1. Who we are#
Mentoring @ Invespire is operated by Invespire Startup Management Private Limited, S-12-13, Plot No. 88 to 91, Sector 19A, Nerul, Navi Mumbai, Maharashtra, India, 400706, India ("we", "us", "our").
We decide how and why your personal data is used for the Platform. That makes us the "controller" under the EU and UK GDPR and the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023.
For any privacy question or request, email info@invespire.com.
Grievance Officer
- Name: Invespire Startup Management Private Limited
- Designation: Grievance Officer (company)
- Email: info@invespire.com
- Postal address: S-12-13, Plot No. 88 to 91, Sector 19A, Nerul, Navi Mumbai, Maharashtra, India, 400706
2. What this policy covers#
This policy covers the Mentoring @ Invespire website and services. It does not cover the video-call services mentors use for sessions, mentors' external links (such as LinkedIn), or Google's own processing when you use Google sign-in. Those services have their own privacy policies.
3. What we collect#
We collect only what you give us, what is created as you use the Platform, and limited technical information needed to run it securely.
Account information
- Your name and email address.
- Your password, stored only as a one-way cryptographic hash (bcrypt). We never see or store the password itself.
- Your time zone. It is detected automatically by your browser when you register, and you can change it.
- Account settings and status: whether you have mentor or administrator access, which view opens by default, whether your email is confirmed, whether you want emails about new messages, whether the account is suspended (with the reason we gave you), and when it was created.
- A record of each time you accepted our Terms of Service and Privacy Policy (the version, the date and how you accepted) and of your confirmation that you are 18 or older. We do not store your IP address or browser with these records.
If you sign in with Google
Google sends us your Google account identifier, name, email address, whether Google has verified that email, and the address of your Google profile picture. We use the picture as your profile photo until you upload a different one or remove it. We do not receive your Google password, contacts or other Google data.
Profile photo (optional)
You can upload a PNG, JPEG or WebP image up to 200 KB. Uploaded photos are stored with our image provider, Cloudinary, and are delivered from its servers. Your photo is shown to other people only if you are an approved mentor.
If you apply to be a mentor
- Your headline, biography, skills, years of experience and optional LinkedIn or portfolio link.
- The status of your application, any reasons given for rejecting it or rejecting later changes, and changes waiting for review.
- Your weekly availability and blocked dates, your average rating and number of reviews.
Bookings, messages, reviews and reports
- Bookings: who the mentor and mentee are, the session time, status, the mentee's optional note, the meeting link the mentor adds, the reason for a decline or cancellation, and who cancelled.
- Messages: the text, when it was sent and whether it has been read. The inbox also stores a short preview of the latest message.
- Reviews and replies: rating, text and dates.
- Reports you make: what you reported, the category you chose and your explanation. If content you posted or your account is reported, the report and our decision. We never tell the person you reported who you are.
- Moderation records: each decision our administrators take (for example removing content, suspending or reinstating an account, deciding on a mentor application), with the reason, the administrator who took it and the date.
- Notifications: a record of each in-app notification (type, related booking, message or review, and the subject line, which can include the other person's name), and whether the matching email was sent.
Technical and security information
- Your IP address, email address or account ID, used briefly to limit repeated attempts: sign-in, sign-up and password reset, but also the contact form, public reports, password changes, confirmation links, account deletion, email changes and data downloads. Counters containing them are deleted automatically after 15 minutes to 24 hours, depending on the action.
- A session cookie that keeps you signed in (see our Cookie Policy).
- Our hosting provider, Vercel, automatically records technical request logs (such as IP address, browser type, the page requested and the time) and error logs from our application. They are kept according to Vercel's log-retention periods.
When you contact us
If you email us (for example for support, a privacy request or a grievance), we keep your email and our reply.
If you use the contact form, your name, email address, topic and message are sent to our support mailbox by email; they are not stored in our database.
If you send a notice through our report page without an account, we store the page you reported, the category, your explanation and, if you give them, your name and email address, so that we can confirm receipt and tell you the outcome. For reports of a minor on the Platform you may leave your email out.
