Privacy Policy

Account & profile — your email, name, password (stored as a one-way hash, never in plain text), college, university, branch, semester, division, WhatsApp number if you add one, a profile photo if you add one, and the weak subjects, skills, interests, goals, and placement status you tell us about yourself during onboarding.

What you create in the app — your conversations with Mentor, notes, planner entries, goals, projects, saved code, resume content, and any documents (PDF/DOCX/PPTX) or images you attach to a Mentor message, so their text can be read alongside your question.

Payment records— which plan or credit pack you bought, the amount, and the gateway used. For that purchase, we do not receive or store your card, UPI, or bank details — those go directly to our payment processors (see Section 3).

Campus Ambassador program— if you apply, the college you're representing and a phone number for coordination. If approved, the UPI ID you give us so we can pay out cash commission you've earned. This is a different case from the purchase flow above: this UPI ID does go into our own database, because there's no payment processor standing between us and a payout we're sending you — it's used only for that.

Technical data — IP address (used to slow down abuse and brute-force login attempts, not to track you), login timestamps, and session cookies that keep you signed in.

To run the actual product: answer your questions, generate notes/plans/code/resume content tuned to your branch and semester, track your monthly usage against your plan, save your work so it's there next time you log in, process a payment you initiate, and keep your account secure (rate-limiting, login-lockout protection, optional two-factor authentication).

We do not use your academic or chat data to train our own models, and we do not sell your personal information to anyone.

AI processing — your Mentor messages and any attached document text are sent to OpenRouter, which routes the request to the underlying AI model (providers include Anthropic, Google, OpenAI, and Mistral, depending on which one answers your message) purely to generate a reply. This is the same as any AI-assistant product — the request has to reach a model to get an answer.

Payments— when you pay for a plan or credits, you're handed off to Cashfree, Razorpay, or NOWPayments (for crypto), who process the transaction under their own privacy policies. We only receive confirmation that a payment succeeded, not your card or wallet details.

Infrastructure— our hosting (Vercel) and database (Prisma Postgres) providers store data on our behalf to keep the app running; they don't use it for their own purposes.

We don't share your data with advertisers, and we don't run third-party ad or tracking scripts.

Sumantrak uses one essential session cookie to keep you signed in, and a CSRF token cookie to protect form submissions from forgery. Both are strictly functional — we don't use advertising, analytics, or cross-site tracking cookies.

We keep your account and content for as long as your account is active. If you turn on "temporary memory" for a Mentor conversation, that specific conversation is never saved to begin with. Payment records are kept as long as required for accounting and legal purposes even after account deletion.

You can update most of your profile directly from your profile page once logged in, including your memory/privacy settings (what Mentor is allowed to remember about you). To correct, export, or delete data we hold about you, or to close your account entirely, reach us through the in-app Support section (Workspace → Support) — we handle these requests manually and will confirm once done.

Sumantrak is built for engineering, diploma, BCA, and BSc Computer Science/IT students, and isn't directed at children. You must be at least 13 years old to create an account, and if you're under 18, you should have a parent or guardian's permission to use a paid plan.

Passwords are hashed, never stored or logged in plain text. Two-factor authentication (TOTP) is available from your profile. All traffic is served over HTTPS. No system is perfectly secure, but we take reasonable, industry-standard steps to protect your data and will let you know if a breach affects you, as required by law.

If we make a material change to how we handle your data, we'll update the effective date at the top of this page and, where appropriate, notify you in-app.

Questions about this policy or your data — reach us through the in-app Support section (Workspace → Support), the same channel used for account help.

Grievance Officer — for a complaint about how your personal data is handled, the same in-app Support channel (Workspace → Support) also serves as our designated grievance contact, in accordance with applicable Indian data protection law.