Legal
Privacy notice
How we collect, use, share and protect personal data, and how to use your rights.
1. Who is responsible for your data
Raghavendra N, trading as BA Mentorship, India, decides how and why your personal data is used. Under India's Digital Personal Data Protection Act, 2023 this makes us the Data Fiduciary; under the GDPR and UK GDPR, the controller. Contact: support.bamentorship@gmail.com.
This notice applies to accounts and to US dollar purchases from the effective date above, and to the website generally. Earlier purchases are also covered by the preserved privacy policy on our policies page; where the two differ for an earlier purchase, the more protective rule applies.
2. What we collect and where it comes from
| Category | What it includes | Source |
|---|---|---|
| Account | Name, email address and profile picture from Google sign-in; an internal account ID | Google, when you sign in |
| Orders and access | Package, price, order and access dates, access status, refunds | You and our systems |
| Payment records | Dodo Payments payment ID, amount, currency, tax, status, receipt or invoice link. Not your card number, which only Dodo Payments handles | Dodo Payments |
| Lab progress and work | Your domain choice, stage and task progress, and the text you write for each task | You |
| AI review usage | Dates and counts of AI reviews and estimated cost. The work reviewed is part of your saved Lab work | Our systems |
| Chat messages | Name, email, message, the page you were on and your consent record | You, through the chat button |
| WhatsApp messages | Your WhatsApp number, profile name and the messages you exchange with our business number | You, through WhatsApp (Meta) |
| Support email | Your email address and what you write | You |
| Optional named activity | If you opt in: pages viewed, internal links clicked, timestamps and a self-reported country or region | You, with consent |
| Aggregate page counts | Daily count of page loads per page. No identity, IP address, cookie or device data is stored | Our systems |
| Security logs | Technical request records kept by our host to run and protect the service | Our hosting provider |
We do not use IP-based location, device fingerprinting, advertising identifiers or form-content capture.
3. Why we use it and our lawful bases
| Purpose | Data used | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Create and secure your account; provide the Lab, kits and access | Account, orders, Lab work | Contract |
| Process purchases, grant access, handle refunds and disputes | Orders, payment records | Contract; legal obligation |
| Give AI feedback when you click Get AI review | The piece of work you submit | Contract (you request it) |
| Reply to support, chat and WhatsApp messages | Messages and contact details | Steps you ask for; consent for chat-button leads |
| Keep tax, accounting and legal records | Orders, payment records | Legal obligation |
| Prevent fraud and abuse (for example extra trials); keep the service secure | Account, security logs | Legitimate interests |
| Understand which pages are used, without identifying anyone | Aggregate page counts | Legitimate interests |
| Optional named activity to improve the website | Optional activity | Consent (you can withdraw at any time) |
For India, we process personal data on the basis of your consent or for a legitimate use allowed by the DPDP Act, such as data you voluntarily give us for a specific purpose. We do not use your data for advertising, sell it, or make decisions about you based solely on automated processing that have legal or similarly significant effects. The automatic checks and AI review only produce learning feedback.
4. AI review
AI review runs only when you click Get AI review. We then send the text of that piece of work, with the task's marking guide, to Anthropic's Claude API. We do not send your name, email or account ID. Anthropic processes it as our service provider to return feedback. Anthropic states in its commercial terms that it does not use data sent through its API to train its models by default; it may keep that data for a limited period for safety and abuse monitoring. Please do not include personal or confidential information in your work.
6. International transfers
We are based in India and our main hosting is in Singapore. Some providers (including Google, Meta and Anthropic) process data in the United States and other countries. Where the GDPR or UK GDPR applies, we rely on the safeguards those providers offer, such as standard contractual clauses or adequacy decisions. We transfer data only to countries the Indian government has not restricted.
7. How long we keep it
| Data | How long |
|---|---|
| Account | While your account is open. Deleted within 30 days of a verified deletion request, except records we must keep. Accounts with no purchase that are inactive for 24 months may be deleted |
| Orders and payment records | For the period required by applicable tax and accounting law (in India, for example, the period in CGST Act section 36 where it applies), then deleted |
| Lab work (paid) | During your access period and the 30-day export window, then deleted within 90 days |
| Lab work (trial only) | 12 months after your trial ends, so you can continue if you buy, then deleted |
| AI review usage records | 12 months |
| Chat-button messages | 365 days from when you send them |
| WhatsApp messages | 365 days in our systems; Meta keeps its own copies under its terms |
| Support email | 90 days after the case is closed, unless needed for an open order, refund, dispute or legal record |
| Optional named activity | 90 days, or sooner if you withdraw consent |
| Security logs | Up to 1 year |
| Backups | Deleted data expires from backups within 90 days |
8. Security
We use encrypted connections, Google sign-in (we never store your password), server-side access checks on every protected page and API, a database role with restricted permissions, and access limited to the owner. No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities where the law requires.
9. Your rights and how to use them
Depending on where you live, you can ask to access, correct, update, delete or receive a portable copy of your personal data; object to or restrict some uses; and withdraw consent at any time (this does not affect what was done before). Email support.bamentorship@gmail.com from the address on your account. We may ask you to confirm your identity, but never for card details or passwords. We acknowledge requests within 48 hours and respond within 30 days. If a request is complex we will explain why we need more time, within the limits the law allows. Some records, such as payment records, must be kept even if you ask us to delete them; we will tell you which.
You can also manage optional named activity at Privacy choices.
10. India: Digital Personal Data Protection Act, 2023
If you are in India, to the extent the Act and its Rules are in force:
- We are the Data Fiduciary. We process your personal data for the purposes listed in section 3 of this notice, with your consent or for a legitimate use allowed by the Act.
- You can withdraw consent as easily as you gave it. Withdrawal stops future processing based on consent; it may mean we cannot continue a service that needs that data.
- You can ask for a summary of the personal data we process and the processing activities, the identities of those we share it with, and correction, completion, updating or erasure of your data.
- You can nominate another person to exercise your rights if you die or become unable to do so. Email us to register a nominee.
- You can raise a grievance with our Grievance Officer (section 15). If you are not satisfied with our response, you may complain to the Data Protection Board of India.
11. EEA and UK: GDPR rights
If the GDPR or UK GDPR applies to you, you have the rights in section 9, including the right to object to processing based on legitimate interests and the right to data portability. You can complain to the data protection supervisory authority in the country where you live or work, or in the UK to the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.
12. United States: state privacy rights
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act as amended by the CPRA and similar state laws. Whether or not those laws apply to a business of our size, we offer residents of any US state the rights to know, access, correct and delete their personal information, and we will not treat you differently for using them. The categories, sources, purposes and recipients are listed in sections 2, 3 and 5.
14. Children
The service is not intended for anyone under 18, and you must be at least 18 to create an account. Under India's Digital Personal Data Protection Act, 2023 anyone under 18 is a child, and we do not knowingly process children's personal data. If you believe a child has given us personal data, contact us and we will delete it.
15. Grievance Officer
Grievance Officer: Raghavendra N
Email: support.bamentorship@gmail.com
We acknowledge grievances within 48 hours and aim to resolve them within 30 days of receipt.
16. Changes to this notice
We will update the version and dates above when this notice changes, and tell account holders by email about important changes before they apply. We will ask for consent again before using data for a new purpose that needs consent.