Mentis Learning
Privacy Policy
Last updated: 2 November 2026
For students: the short version
- We only collect what we need to help you learn: your name, email, year group, your quiz and paper scores, the lessons you watch, and your messages and calls with your mentor.
- We never sell your data, show you adverts or track you around the internet.
- Your mentor can see your progress and messages. That's how they help you, and it keeps you safe.
- Card details go to Stripe, our payment company. We never see the card number.
- You (or your parent or guardian) can ask to see your data, fix it or delete it. Just email mentislearning44@gmail.com.
1. Who we are
Mentis Learning is run by Iyad Stanakzai, a sole trader. We are the "controller" of your personal data, which means we decide how it's used and we're responsible for looking after it.
- Email: mentislearning44@gmail.com
2. What we collect
About the student
| What | Why |
|---|---|
| First name, last name, email, year group | To create the account, sign in, and show the right exam countdown |
| Password | To sign in. It's stored scrambled, so even we can't read it |
| Quiz and past-paper answers, marks and scores | To show progress, weak topics and what to revise next |
| Lessons watched and how far through | To pick up where you left off and track progress |
| Messages and photos sent to the mentor | To get help from the mentor, and as a safety record |
| Call bookings | To arrange Zoom calls with the mentor |
| Mentor notes, next steps and timetable | For the mentor to guide the student's revision |
| Plan status (trial, active, ended) | To know whether the account has access |
About the parent or guardian who pays
Stripe collects the payer's name, email, card details and billing address when they pay. We don't store card numbers. From Stripe we receive:
- a customer reference and the plan's status, dates and payments;
- a scrambled code made from the card ("fingerprint"), so we can make sure each card only gets one free trial. It isn't the card number and can't be turned back into one.
Technical information
- Small sign-in cookies that keep the student signed in (see our Cookie Policy).
- Our hosting and database providers keep short-term technical logs, such as IP addresses and the time of each request, to keep the site secure and working.
We don't use advertising, tracking cookies or analytics that follow people around the internet. We don't make automated decisions with legal or similarly significant effects about anyone.
3. Why we're allowed to use it (our "lawful bases")
- To provide the service you've paid for (contract): creating the account, giving access, lessons, quizzes, papers, messages and calls, and taking payments.
- Our legitimate interests: keeping the site secure, preventing repeat free trials, improving our lessons, and keeping a record of mentor messages to protect students. We've weighed these against students' interests and rights, and we keep them to the minimum needed.
- Legal obligations: keeping payment and tax records, and acting on safeguarding concerns where the law requires it.
We don't rely on consent for the main service, and we don't send marketing emails.
4. Children's privacy
Most of our students are under 18, so we follow the ICO's Age Appropriate Design Code (the "Children's Code"):
- Privacy settings are high by default. We only collect what's needed for the service.
- No adverts, no selling data and no profiling for marketing.
- We don't collect location.
- Students under 18 need a parent or guardian's permission to use Mentis, and a parent or guardian pays.
- Students can use their data protection rights themselves if they're old enough to understand them. Parents and guardians can also ask on their child's behalf.
5. Who we share it with
We only share data with companies that help us run Mentis, and only what they need. They must keep it safe and use it only for us.
| Company | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and secure file storage | UK (London) |
| Vercel | Hosts the website | UK, EU and USA |
| Stripe | Takes payments. Stripe is also responsible for the payment data it collects, under its own privacy policy | UK, EU and USA |
| Resend | Sends emails such as sign-in codes and message alerts | EU (Ireland) |
| Vimeo | Plays the lesson videos. Set to not track viewers | USA |
| Zoom | Mentor video calls | USA |
| Google (Gmail) | Our email inbox, if you email us | USA and elsewhere |
When data goes outside the UK, it's protected by UK-approved safeguards, such as the UK–US Data Bridge or approved contract clauses.
We may also share data if the law requires it, or to protect a child from harm.
6. How long we keep it
- Account, progress, notes and bookings: while the account is open. When an account is closed, we delete these within 30 days.
- Messages and photos between student and mentor: kept for 2 years after the account is closed, as a safeguarding record, then deleted.
- Payment and subscription records: 6 years, because tax law requires it.
- Trial records (the scrambled card code and account reference): kept so the free trial can't be used again.
- Backups: deleted data may stay in secure backups for up to 90 days before it's overwritten.
7. Your rights
You have the right to:
- ask for a copy of your data;
- ask us to correct it;
- ask us to delete it;
- ask us to limit or stop using it, or object to how we use it;
- ask for your data in a format you can take elsewhere.
Email mentislearning44@gmail.com. We'll reply within one month. We may need to check who you are first. Sometimes we can't delete everything straight away, for example payment records we must keep by law or safeguarding records, and if so we'll explain why.
8. Keeping data safe
- All data is sent over secure connections (HTTPS).
- Each student can only see their own data. Only the mentor can see students' work and messages.
- Photos, quiz pictures and past papers are kept in private storage, opened only through short-lived links.
- Passwords are stored scrambled, and card details stay with Stripe.
9. Complaints
If you're unhappy with how we've used your data, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
10. Changes
If we make important changes to this policy, we'll tell you by email or on the site before they apply.