Your application.
Handled with care.

1. Who is responsible

Mentenora AI is a brand of Kateryna Kuzmenko. No incorporated company is represented; a postal address will be published here once the company is registered. Privacy contact: mentenora.ai@gmail.com.

2. Information we collect

If you apply, we collect your first and last name, business name, business email address, country and preferred plan. A message is optional. We also record when the application was received, a random application reference, the version of this notice you saw and our later correspondence with you. Please do not send sensitive personal data, payment details or passwords. No customer account is created.

To protect the form against abuse, our server derives keyed one-way codes (HMAC) from your IP address and email address to count recent submissions. These codes are not stored with your application and expire automatically within about two days. Your browser also completes a small computational check (proof of work) that involves no cookies, tracking or third-party service.

Our hosting provider processes technical request data such as IP addresses, request times and browser information to deliver and protect the website. These logs are kept for a limited period under Vercel’s standard log retention and are not used for marketing.

3. Why we use it, and our legal bases

We use application details to understand your request, assess whether we can help and reply to you. Where you ask us to take steps before a possible contract, the legal basis is Article 6(1)(b) GDPR. For business contacts acting for an organisation, and for proportionate security and abuse prevention, we rely on our legitimate interests under Article 6(1)(f) GDPR: handling business enquiries and keeping the website secure. You may object to processing based on legitimate interests. We do not add applicants to marketing lists, and an application never activates a paid service.

4. Required and optional information

The six required fields let us identify you and your business, contact you and understand your preferred plan. Without them we cannot process an application through this form. The message is optional.

5. Who receives your information

Applications are reviewed by the responsible individual named above. We use these service providers (processors) only to run this website and form:

• Vercel (website hosting and the application endpoint, configured to run in Frankfurt, Germany).
• Neon (managed PostgreSQL database storing applications, hosted in Frankfurt, Germany).
• Brevo (sends a notification email to the owner that contains only the application reference, not your details).
• Google Gmail (the owner’s mailbox, which receives that notification and is used to reply to you).

Each provider processes this data under its data processing terms. We do not sell application data, and no advertising or analytics service receives it.

6. Where your information is stored, and international transfers

Your application is stored in a database in the European Union (Frankfurt). The notification email deliberately excludes your details. However, when we reply to you by email, that correspondence is processed by Google, which may process data outside the EU. Our providers may also access data from outside the EU for support or security. Where this happens, transfers rely on the safeguards offered by those providers, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Contact us to receive information about these safeguards.

7. How long we keep it

We delete applications that do not lead to a discussion or agreement six months after our last substantive contact, together with related email correspondence. Notification job records are deleted seven days after delivery; abuse-prevention codes expire within about two days. Database backups expire under the provider’s backup window. If we agree to work together, separate contract terms and retention rules apply.

8. Security

Applications are sent over encrypted connections and stored in an access-restricted database with encryption at rest. The public website can only add new applications; it has no way to list, read or search them. Only the responsible individual can read applications, using separate credentials. Notification emails contain no applicant details. No method of transmission or storage is completely secure, but we work to protect your information and will act on any incident as the law requires.

9. Cookies and analytics

The website uses one optional first-party cookie, mentora_website_theme, only if you choose a light or dark theme; it lasts up to one year and contains only that choice. We use no analytics, advertising pixels, external fonts or third-party scripts. The application form does not set cookies.

10. Your rights

Subject to the conditions of the GDPR, you may request access to, correction, deletion or restriction of your data, receive a portable copy, and object to processing based on legitimate interests. Contact us using the details above; we may need to confirm your identity proportionately. You may also complain to the Luxembourg data protection authority (CNPD, cnpd.public.lu) or another competent supervisory authority. No decision about your application is made solely by automated means.

11. Changes

We will publish any material change here with a new effective date. Effective date: 19 October 2026. Notice version: 2026-10-19.