Privacy policy

This policy explains what personal data MentorBuild collects, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it. It applies to everyone who uses MentorBuild — students, mentors, institution coordinators and visitors to our website.

MentorBuild is operated by NavaTrix Digital Technologies LLP (“MentorBuild”, “we”, “us”), a limited liability partnership registered in India at 11/862, upstairs, indira nagar, Mamillapalli, Chinthakommadinne, Cuddapah- 516004, Andhra Pradesh, India, LLPIN ACX-8134. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described here.

1. The data we collect

We collect only what we need to run the service. That falls into five groups.

Account data

• Your name, email address and password (stored only as a cryptographic hash, never in readable form).
• Your role on the platform — student, mentor, institution coordinator or administrator.
• A phone number, where you give one, used to contact you about your project.

Profile data

• For students: your course, institution and the goals you describe during onboarding.
• For mentors: your professional history, skills, portfolio links and the supporting evidence you submit for verification.
• For mentors who are paid through the platform: bank account details, held solely to process payouts.

Project data

• Project briefs, milestones, uploaded files, deliverables and review notes.
• Messages exchanged in a project workspace, and records of scheduled and completed sessions.
• Ratings and written reviews you leave, and any dispute you raise.

Payment data

• Transaction amounts, escrow status, invoices and payout records.
• We do not receive or store your full card number, UPI PIN, CVV or net-banking credentials. Those go directly to our payment gateway, Razorpay, and we only ever see a transaction reference and status.

Technical data

• IP address, browser and device type, and pages visited, used to keep the service secure and diagnose faults.
• Authentication and session records, including failed login attempts, used to detect account takeover.
• Cookies and similar storage, described in section 8.

2. Why we use it, and on what basis

Under the DPDP Act we may process your personal data where you have given consent, or where processing is necessary for a legitimate use the Act recognises. We use your data to:

• Create and secure your account, and verify that you are who you say you are.
• Match you with a mentor whose experience fits your project, and run the project workspace.
• Take payment, hold it in escrow, release it on approval and issue invoices.
• Issue certificates and, where you choose to publish one, a public portfolio entry.
• Investigate disputes, fraud, abuse and breaches of our conduct policies.
• Send you transactional messages about your own account and projects.
• Send you marketing messages, but only where you have separately opted in.
• Meet our obligations under Indian tax, accounting and other applicable law.

Where we rely on your consent, you may withdraw it at any time — see section 6. Withdrawing consent does not affect processing already carried out, and we may still need to keep certain records to meet a legal obligation.

3. Who we share it with

We do not sell your personal data, and we never have. We share it only as follows.

• With the other party to your project. A mentor sees the student's name, brief, project files and messages. A student sees the mentor's profile and the same project material. Neither sees the other's payment details.
• With your institution, where you joined through an institution programme. A coordinator can see your project status and progress, not the contents of your private messages.
• With Razorpay, our payment gateway, to process payments, escrow and payouts.
• With the infrastructure, email and messaging providers that run the service on our behalf, under contracts that restrict them to acting on our instructions.
• With our professional advisers, and with a law enforcement or regulatory authority where we are legally required to disclose.
• With an acquirer, if the business is sold or reorganised — you will be told before your data moves.

4. What is visible publicly

Most of what you do on MentorBuild is private to you, your mentor and, where relevant, your institution. Three things are not:

• Approved mentor profiles are publicly listed, showing the professional details the mentor chose to publish.
• Certificate verification links are public by design, so an employer can confirm a certificate is genuine. The link shows the certificate holder's name, the project title and the issue date.
• A portfolio entry is public only if you choose to publish it, and you can unpublish it at any time.

5. How long we keep it

• Account and profile data: for as long as your account is open, and for a limited period afterwards, so we can handle any dispute that arises late.
• Project and message data: for as long as certificates issued from it need to remain verifiable, so disputes can also be reconstructed.
• Payment and invoice records: 8 years, as required by Indian tax and accounting law.
• Technical and security logs: for a limited period.

When a retention period ends we delete the data or irreversibly anonymise it so that it can no longer be linked back to you.

6. Your rights

The DPDP Act gives you the following rights over your personal data.

• Access — ask us for a summary of the personal data we hold about you and who we have shared it with.
• Correction — have inaccurate or incomplete data corrected, completed or updated.
• Erasure — ask us to delete data we no longer need, subject to the retention periods in section 5.
• Withdraw consent — for anything we do on the basis of consent, including marketing.
• Nominate — name someone to exercise these rights on your behalf if you die or become incapacitated.
• Grievance redressal — raise a complaint with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these, email contactmentorbuild@gmail.com. We respond within 30 days. We may ask you to verify your identity first, so that we do not disclose your data to someone else.

7. How we protect it

• Traffic between you and MentorBuild is encrypted in transit using TLS.
• Passwords are stored using Argon2id hashing and are never recoverable in readable form, including by us.
• Accounts lock temporarily after repeated failed login attempts, and administrator accounts require a second factor.
• Access to production data is limited to staff who need it, and administrative actions are recorded in an audit log.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

8. Cookies

We use cookies and similar browser storage that are strictly necessary to keep you signed in, remember your theme preference and protect against cross-site request forgery. These cannot be switched off without breaking the service. Where we use any analytics or advertising cookie, we will ask for your consent first and you can change your mind at any time.

9. Children

MentorBuild is not intended for anyone under 18. Under the DPDP Act, processing a child's personal data requires verifiable consent from a parent or lawful guardian, and we do not have the mechanisms to obtain it. If you believe a person under 18 has created an account, tell us at contactmentorbuild@gmail.com and we will close it and delete the data.

10. Transfers outside India

Some of the providers that run the service on our behalf store data outside India. Where that happens we transfer data only to countries not restricted by the Central Government under the DPDP Act, and only under contracts that hold the provider to the protections described in this policy.

11. Changes to this policy

If we make a material change we will tell you by email or through the platform before it takes effect.

12. Contact and grievances

Our Grievance Officer under the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is:

We acknowledge every complaint within 24 hours and resolve it within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.