytics, or cross-site tracking cookies.

To understand how many people visit our public pages, we also run a simple first-party visit counter. It records the page opened, the referring site or campaign tag, your approximate location (country and city, from the hosting provider's IP lookup), and your device and browser type. It sets no cookie, stores no IP address and no account details, and uses a one-way hash that changes every day, so it can't be used to recognise you from one day to the next. It doesn't run on your signed-in workspace pages, and it respects your browser's Do Not Track and Global Privacy Control settings. These records are deleted after about 13 months.

We keep your account and content for as long as your account is active. If you turn on "temporary memory" for a Mentor conversation, that specific conversation is never saved to begin with. Payment records are kept as long as required for accounting and legal purposes even after account deletion.

You can update most of your profile directly from your profile page once logged in, including your memory/privacy settings (what Mentor is allowed to remember about you). To correct, export, or delete data we hold about you, or to close your account entirely, reach us through the in-app Support section (Workspace → Support) — we handle these requests manually and will confirm once done.

Sumantrak™ is built for engineering, diploma, BCA, and BSc Computer Science/IT students, and isn't directed at children. You must be at least 13 years old to create an account, and if you're under 18, you should have a parent or guardian's permission to use a paid plan.

Passwords are hashed, never stored or logged in plain text. Two-factor authentication (TOTP) is available from your profile. All traffic is served over HTTPS. No system is perfectly secure, but we take reasonable, industry-standard steps to protect your data and will let you know if a breach affects you, as required by law.

If we make a material change to how we handle your data, we'll update the effective date at the top of this page and, where appropriate, notify you in-app.

Questions about this policy or your data — reach us through the in-app Support section (Workspace → Support), the same channel used for account help.

Grievance Officer — for a complaint about how your personal data is handled, the same in-app Support channel (Workspace → Support) also serves as our designated grievance contact, in accordance with applicable Indian data protection law.