What we do not collect
We do not collect your date of birth, phone number, postal address, payment details or precise location. We do not use analytics, advertising or tracking tools, and we do not build advertising profiles. We do not take part in, record or receive the content of video sessions, which take place on the third-party service chosen by the mentor.
4. Why we use it and our legal bases#
Every decision about mentor applications, reports, suspensions and account closures is made by a person. The one exception is housekeeping: an account whose email address was never confirmed and that has no activity is deleted automatically after 30 days (section 8). We do not make any other decisions about you by automated means that have legal or similarly significant effects.
Mentor search results are by default ordered by average rating, then number of reviews, then how recently the profile was created. You can choose other sort orders on the mentor list, and you can filter by keyword, skill or experience to narrow the list. Nothing is ranked by payment, because nothing is paid.
Where we rely on your consent, you can withdraw it at any time by deleting your account or emailing us. Withdrawing consent does not affect processing that happened before, and you will no longer be able to use the Platform.
- To create and run your account, publish approved mentor profiles, handle bookings, messages and reviews, and send the related service emails. Legal basis: performing our contract with you (GDPR Art 6(1)(b)); under Indian law, your consent given when you register.
- To keep the Platform secure and prevent abuse, for example rate-limiting sign-in attempts and ending sessions after a password reset. Legal basis: our legitimate interest in protecting users and the Platform (GDPR Art 6(1)(f)); under Indian law, your consent and the purposes for which you provided the data.
- To review mentor applications, handle reports, moderate content and deal with grievances. Legal basis: our legitimate interest in a safe and trustworthy platform, and our legal obligations as an intermediary (GDPR Art 6(1)(c) and (f)).
- To keep records we are legally required to keep and to respond to lawful requests from authorities. Legal basis: legal obligation (GDPR Art 6(1)(c)).
- To keep a record of your acceptance of these policies and of your confirmation that you are 18 or older. Legal basis: legal obligation and legitimate interest in being able to show that consent was given.
5. Who can see your information#
We do not sell your personal data, and we do not share it for targeted advertising.
Anyone on the internet
- For approved mentors (unless suspended): name, profile photo, headline, biography, skills, years of experience, link, average rating, number of reviews, and open time slots for the next 30 days.
- For reviewers: the rating, review text and date, with the reviewer's first name only, and the mentor's reply.
The people you book or message
- Mentors see the mentee's name, requested time and note. Mentees see the mentor's name and meeting link once a request is accepted. Both see the booking status, reasons for declines and cancellations, and their messages.
- Mentors see the full text of reviews of their sessions.
Our administrators
People we authorise to run the Platform can see account details (including email addresses and join dates), mentor applications and reported content, and can access other data where needed for support, security, moderation or legal reasons.
Our service providers
We use the providers listed in section 6 to host and run the Platform. They process data on our instructions under data processing terms.
If the Platform changes hands
If the Platform is transferred to another organisation, your data may transfer with it. The new operator must respect this policy, and we will tell you before any change to how your data is used.
6. Service providers#
Google LLC provides Google sign-in if you choose to use it. For that, Google acts under its own privacy policy (https://policies.google.com/privacy).
Profile photos are loaded directly from the service where they are stored. Where a mentor's photo is hosted by Google (a Google profile picture) or Cloudinary (our image provider), your browser requests it from that provider, which then receives your IP address and browser details.
We will update this list before we add a new provider that handles personal data.
