MentorSuite

Privacy policy

Last updated: 2026-10-19.

1. Data controller

Codelabs Studio, S.L. (Tax ID B88708797), Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre, Málaga, España. Registro Mercantil de Málaga, hoja MA-198508, inscripción 1ª. [email protected]. https://mentorsuite.learnsuite.pro

2. Contact

For anything about your data write to [email protected].

3. What we process and why

  • Account: name, email, password (encrypted at the identity provider), language. Purpose: providing the service. Basis: contract.
  • Progress and assessment: lessons watched, quiz answers, certificates issued. Basis: contract.
  • Purchase and territorial licence: IP country and VPN/proxy signals, card and billing country, verified phone prefix, device identifier and time zone, playback sessions. Purpose: setting your zone price, enforcing the territorial licence, preventing fraud and resale. Basis: contract and legitimate interest in protecting the content. Kept for the life of the licence plus twelve months.
  • Phone: number verified by SMS, for travel passes and account protection. Basis: contract.
  • Identity verification (only for courses that require it): document and selfie processed by Stripe Identity; we keep only the result and the verified name. Basis: contract and legal obligation where applicable.
  • Conversational tutor: your questions and its answers, to provide the service and improve the syllabus. Basis: contract. Never used to train third-party models.
  • Website assistant chat: the public website has a chat with an artificial intelligence assistant that runs on AgenteUno, another Codelabs Studio product, acting as processor. Until you open it, it stores nothing on your device. When you open it and write, we keep a session identifier in your browser's session storage and, on AgenteUno's servers, the text of your messages, the replies and the date and time of the conversation, to answer you and improve our support. To generate the replies, the conversation text is sent to Cerebras Systems Inc. (U.S.), the language-model provider AgenteUno uses for this chat, acting as processor. Cerebras Systems Inc. is not on the EU-U.S. Data Privacy Framework (DPF) list: the transfer relies on the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) incorporated into its data processing agreement. If you use the voice of the assistant, the audio and its transcript are processed by Google LLC (Gemini Live, U.S.), which is certified under the EU-U.S. Data Privacy Framework (DPF). Message text is deleted automatically after 730 days and the conversation record, by then without text, after 3 years; you can ask us to delete it sooner at [email protected]. Please do not type data you do not want us to keep (for example health data or other people's data). Chat usage statistics are measured only if you accept the matching category in the cookie banner. Basis: legitimate interest in answering your enquiry.
  • Founding experts programme (application form): if you fill in the form to apply as a founding expert of MentorSuite, we process your name, email address and the channel you present yourself with (for example a YouTube link or handle). Purpose: to contact you about the founding experts programme, and only that. Legal basis: your consent (art. 6(1)(a) GDPR), which you give by ticking the box before sending the form and which we record with its date. Retention: until you withdraw your consent or, if there is no relationship with you, for 12 months from your last request; then we delete it. Recipients: no third party; the data are hosted in the European Union. Controller: Codelabs Studio, S.L., Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre, Málaga, España. You can withdraw your consent at any time, with the same ease as you gave it, and exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to [email protected]; you can also complain to the Spanish Data Protection Agency (www.aepd.es). We send you nothing automatically after the form.
  • Crisis protocol of the AI assistants: every message to an AI assistant (text or voice) is checked automatically, by rules and by a language model, for signs of a serious risk to you or to a third party (suicide, self-harm, violence, an emergency). If there are, the assistant does not end the conversation: it answers calmly and shows the helplines of your country. If you choose not to record, nothing is kept unless we detect a serious risk to you or to another person; in that case it is kept for safety and only handed to the authorities if they request it. Access to that material is restricted to the platform's safety officer, every access is logged, and the academy, coach or professional only receives a notice (date, type of risk and, if you were signed in, who), never the content. It is kept for two years from the last message and then deleted, unless an authority has requested it, in which case it is kept until that procedure ends. Basis: vital interests of the data subject or of another person (Articles 6(1)(d) and 9(2)(c) GDPR). The AI is not a health professional.
  • Recorded 1:1 sessions: only if the learner and the instructor both accept it in the room; the date of each consent and the version of the accepted text are recorded. The recording is stored in the European Union (Cloudflare R2) and transcribed on our own servers. If the academy switches it on, a Google language model (Gemini) prepares a summary. With the instructor's approval, a few general teaching points without personal data may be added to the tutor of the academy's learners; never the recording, the transcript or the summary. Only the learner and the academy can see the recording, the transcript and the summary. Either of them can revoke consent at any time and erase, from their own area, the recording, the transcript, the summary and those tutor points. Basis: consent (Article 6(1)(a) GDPR). Kept until either of them revokes it.
  • Preparing 1:1 sessions (VideoSuite): when you book a 1:1 session with the academy's creator, it is managed and held in VideoSuite, a service of Codelabs Studio, S.L. hosted in the European Union. So that the creator can prepare it, we send them a brief with your name, how long you have been a member, your progress in the courses, the questions you asked their assistant from your verified account and what you posted in the academy's community under your name (your questions, whether they were resolved and whether the answer was verified, your posts and your replies). Nothing you posted anonymously and no data from other academies is ever included. Only the creator of that session sees it. Basis: performance of the contract (preparing the session you booked) and legitimate interest, which you can object to by writing to [email protected]. It is kept with the session. When you join the session you choose whether it is recorded; if you choose not to, nothing is recorded and there is no transcript or summary, except where there is a serious risk to you or to someone else (GDPR articles 6.1.d and 9.2.c), as explained on that same screen.
  • Technique review videos (only in academies that offer it): the videos of your exercises that you send for review, your note and the comments and drawings of the thread. Purpose: reviewing your technique as part of the course. Basis: contract. The video is stored in the European Union (Cloudflare R2) under a private key and is played only through short-lived links; only you and the academy team (its owner, instructors and the reviewers it designates) can see it. Kept until you delete it from your area, which erases the video and its comments.
  • Watermark: your name and part of your email are shown over the video during playback. Basis: legitimate interest in protecting the content.
  • Communications: transactional emails (verification, invoices, confirmations). Basis: contract.
  • Instructor voice and likeness (biometric data): we clone the instructor's voice, as part of the work we do for their academy, for a single purpose: dubbing their own courses into other languages with the mouth synced over their original video. Legal basis: their explicit written consent (Articles 6(1)(a) and 9(2)(a) GDPR), documented in writing. It is not used for any other purpose, sold or shared. The voice provider (ElevenLabs, Inc., United States) acts as a sub-processor under standard contractual clauses. To synchronise the lips, KIE (Singapore) and Volcengine (China) receive the video of the instructor's face and the audio dubbed in their voice, also as sub-processors under standard contractual clauses (Article 46(2)(c) GDPR). The instructor can withdraw consent at any time, as easily as it was given, by writing to [email protected]; on withdrawal their voice stops being used and the voice model is destroyed, without affecting earlier processing.

