Privacy Policy

Mentawe is operated by Mentawe, based in the United Kingdom.

We are the data controller for the personal data you provide when using Mentawe, and as a UK-based operator we are subject to UK GDPR.

Questions about this policy or your personal data should be directed via our contact form.

We collect the following categories of personal data:

• Account data: your email address and a password (stored as a secure hash — we never have access to your plain-text password).
• Profile and onboarding data: career goals, success vision, perceived blockers, motivations, and your company's stated objectives — information you voluntarily provide during onboarding and through continued use.
• Workplace situation data: descriptions of workplace situations you type into the coaching console. These are sent to an AI model to generate coaching responses and stored as part of your session history.
• Stakeholder data: names, roles, influence levels, and inferred characteristics of colleagues you add to your influence map.
• Feature records: the content you create in other areas of the app — tasks (and their blockers and deadlines), decision records, performance check-ins and logs, training modules, hiring roles and candidate notes, and career/CV data. These are stored in your account, and the AI ones are processed by OpenAI as described below.
• Notes: links, plain-text notes, your own one-line summaries, and tags you save in My Notes. Notes are used as private context for your coaching. If you write a note with your own summary, its text is sent to OpenAI to assess whether it would make a broadly-useful, non-identifying insight; if so, an anonymised, reworded version may be shown to other users as a community insight card (see “How we share your data”). You should not put confidential or identifying information in a note you would not want shared.
• Message-drafting data: in the Communication area, the outcome you want a message to achieve, any recipient details or thread you paste in, and the tone you choose. This is sent to OpenAI to draft the message and stored as part of your session history.
• Wellbeing data (special category — health data): if you switch on My Weather, your daily “weather” check-ins, any notes on them, parked worries, “three good things” entries, and anything you type into “name the storm.” This is treated as special-category health data and is only ever collected with your explicit opt-in. See section 2A.
• On-device data: to work offline and load fast, Mentawe stores some data in your own browser (via localStorage and a service-worker cache) — including which insight cards you've saved or dismissed, your reading streak, and cached pages. This lives on your device, not our servers, and clearing your browser data removes it.
• Meeting recordings and transcripts: if you use the meeting recording feature, your audio is processed in real time by OpenAI's Whisper API to produce a text transcript. The audio file itself is not stored by Mentawe. The resulting text transcript and AI-generated meeting analysis (structured notes and political insights) are stored in your account. By using this feature you confirm you have the consent of all meeting participants.
• Google Calendar data: if you connect Google Calendar, Mentawe reads your primary calendar events in your browser session to display upcoming meetings. Calendar event data (titles, times, attendees) is not stored on Mentawe's servers and is not sent to OpenAI unless you explicitly choose to prep a meeting, at which point only the meeting title and attendee names you select are included in the AI prompt.
• Payment data: we do not store card details. Payment is handled by Stripe, who acts as a separate data controller under their own privacy policy. We receive only subscription status, plan details, and an anonymised customer reference.
• Technical data: IP address, browser type, and device information collected automatically by our authentication provider for security purposes.

The My Weather area lets you record how you're doing at work. Because this can reveal information about your mental health, UK GDPR treats it as special-category data, which we handle with extra care:

• Opt-in only. We collect none of it unless you explicitly switch My Weather on. Our legal basis is your explicit consent (UK GDPR Article 9(2)(a)), which you can withdraw at any time.
• Private and minimal. Your check-ins, worries and entries are visible only to you. They are used solely to gently adjust the tone and timing of your coaching (for example, not pushing a hard conversation on a rough week). They are never used for analytics, profiling, advertising, or shared with anyone.
• Deletable instantly. You can delete all of your wellbeing data and switch the feature off at any time from within My Weather, which removes it immediately.
• Processed by OpenAI when you ask. The “name the storm” reflection sends the words you type to OpenAI to reflect them back; your stored check-ins are included as brief context in coaching prompts only while the feature is on. OpenAI does not train its models on API data by default.

Not a health or medical service. Mentawe is a support tool for everyday work stress. It is not a therapist, doctor, or crisis service; it does not diagnose, treat, or provide medical or psychological advice, and it is not a substitute for professional help. Where your words suggest you may be in crisis, we show you contact details for real, human support services (such as the Samaritans). If you are in immediate danger, contact your local emergency services.