- Vercel Inc.: Hosting the website and running the application code; request and error logs. Data: All data sent to and from the site while it is processed, IP address, browser details, request logs. Location: United States (functions region: a region selected by the operator in Vercel). Privacy policy: https://vercel.com/legal/privacy-policy
- MongoDB, Inc. (MongoDB Atlas): Database that stores all account and platform data. Data: All account, profile, booking, message, review, report and notification data. Location: a region selected by the operator in MongoDB Atlas. Privacy policy: https://www.mongodb.com/legal/privacy/privacy-policy
- Zoho Corporation Pvt. Ltd. (Zoho Mail): Sending service emails (verification, password reset, booking, message and moderation notices). Data: Email address, name, and the content of each email (for example session times, notes, meeting links, reasons and message previews). Location: a data centre operated by the email provider. Privacy policy: https://www.zoho.com/privacy.html
- Cloudinary: Storing and delivering profile photos. Data: Uploaded profile photos; IP address and browser details of people who view them. Privacy policy: https://cloudinary.com/privacy
7. International transfers#
We are based in India. Our database is hosted in a region selected by the operator in MongoDB Atlas, and our application runs on Vercel's infrastructure (a region selected by the operator in Vercel). Your data is therefore processed in countries other than your own, which may have different data protection laws.
Where EU or UK data protection law applies, we rely on our providers' data processing agreements, including the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU-US Data Privacy Framework where a provider is certified. You can ask us for more information about these safeguards.
Under Indian law, we transfer personal data only to countries to which transfers are not restricted by the Government of India.
8. How long we keep your data#
- Account and profile data: while your account exists.
- Accounts whose email address is never confirmed, and that have no activity: deleted 30 days after sign-up.
- Email-confirmation and email-change links expire after 24 hours, and password-reset and account-deletion links after 1 hour; all are deleted once used or expired.
- Rate-limit counters (containing IP address, email address or account ID): deleted automatically after 15 minutes to 24 hours.
- In-app notifications: deleted after 180 days.
- Meeting links: deleted 30 days after the session. Booking notes and cancellation reasons: deleted 24 months after the session.
- Messages and booking history: kept while at least one of the participants still has an account, so the other person keeps their history; deleted once both accounts are deleted.
- Content removed after a report (reviews, mentor replies, messages, meeting links and booking notes, and mentor profiles), and content under an open report when its author deletes it or their account: hidden immediately and kept for 180 days so the decision can be investigated, reviewed on appeal or reversed, and so it is available if the law requires it (Indian intermediary rules require removed content to be preserved for this period). Then its text is deleted (for a review, an empty placeholder remains so the same session cannot be reviewed again). A mentor profile kept this way after the account was deleted is then deleted completely; a removed profile of an existing account stays with its owner, who can edit it and apply again.
- Reports: deleted 12 months after they are resolved. A report filed by an account that has since been deleted and is still open is deleted 180 days after the account was deleted. Records of moderation decisions: kept for 3 years.
- After you delete your account: your registration details (name, email and sign-up date) are kept in restricted storage for 180 days, as required by Indian intermediary rules, and then deleted. Records of your acceptance of our policies are kept for 3 years. They carry no name or email, but they are linked to an internal identifier, so while the 180-day registration record exists they can be traced back to you.
- Hosting logs: kept by Vercel according to its log-retention periods.
- Emails you send us: 3 years after the matter is closed.
9. What happens when you delete your account#
- You confirm the request (with your password, or a link sent to your email).
- Your upcoming and pending sessions are cancelled, and the other participants are told that the other participant closed their account.
- Your name, email address, password, Google link and profile photo are removed from your account, which remains only as an anonymous "Deleted user" record so other people's histories still make sense. You are signed out everywhere.
- Your mentor profile, availability and the reviews about you as a mentor are deleted. Reviews you wrote are deleted and mentors' ratings are recalculated.
- The text of messages you sent is deleted. The other person sees that the message came from a deleted account and keeps the messages they sent.
- Past bookings stay in the other person's history, without the notes or meeting links you wrote.
- Your notifications and pending email links are deleted.
- Content under investigation after a report, and the registration details described in section 8, are kept for the stated periods and then deleted.
- Some records are not removed by deleting your account, and stay for the periods in section 8: records of moderation decisions that name you (3 years); reports you filed, including what you wrote in them (12 months after they are resolved; one still open is deleted 180 days after your account); notifications already sent to other people that contain your name (up to 180 days); the 180-day registration record, which also holds your Google account identifier and, if your account had been suspended, that fact with the reason and the admin who recorded it; and copies of emails already sent, which our email provider keeps under its own retention rules. If our image provider cannot be reached at the moment you delete your account, a copy of your photo may stay there until it is removed.