4. Retention

For as long as the account exists and afterwards as long as legal obligations require. You can delete your account from your area without writing to anyone: access ends at once, your subscriptions stop renewing that same day (you are not charged again), and for 30 days you can change your mind by signing in, which resumes them. After that period we erase your profile (name, email, phone and the identity provider account), your progress and quiz answers, the recordings, transcripts and reports of your 1:1 sessions, your devices, the questions you left to the tutor and your conversations with it, the private messages you sent (those other people sent you stay with them, shown as from «Usuario eliminado»), your reactions and notifications in the community (what you posted in public is replaced by a deletion placeholder and no longer shows your name), the videos you uploaded for technique review and their comments, your coaching programmes (daily check-ins and questionnaire results), your name and email in booked 1:1 sessions, also in VideoSuite, the video room where they take place (the amount stays as billing data; future events in the instructor's calendar keep only «Sesión 1:1»), your customer record at the payment processor (Stripe; invoices stay there as the law requires), the copy of your certificate data that the academy shares with its partner contact manager when it does, your notice subscriptions and your record in our contact manager. We keep only what the law requires: orders and invoices for six years (Spanish Commercial Code, article 30, and tax law), reduced to the data an invoice needs; the public verification record of certificates already issued (number, course, issue date and the name as printed), because third parties verify them, with a note that the holder asked for deletion; and a one-way hash of your email so that we never write to you again. Material that the crisis protocol retains for safety follows its own period, described in that protocol. Recordings of sessions held in VideoSuite are not deleted automatically: they are kept under its recordings policy and deleted if you expressly ask. If you own an academy, your account is not deleted automatically while the academy is active, because deleting it would leave the academy and its students without a holder: it is kept until the academy is closed or transferred. The instructor's voice model is kept only while their consent and their relationship with the academy last, and is destroyed on withdrawal or when the service ends.

5. Recipients and transfers

The providers listed on the Sub-processors page, under processing agreements and, outside the EEA, the European Commission's standard contractual clauses. Data is hosted in the European Union (Germany).

6. Your rights

Access, rectification, erasure, objection, restriction, portability and not being subject to automated decisions. Write to [email protected]. You may also complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.

7. Automated decisions

The price zone and the territorial licence are decided automatically from the signals in section 3. If the outcome looks wrong, ask for human review at [email protected]: an order marked "under review" is decided by a person.

8. Country annexes

  • Brazil (LGPD): legal bases equivalent to GDPR; the controller above answers as data controller; rights before the ANPD.
  • United States (CCPA/CPRA, California): we do not sell or share personal data for advertising; rights of access, deletion and correction through the same channel.
  • India (DPDP Act 2023): verifiable consent for the stated purposes; rights of correction, erasure and complaint before the Data Protection Board.
  • United Kingdom (UK GDPR): same rights; transfers under the IDTA or the UK addendum to the standard clauses.
  • Argentina (Law 25.326), Mexico (LFPDPPP), Paraguay (Law 6534/2020) and the rest of Latin America: ARCO rights through the same channel; the controller is the one in section 1.