Privacy Policy (MVP)

Effective date: 2026-10-26 Last updated: 2026-10-26

This is a real but lightweight Privacy Policy designed for beta user testing. Have a lawyer review before broader rollout.

1. What We Collect

We collect information necessary to operate and improve the learning system.

A. User-provided data

  • Answers to questions
  • Search queries (e.g., noun/concept searches)
  • Feedback on questions and videos

B. System-generated data

  • Performance scores (correctness, alignment, estimated ability levels)
  • Progress tracking per concept/noun
  • Interaction logs (question attempts, video engagement)

Note: This system builds an adaptive educational profile per user — correctness tracking + concept mastery graphs constitute behavioral and cognitive inference data. Treat it as sensitive by design.

C. Technical data

  • Basic device/browser information
  • Session logs for debugging and reliability
  • The link that brought you. If you arrive through a link we shared that carries a tag saying where we posted it (for example, a link tagged "reddit"), we keep that tag in a cookie on your device, set by our own site and not by an advertiser, for up to 30 days. If you then create an account, we save it with your account. We only set this cookie while you are signed out.

2. How We Use Data

We use data to:

  • Deliver adaptive questions and feedback
  • Calculate learning progress and ability estimates
  • Improve question selection and calibration models
  • Debug and improve system performance
  • See which of the links we share lead people to sign up, so we know where to share Mendalev

We do not use data for advertising.

3. Data Storage

  • Data is stored in a secure database system (including graph-based storage).
  • Data is linked to your account.
  • We keep your account and learning data while your account exists. When you delete your account, §6 describes what is removed, what is de-identified and what is kept, and for how long.
  • Records of your consent. Each time you accept our Terms, are shown this Privacy Policy, or agree to how we use your learning data, we keep a record of which version you saw and when. If you are under 18, we also record your confirmation that a parent or guardian agreed (see §9). We keep the full record while your account exists. See §6 for what happens after deletion.
  • Service logs. Our hosting providers, Render (application server) and Vercel (website), record technical request logs (the address a request came from, the page requested and the time; not what you typed). On our current plans these logs are available for 7 days (Render) and 1 hour (Vercel); the periods change if our plans change. The providers may also keep separate operational and security records under their own terms.

4. Data Sharing

We do not sell personal data.

We do not share personal data with third parties except:

  • Infrastructure providers (hosting, database, deployment services)
  • AI service providers. To grade your answers and generate feedback, we send question text and your responses to a third-party AI provider (currently OpenAI, in the United States). When you ask Mendalev to process a new YouTube video, the video's transcript goes to the same provider. This provider does not use the data to train its models, and processes it under its standard API terms (which include a limited retention window for abuse monitoring).
  • Crash reports. When something breaks in Mendalev, a short crash report goes to Sentry (Functional Software, Inc.), our error-tracking provider. It holds only the type of error, where in our code it happened, the kind of page and the kind of device (phone, tablet or desktop). It holds no account details, no IP address, no cookies and nothing you typed. Sentry stores these reports in the European Union and keeps them for 30 days.
  • When legally required (e.g., court order)
  • Successors in a business transfer. In a merger, acquisition, reorganization, financing, or sale of all or part of our assets — including a transfer to an affiliate, or to a successor or newly-formed entity under common control with us — your personal data may pass to the new owner, who must keep handling it under commitments at least as protective as this policy. This is a corporate transfer, not a sale of your personal data (see §11).

5. Educational Data Sensitivity

This system processes learning and performance data, which may be considered sensitive in educational contexts. We treat this data with care and restrict access to system functionality only.

What this means in practice:

  • Ability estimates (θ), scoring, and calibration parameters are internal — not surfaced to third parties
  • Concept mastery graphs are used only for personalizing the user's own experience

Deferred compliance (not yet applicable):

  • FERPA (US education regulation) — applies when formally adopted by schools
  • GDPR full program — applies when EU users scale

6. Data Deletion and De-identification

Users may request deletion of their data. Upon request:

  • Account data (name, email, username, birth month and year, phone number, OAuth identifiers, and similar direct identifiers) will be permanently removed.
  • Learning history will be deleted or irreversibly de-identified for measurement and content-quality research within a reasonable timeframe. When de-identification is used, we remove direct identifiers from the records and permanently destroy the association to the original account. We do not retain any mapping that would allow your learning history to be re-linked to you. The one exception is the record of your consents: it keeps a scrambled code made from your Google account ID with a secret key held outside our database, so that only we can match it to you, and nothing else about you (see Consent records below).

De-identification is irreversible. Once your account is de-identified, we are unable to restore it or to provide you with a copy of the resulting records, because there is no longer any way to associate those records with you.

Backups. Erased data may survive in operational backup snapshots for up to 30 days following your erasure request. Backup snapshots are destroyed on our normal retention cycle, after which the erased data no longer exists in any system we control. We will not restore pre-erasure data from a backup unless required to do so by law.

Consent records. When you delete your account, we reduce the record of your consents to the minimum needed to show what you agreed to and when: which versions of our Terms, this Privacy Policy and the consent screen you accepted, your confirmation of a parent's or guardian's OK if you were under 18, and the dates. We keep it, for legal and compliance purposes only, until 3 years after deletion or just after your 21st birthday, whichever is later, and longer only while an access request or a legal dispute about it is open. It is then securely destroyed. We never use it for anything else.