- We email you a confirmation.
10. How we protect your data#
No online service can be completely secure, and we do not hold any security certification. Messages are not end-to-end encrypted. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires. You can report security problems as described in our Security and Responsible Disclosure Policy.
- The site uses HTTPS, and browsers are told to use only HTTPS.
- Passwords are stored only as bcrypt hashes. Email-confirmation and password-reset links contain single-use codes that are stored only as hashes and expire.
- Sessions use an encrypted cookie that scripts cannot read. Resetting your password or changing your email address signs out your sessions, suspending or deleting an account ends its sessions immediately, and you can sign out everywhere from account settings.
- Repeated sign-in, sign-up and password-reset attempts are rate-limited.
- Uploaded images are checked to be real PNG, JPEG or WebP files.
- Access to administrative functions is limited to authorised administrators.
11. Your rights#
For everyone
- Download a copy of your data (a JSON file) from your account settings.
- Correct your name and time zone in account settings, and change your email address there (we send a confirmation link to the new address and a notice to the old one; accounts that sign in only with Google add a password first, or contact us).
- Delete a review you wrote, or your whole account, from your dashboard and account settings.
- Sign out of all your devices from account settings.
- Ask us any question about your data, or make any of the requests below, by emailing info@invespire.com.
If you are in the EU, EEA or UK
You have the right to access, rectify and erase your data, to restrict or object to processing based on legitimate interests, to data portability, and to withdraw consent. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concerns first.
If you are in India
Under the Digital Personal Data Protection Act, 2023, you may obtain a summary of your personal data and how it is processed; have it corrected, completed, updated or erased; withdraw consent; have your grievances addressed by our Grievance Officer; and nominate another person to exercise your rights if you die or become incapacitated (email us to make a nomination). If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.
If you are in the United States
We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. Whether or not a state privacy law applies to us, you can ask to access or delete your data as described above, and we will not treat you differently for doing so.
How we handle requests
We may need to confirm your identity, usually by asking you to write from the email address on your account. We reply within 30 days, or sooner where the law requires, and may extend this where the law allows (we will tell you why). Requests are free. If your account is suspended, you can still make any of these requests by email.
13. Emails we send#
We send service emails about your account and activity: confirming your email, resetting your password, changing your email address, deleting your account, booking requests and decisions, cancellations, new messages (with a short preview), mentor application decisions, reviews, confirmations and outcomes of reports you make, decisions about your content or your account (with the reasons and how to appeal), and, at least once a year, a reminder of our rules. We do not send marketing emails. You can turn off emails about new messages in your account settings; the other service emails are needed to run your account. Every email says why you received it.
14. Children#
The Platform is only for people aged 18 or over, and everyone must confirm this when registering. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data as described in section 9. If you believe a child is using the Platform, contact info@invespire.com.
15. Language#
This policy is written in English. If you live in India, you can ask for it in any language listed in the Eighth Schedule to the Constitution of India by emailing info@invespire.com.
16. Changes to this policy#
We will update this policy when our practices or the law change. For material changes, we will show you a summary of what changed and ask you to accept the new version the next time you sign in. Until you accept, you can still download your data and delete your account. We may also email registered users in advance. The date and version at the top show the current version.
17. Contact and complaints#
- Privacy requests and questions: info@invespire.com
- Grievance Officer: Invespire Startup Management Private Limited, info@invespire.com, S-12-13, Plot No. 88 to 91, Sector 19A, Nerul, Navi Mumbai, Maharashtra, India, 400706
- Postal address: Invespire Startup Management Private Limited, S-12-13, Plot No. 88 to 91, Sector 19A, Nerul, Navi Mumbai, Maharashtra, India, 400706
Questions about this page? Contact us