Privacy Policy

How we protect your data

We protect personal information, especially sensitive data such as Google user data, student details and assessment results, with these safeguards:

• Encryption in transit. Our website and portals are served only over HTTPS (TLS). Our servers also use encrypted connections to reach Google, our database and our email provider.
• Encryption at rest. Our database provider encrypts stored data with AES-256. The Google token that lets us act on a mentor's calendar has extra protection: it is stored as an encrypted secret in a separate vault, and only our servers can decrypt it. Short-lived Google access tokens are kept in memory only and never stored.
• Access controls. Every table in our database uses row-level security, so each account can reach only the records it is allowed to see. No user account can read Google connection data; only our server code can use it. Secret keys stay on our servers and are never sent to browsers. Only authorised staff can use the admin portal, and what they can do depends on their role.
• Least privilege. We ask Google only for what scheduling needs: your busy times and the events we create on your calendar.
• Verified requests. Each Google connection request is signed so it can't be forged. Before we act on a calendar change notification, we check its secret token.
• Minimisation and deletion. We don't store your busy times. When a mentor disconnects Google, we revoke our access and delete the stored token. You can ask us to delete your data at any time (see "Your choices").
• Audit and incidents. We keep audit records of changes to mentorship sessions. If a security incident affects your data, we will notify you and the relevant authorities as required by law.

Google Calendar for mentors

Mentors can connect a Google account to the Mint Minds mentor portal so that learners can book sessions with them. Only mentors connect Google. Students and individual learners never give us access to their Google accounts.

What we access

• Your Google account email address, so we can show which account is connected and keep your booked sessions on the right calendar.
• The times you are busy on your primary calendar. We see busy periods only, not event titles, descriptions or attendees.
• The events Mint Minds creates on your primary calendar for your mentorship sessions.

How we use it

• We use your busy times to offer learners only the times you are free.
• When a learner books a session, we create an event on your primary calendar with a Google Meet link and invite the learner.
• When a session is rescheduled or cancelled in Mint Minds, we move or delete that event.
• Google tells us when your calendar changes, and we then check the events Mint Minds created. If you move or delete a session in Google Calendar, we update the booking and let the learner know.
• We do not read, change or delete any other events on your calendar.

What we store

We store your Google account email address, an encrypted token that lets us act on your calendar, an identifier for Google's change notifications, and the ID and Google Meet link of each event we create. Busy times are used to work out open slots and are not stored. See How we protect your data for how this data is secured.

Sharing

The learner who books a session sees its time and Google Meet link, in Mint Minds, in the Google Calendar invitation and in emails we send about the session. Our hosting, database and email providers process this data on our behalf only to run these features. We do not sell Google user data, use it for advertising, or use it to train artificial intelligence models. Mint Minds staff do not read it unless you ask us to, or where it is needed for security or to comply with the law.

Mint Minds' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting

You can disconnect Google from the Availability page of the mentor portal once you have no upcoming sessions. When you disconnect, we stop receiving change notifications, revoke our access with Google and delete the stored token. You can also remove our access at any time from your Google Account. Event IDs and Meet links stay with your session history in Mint Minds. To have them deleted, contact us using the details below.