Residual risk. Although we remove direct identifiers and permanently destroy the link to your account, no de-identification method can guarantee zero re-identification risk in every circumstance.

To delete your account: open Settings → Danger zone → Delete account permanently in the app. You can also email privacy@mendalev.com if you cannot reach the in-product option.

7. Requesting a Copy of Your Data

You may request a copy of the personal data we hold about you — your profile, answer history, feedback and ratings, saved topics, and per-topic progress.

To make a request, email privacy@mendalev.com from the email address associated with your account. We will verify the request and provide your data in a structured, machine-readable format (JSON) within 30 days.

This is how we honor data access and portability rights (e.g., GDPR Articles 15 and 20, CCPA). Requests are currently fulfilled by an administrator; there is no self-serve download in the app. Note that after deletion or de-identification (§6), we can no longer provide a copy of your learning records, because they are no longer linked to you.

8. Security

We use reasonable technical safeguards to protect data. However, no system is completely secure.

9. Young people

You must be 14 or older to create a Mendalev account yourself. When you sign up, we ask for your birth month and year, but never the day, to check whether you can create your own account and to apply the privacy rules appropriate for your age.

If you are under 14, we do not create a Mendalev account for you or retain the information you entered in the age and consent step.

If you are 14 to 17, you can give your own privacy consent. Before you start, we explain in plain language what information we collect and how we use it.

A parent's or guardian's OK. Written answers are graded by an outside AI service (see §4). If you are under 18, you need a parent's or guardian's OK before you use them: you tick a box confirming that a parent or guardian has agreed. Everything else in Mendalev works without it. You can turn it off at any time in Settings, and a parent or guardian can write to privacy@mendalev.com to turn it off. Turning it off stops anything new from being sent, but cannot recall what was already sent.

What we keep. A record of your confirmation (and of turning it off), what it covered, the version of the text you saw and the date, as part of your consent records (§3, §6). We do not collect your parent's or guardian's name or contact details.

We use your answers and learning activity to measure what you are learning, personalize what you study next, and show your progress. If you join a teacher's course, that teacher can see your progress in that course. Service providers may process information for us where needed to operate Mendalev, as described elsewhere in this policy.

We do not use your personal information for advertising or marketing, research in which you can be identified, or training AI models.

When you turn 18, nothing new is switched on automatically. If we offer an optional use of your information that requires your consent, it will be presented as a separate choice.

You can delete your account from your account settings. We delete or retain associated information according to the retention rules described in this policy, including any limited records we need to keep for legal or compliance purposes.

10. Changes to this policy

We will tell you about material changes to this policy. If a change introduces a new or materially expanded collection, use, or disclosure of your personal information that requires your consent, we will ask for your consent before applying that change to you.

11. Business Transfers and De-identified Data

Business transfers. The product, the company behind it, or its assets may move to a new owner. If we are involved in a merger, acquisition, reorganization, financing, bankruptcy or insolvency, or a sale or transfer of all or part of our assets — including a transfer to an affiliate, or to a successor or newly-formed entity under common control with us (for example, if we move the product into a new company) — your personal data may be transferred as part of that transaction.

  • Not a sale. A transfer of this kind is part of a corporate transaction, not a sale or share of your personal data. Because the recipient assumes operation of the service and is bound to keep handling your data consistent with this policy, it qualifies under the business-transfer exception to the "sale or share" definition in laws like CCPA/CPRA. It does not change our promise in §4 that we do not sell your personal data.
  • Your protections follow the data. Any successor must keep handling your personal data under a privacy policy at least as protective as this one, and for purposes consistent with this policy — not for new, unrelated uses. If practices would materially change, we will tell you first, by email or in-app, and give you a chance to delete your account before the change takes effect.
  • Your rights are unchanged. A transfer does not expand how your personal data may be used, and it does not weaken your deletion or de-identification rights in §6. After a transfer, you exercise those rights against the successor.

De-identified and aggregate data. We treat irreversibly de-identified and aggregate data as non-personal: it carries no personal identifiers and is not restricted by this policy. This includes our calibrated question bank — item and criterion difficulty parameters, scale versions, and our own question content — which contains no personal identifiers. We may retain, use, and transfer this de-identified and aggregate data freely, including to an affiliate or successor and including independently of any business transfer above. This does not weaken your deletion right: §6 still governs your personal data and your account, de-identification stays irreversible, and a deletion request does not require us to destroy de-identified or aggregate data that can no longer be linked to you.

12. Contact us

Our Privacy Officer is responsible for how we handle your personal information. For privacy questions, requests (including access and deletion) and complaints, email privacy@mendalev.com. For help with your account or the service, email support@mendalev.com.

Implementation references (repository)

These pointers are for legal review, school procurement review, and contributors auditing how this policy is operationalized. They are not part of the user-facing terms above.

  • profiling_ethics.md — the green / grey / red framework that governs what we will and will not infer or store about a user, and the two operational tests applied to new profiling features. §2 ("How We Use Data") and §5 ("Educational Data Sensitivity") above are the user-facing surface of those principles.
  • school_privacy_posture.md — current state of consent capture, deletion, export, sub-processor disclosure, and the open gaps. Source of truth for "do we actually do what this policy describes."
  • compliance_laws.md — the regulatory landscape (FERPA, COPPA, SOPIPA, GDPR, CCPA, PIPEDA, Law 25) this policy must stay inside.