Privacy Policy

• Data Principal: The individual to whom the personal data relates (students, teachers, administrators, or other users).
• Data Fiduciary: Mentron Technologies LLP, LLPIN: ACV-3361, which determines the purposes and means of processing personal data.
• Consent Manager: A person registered with the Board who enables Data Principals to review, manage, and withdraw consent.
• Personal Data: Any data about an identifiable individual, including name, email, learning activity, and assessment results.

We process personal data for the following lawful purposes:

• Service delivery: Operating the platform, managing accounts, and providing learning features (adaptive learning, FSRS-based spaced repetition, mind maps, quiz generation)
• Personalization: Adapting learning paths and content difficulty to individual learner needs
• Analytics and improvement: Aggregated analysis to improve platform features and educational outcomes
• Communication: Responding to support requests, sending account notifications, and (with consent) product updates
• Legal compliance: Meeting obligations under Indian law, accreditation requirements, and institutional agreements
• Safety and security: Detecting and preventing fraud, abuse, and unauthorized access

Under the DPDP Act, we process data based on:

• Consent: Where you have provided clear, affirmative consent (e.g., creating an account, submitting a demo request)
• Legitimate use: Where processing is necessary for the stated purpose (e.g., grading an assessment you submitted)
• Legal obligation: Where required by law, regulation, or court order

Under Sections 12–14 of the DPDP Act, you have the right to:

• Access: Request a copy of your personal data held by us
• Correction: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Nomination: Nominate another individual to exercise your rights in the event of death or incapacity
• Withdraw consent: Withdraw previously given consent at any time; withdrawal does not affect the lawfulness of processing prior to withdrawal
• Grievance redressal: Contact our Grievance Officer (see Section 12)

To exercise any of these rights, contact us at privacy@mentron.in. We will respond within 30 days.

Mentron serves K-12 educational institutions. For users under the age of 18, we require verifiable parental consent before processing personal data. Institutional accounts are responsible for obtaining this consent through their own enrollment processes. We do not:

• Use children's data for behavioral advertising or commercial profiling
• Share children's personal data with third parties except as required for service delivery or legal compliance
• Collect more data from children than is necessary for educational purposes

• Account data: Retained while your account is active and for 90 days after deletion request
• Learning data: Retained for the duration of institutional enrollment plus 1 academic year for accreditation reporting
• Demo requests: Retained for 12 months, then deleted unless a contract is in place
• Analytics data: Anonymized within 30 days; aggregated data retained indefinitely
• Logs: Security and access logs retained for 90 days

We implement appropriate technical and organizational measures:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Role-based access controls with least-privilege principles
• Regular security assessments and vulnerability scanning
• Employee training on data protection and incident response
• Audit logging of administrative access to personal data

Our primary infrastructure is hosted on Vercel (AWS) and Supabase. Data may be processed in data centers outside India. We ensure that transfers to countries not notified by the Indian government under the DPDP Act are made only with your consent or under appropriate safeguards. All processing partners maintain equivalent security standards.

We use the following categories of sub-processors:

• Hosting: Vercel (application hosting), Supabase (database and authentication)
• Analytics: Google Analytics 4 (anonymized, aggregated usage data)
• Email: Transactional email providers for account notifications
• LMS Integrations: Canvas, Moodle, Google Classroom (via LTI 1.3 / API)

We maintain data processing agreements with all sub-processors and will update this list as providers change.

Mentron uses AI for adaptive learning, quiz generation, flashcard scheduling (FSRS), and mind map creation. Your data is used as follows:

• Personalization: Learning data is used to personalize your experience (adaptive paths, spaced repetition scheduling)
• Content generation: AI-generated quizzes and flashcards are derived from course content, not from other users' data
• Model training: We do not use your personal data to train general-purpose AI models. Fine-tuning for your institution uses only your institution's data, which is not shared with others
• Human review: AI-generated assessments may be reviewed by instructors at your institution; Mentron staff do not review individual learning data without explicit authorization

In the event of a personal data breach that is likely to cause harm to Data Principals, we will notify the Data Protection Board of India and affected individuals without undue delay, and in any case within 72 hours of becoming aware of the breach, as required under the DPDP Act.

As required under Section 10 of the DPDP Act, you may contact our Grievance Officer:

Email: privacy@mentron.in
Mentron Technologies LLP, North Andalpuram, Rajapalayam – 626108, Tamil Nadu, India

We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or by email. Continued use of the platform after changes constitutes acceptance of the updated policy. The "Last updated" date at the top of this page reflects the most recent revision.

For privacy-related questions or to exercise your data rights:

Email: privacy@mentron.in
Mentron Technologies LLP
North Andalpuram, Rajapalayam – 626108
Tamil Nadu, India