Privacy Policy

Last updated: 12 July 2026

This privacy policy explains how Kyvern (“we”, “us”, “our”) collects, uses, and protects your personal data when you use our mentoring platform. Kyvern is the trading name for [UNSET: registered company name and address]. If you have any questions, contact us at [UNSET: privacy contact email].

1. Who is responsible for your data

Kyvern is the controller of your personal data. We have not appointed a separate Data Protection Officer. You can reach us using the contact details above with any privacy question.

2. What data we collect

We collect these types of personal data from you:

• Account data: your name, username, email address, and password (your password is stored and secured by our auth provider, Supabase).
• Profile and onboarding data: your mentoring goal, years of experience, learning style, meeting frequency, how long you can commit, feedback preference, working style, and the values you look for in a mentor.
• Mentoring activity: messages you send, session transcripts, AI-generated summaries, ratings, and the mentor or mentee you match with.
• Payment data: if you subscribe to a paid plan, your billing details are collected and processed by Stripe. We do not store your card number.
• Communications: reminders and no-show notices we send you by email.

3. How we collect your data

You give us most of your data directly when you sign up, finish onboarding, message a mentor, or subscribe. We also collect some data automatically through essential cookies that keep you signed in and through the video and AI features described below.

4. How we use your data and why

We process your data for these purposes:

• To create and run your account (legal basis: contract).
• To match you with mentors, run sessions, and send reminders (legal basis: contract).
• To process your subscription payments (legal basis: contract).
• To keep the platform secure and prevent fraud (legal basis: legitimate interest).
• To send you marketing emails, only if you agree (legal basis: consent). You can withdraw consent at any time.
• To meet legal obligations, such as keeping required records (legal basis: legal obligation).

5. Automated matching and profiling

We use automated processing, including profiling, to suggest mentors and to summarise sessions. Our AI model (provided by xAI) reads your profile and session content to produce match suggestions, explain the matches, suggest skills, and list action items. The final choice is always yours: AI matches, but you choose. We do not make decisions that legally affect you based only on automated processing.

6. Who we share your data with

We share your data with a small number of service providers who help us run the platform. These recipients are:

• Supabase - hosting, database, and authentication.
• Stripe - payment processing for paid plans.
• LiveKit - video for 1:1 and group mentoring sessions.
• Resend - sending reminder and no-show emails.
• xAI - powering the AI matching and session summaries described above.

We do not sell your personal information. We do not share it for cross-context behavioural advertising. If that ever changes, we will offer an opt-out and honour the Global Privacy Control (GPC) signal.

7. International transfers

Your data is stored with our hosting provider, Supabase ([UNSET: Supabase hosting region]). If your data is transferred outside the UK or the European Economic Area, we rely on Standard Contractual Clauses or another lawful safeguard to protect it.

8. How long we keep your data

We keep your data only as long as we need it. We keep your account and profile data for as long as your account is active, then delete it within [UNSET: retention period, e.g. 30 days] of account closure. We keep payment records for [UNSET: retention period required by law] to meet legal and tax obligations. Session transcripts are kept for [UNSET: retention period] or until you delete them.

9. Your rights under UK and EU law

If you are in the UK or the EU, you have the right to:

• access your data;
• have inaccurate data corrected;
• erasure (the right to be forgotten);
• restrict how we process your data;
• receive your data in a portable format (data portability); and
• object to processing.

10. Your rights under California law

If you are a California resident, you have the right to know, the right to delete, the right to correct, the right to limit your personal information, and the right not to be discriminated against for using these rights. In detail:

• know what personal information we collect and how we use it;
• delete your personal information;
• correct inaccurate information;
• limit our use of sensitive personal information; and
• not be discriminated against for using these rights.

Sensitive personal information we handle includes your account login and financial account data processed through Stripe. We do not collect social security numbers, precise geolocation, biometric, or health data.

To exercise any of these rights, contact us using the details below. We will check your identity and respond within 45 days. You can also use a Global Privacy Control (GPC) signal in your browser.

11. Withdrawing consent

Where we process your data on the basis of consent, you can withdraw that consent at any time. Withdrawing consent does not affect processing we already carried out. Contact us to withdraw consent.

12. Complaints

You have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner’s Office (ICO) at ico.org.uk. If you are in the EU, you can contact your local data protection authority.

13. Cookies

We use strictly necessary cookies to keep you signed in and to make the site work. We do not use advertising or tracking cookies. If we add analytics or advertising cookies in future, we will update this notice and, where required, ask for your consent.

14. Children

Kyvern is a professional mentoring service for users who are 18 or older. We do not knowingly collect personal data from children.

15. Mentor vetting and no guarantee

We carry out basic checks on mentors before they join Kyvern. These checks include confirming a mentor’s identity and the experience they claim to have. We do not run deep background checks. Because our mentors are based in many different countries, the checks we can carry out vary by location and are limited.

You are responsible for doing your own due diligence before you choose a mentor. Satisfy yourself that a mentor is right for your needs before you share personal information or act on their advice.

Kyvern aims to give you a safe and enjoyable mentoring experience. We are not liable for a mentor’s conduct or for the outcome of a mentoring relationship, unless the law says we must be. Many factors affect whether a mentoring relationship works well, so we cannot guarantee any particular result, quality, or experience.

16. Contact us

To ask a question, exercise a right, or withdraw consent, contact us at [UNSET: privacy contact email]. We will respond within one month.

17. Changes to this policy

We update this privacy policy whenever our practices change, and we publish the latest version on this page. The “Last updated” date shows the latest version.