• To create and manage your account and deliver the Mentawe service.
• To provide the Notes, Communication and My Weather features — using your notes and (if opted in) your wellbeing weather as private context so coaching is grounded in what matters to you, and drafting messages you ask us to draft.
• With your consent, to turn a broadly-useful note into an anonymised, reworded insight card for the shared feed.
• To generate AI coaching responses and meeting analyses by sending your situation descriptions, meeting transcripts, and relevant profile context to OpenAI. Your data is processed by OpenAI but is not used to train OpenAI's models via the API by default.
• To transcribe meeting audio: audio recordings are sent to OpenAI's Whisper API, converted to text, and the audio file is discarded. The text transcript is stored in your account for your reference.
• To calculate and store your Navigator Score and track your progress over time.
• To manage your subscription and process payments via Stripe.
• To send you essential service communications (account confirmations, subscription notices). We do not send marketing emails without your separate consent.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

We process your personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b)): account creation, service delivery, and subscription management.
• Legitimate interests (Article 6(1)(f)): security monitoring, fraud prevention, and service improvement, where these interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): financial record-keeping and responding to lawful requests from authorities.
• Consent (Article 6(1)(a)): optional features you switch on — in particular sharing an anonymised version of a note to the community feed. You can withdraw consent at any time.
• Explicit consent (Article 9(2)(a)): the sole basis on which we process the special-category wellbeing data in My Weather. If you do not give it, we do not collect that data at all.

We do not sell your personal data. We share data only with the following sub-processors who are contractually required to protect it:

• OpenAI Inc. (San Francisco, USA) — processes your workplace situation descriptions, meeting transcripts, and audio recordings to generate AI coaching responses and transcriptions. OpenAI does not use data submitted via the API to train its models by default.
• Supabase Inc. (San Francisco, USA) — provides database and authentication infrastructure. All data is encrypted at rest and in transit.
• Stripe Inc. (San Francisco, USA) — processes subscription payments. Stripe is an independent data controller for payment card data under their own privacy policy.

Community insight cards. Separately from sub-processors: if a note you save (with your own summary) is assessed as broadly useful, an anonymised and reworded version of the idea may be shown to other Mentawe users as an insight card. We remove identifying details and never show your name or your original wording, but this is still a form of sharing — so please do not save confidential or personal information in a note. This happens on the basis of your consent and only for notes you choose to write with a summary; it never applies to your wellbeing data, situations, meetings, messages, or people.

We may also disclose your data where required by law, court order, or to protect the rights, property, or safety of Mentawe, its users, or the public.

Our three sub-processors (OpenAI, Supabase, Stripe) are based in the United States. The UK does not have an adequacy decision with the United States. We ensure appropriate safeguards for these transfers through reliance on each sub-processor's Data Processing Agreements, which incorporate the UK's International Data Transfer Agreement (IDTA) or equivalent Standard Contractual Clauses with a UK Addendum.

• Account and profile data: retained for as long as your account is active, then permanently deleted within 30 days of account closure.
• Session and coaching data: retained for the lifetime of your account to support the Navigator Score trend and your history view.
• Notes and feature records: retained until you delete them or close your account.
• Wellbeing data: retained only while My Weather is switched on; deleted immediately when you delete it or opt out, and in any case within 30 days of account closure.
• On-device data: lives in your browser until you clear your browser storage; it is not on our servers.
• Payment records: retained for 7 years to comply with UK financial record-keeping requirements.
• Technical/security logs: typically retained for up to 90 days.

Under UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data where we no longer have a lawful basis to retain it.
• Restriction: ask us to limit how we process your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.

To exercise any of these rights, use our contact form. We will respond within one month. You also have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.

We use only essential cookies required to keep you signed in. No advertising or analytics cookies are set. We also use your browser's local storage and a service-worker cache to remember your saved and dismissed cards, your reading streak, and to let the Insights feed work offline — this is functional, stays on your device, and is not used to track you. See our Cookie Policy for details.

Mentawe is a professional service intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with their data, please contact us so we can delete it.

We may update this policy from time to time. We will notify you of material changes by email or by displaying a notice in the app. Continued use of Mentawe after changes take effect constitutes acceptance of the updated policy.

Mentawe, United Kingdom
contact@mentawe.com
mentawe.com/contact