Privacy Policy

CXMentor ("we," "our," or "us") operates the mentorship platform accessible at cxmentor.in. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal data when you use our platform.

This policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules. By registering on or using CXMentor, you acknowledge you have read and understood this policy.

• To create, verify, and manage your account
• To match students with suitable mentors based on goals and expertise
• To facilitate session booking, scheduling, and video conferencing
• To process credit purchases and mentor payout requests
• To generate AI-assisted session summaries (only with your in-session consent; you may disable transcript capture at any time)
• To send transactional emails — booking confirmations, reminders, payment receipts, and session completion notices
• To detect fraud, abuse, and ensure platform security
• To improve our platform through aggregated, anonymised usage analytics
• To share session engagement metrics with your enrolled institution's Career Development Cell (CDC), if applicable

Under the DPDP Act, 2023, we process your personal data on the following bases:

• Consent — you provide explicit consent at registration and before AI transcript processing
• Contractual necessity — processing required to deliver the mentorship booking services you have requested
• Legitimate interests — fraud prevention, platform security, and aggregated analytics to improve the service
• Legal obligation — retention of financial records as required by Indian tax laws

We do not sell your personal data to third parties. Data is shared only in the following limited circumstances:

• Mentors — limited student profile (name, college, career goals) shared with a mentor only after a session is booked
• Institutions / CDC — session engagement metrics (sessions completed, endorsements, skill progress) shared with your institution's CDC admin, only if you are an enrolled institution member
• Payment processor — transaction data shared with Razorpay to process credit purchases; Razorpay's own privacy policy applies to their handling
• Email infrastructure — transactional emails sent via SMTP providers; no marketing lists are shared
• Law and legal process — if required by law, court order, or a competent government authority under applicable Indian law

• Active account data is retained for the lifetime of your account
• After account deletion: personal data is retained for up to 2 years for audit and legal compliance purposes
• Session transcripts and summaries: retained for 1 year, then permanently deleted or anonymised
• Payment and transaction records: retained for 7 years as required under the Income Tax Act, 1961

As a Data Principal under the DPDP Act, you have the right to:

• Access — request a summary of personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal retention requirements)
• Withdraw consent — withdraw consent for data processing at any time; this may limit your ability to use certain features
• Grievance redressal — file a complaint with our Grievance Officer (see Section 9)
• Nomination — nominate a person to exercise your rights on your behalf in case of death or incapacity

To exercise any of these rights, email us at privacy@cxmentor.in. We will acknowledge your request within 48 hours and resolve it within 30 days.

We implement reasonable technical and organisational measures including:

• HTTPS / TLS encryption for all data in transit
• Bcrypt hashing for stored passwords — plaintext passwords are never stored
• Short-lived JWT tokens with refresh-token rotation for authentication
• Role-based access controls ensuring staff can only access data necessary for their function
• Separate authentication secrets for user, admin, and institution CDC contexts — these are never shared or mixed

No system is completely secure. In the event of a data breach that is likely to result in high risk to your rights, we will notify you and the relevant authority as required by law.

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer:

CXMentor is intended for college students and working professionals, typically 17 years of age and above. We do not knowingly collect personal data from children under 16 years of age. If you believe a minor's data has been submitted on our platform, contact us immediately at privacy@cxmentor.in and we will delete it promptly.

Please read our Cookie Policy for full details. In brief: we use browser localStorage (not traditional cookies) for authentication tokens and user preferences. Razorpay's payment iframe may set its own cookies, governed by Razorpay's privacy policy.

Your data is processed and stored on servers located in India. If any data is transferred outside India (for example, via third-party services), we ensure appropriate safeguards are in place as required by applicable law.

We may update this Privacy Policy periodically. For material changes, we will notify you via email and an in-platform notice at least 7 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For all privacy-related queries: