Privacy Policy

Working draft — publication pending. The retention and deletion sections will be completed once the corresponding system has been defined, implemented and verified. This version must not be published as a final policy.

This Privacy Policy explains how Mentur collects, uses, stores, protects, and processes personal data and documents uploaded by users when using the academic document analysis and style verification application.

This policy informs you about the processing of your data. Using Mentur does not constitute blanket consent for all purposes. Optional analytics requires a separate choice; any authorizations required by applicable law must be distinguished from providing the service.

1. Data controller

The controller responsible for processing personal data is:

Name or legal name: Andrés Rivas
Trade name: Mentur
Country: Colombia
Contact email: [email protected]
Email for privacy requests: [email protected]
Website: https://mentur.co

2. Scope of this Policy

This Policy applies to the use of Mentur, including:

• User registration and login.
• Use of the application as a guest user.
• Uploading academic documents.
• Automatic document analysis.
• Generation and display of reports.
• Access to document previews.
• Use of security, support, and administration features.
• The APA title page tool and feedback forms.

Mentur is designed to help review formal, structural, citation, reference, presentation, and other academic criteria configured within the application. It does not replace an academic, legal, editorial, or institutional review performed by a competent person or entity.

3. Personal data we collect

Mentur may collect the following personal data, depending on how you use the application:

3.1 Account data

When you create an account or log in, we may collect:

• Name.
• Email address.
• Password protected using a hash function, if you register with a password.
• Email verification status.
• Registration date.
• Account update date.
• Country derived from connection information and registration method.
• Requested email changes awaiting confirmation.
• Remember-me token, if you use that option.
• Data related to two-factor authentication, if you enable it.

If you use Google login, we may collect the data needed to authenticate your account, such as Google identifier, email address, name, and associated avatar, according to the information provided by Google and the permissions you authorize.

3.2 Technical and security data

To operate the application, maintain active sessions, prevent abuse, and protect the security of the service, we may collect:

• IP address.
• Browser and device information.
• Session identifiers.
• Access date and time.
• Activity records.
• Usage events.
• Login attempts.
• Security events.
• Technical information related to errors, requests, or internal processes.

3.3 Uploaded document data

When you upload a document, we may collect and store information related to that file, including:

• Original file name.
• File type.
• Extension.
• MIME type.
• File size.
• Upload date and time.
• Analysis status.
• Public or internal document identifier.
• Uploaded original file.
• Derived files, such as previews, reports, analysis results, or temporary files needed to process the document.

You voluntarily upload a Word document in .docx format. During analysis, Mentur may generate a PDF preview for the viewer; this conversion does not mean that the tool accepts PDF uploads.

Original and derived files are stored privately with access controls.

3.4 APA title page tool

The fields you enter — such as a title, names, institution, course or instructor — are sent to Mentur to generate the downloadable document. The draft may remain in your browser until you delete it, even when it contains names or other personal data.

The tool also retains information for internal statistics: institution, faculty, program, course, country, language, selected format, number of authors and generation date, along with an identifier derived from the IP address and browser. This statistical record does not store author names, the title or the instructor name as event fields. It is separate from the full draft that your browser may retain.

3.5 Feedback and support

If you submit feedback or request support, your message, ratings and any contact details you provide are processed. Report feedback may be linked to your account or guest identity, the document and its report.

4. Processing of document content

To provide the service, Mentur’s own analyzer processes the content of the uploaded document. This may include extraction and analysis of:

• Document text.
• Paragraphs or fragments.
• Headings.
• Citations.
• References.
• Tables.
• Figures.
• Structural elements.
• Document formatting.
• Errors, warnings, or possible noncompliance with academic, format, citation, reference, or presentation criteria.
• Document metrics.
• Preview blocks.
• Matches or fragments associated with detected issues.

The analysis may generate reports that include fragments of the document needed to show the user where a possible issue or aspect to review is located.

Mentur does not ask you to upload documents containing sensitive data, confidential third-party information, financial data, medical records, identity documents, or other information that is not necessary for academic analysis. If you include that type of information in the document, it may be technically processed as part of the uploaded file.

5. Purposes and legal basis of processing

Mentur processes personal data and uploaded documents for the following purposes:

• Creating and administering user accounts.
• Allowing login and authentication.
• Enabling access with Google, when the user chooses that method.
• Allowing document upload.
• Processing documents to analyze aspects related to format, structure, citation, references, presentation, and other academic criteria configured in the application.
• Generating analysis reports.
• Showing errors, observations, metrics, and document previews.
• Differentiating access among guest users, registered users, and administrators.
• Limiting or expanding display of results according to user type.
• Maintaining user sessions.
• Protecting application security.
• Preventing abuse, automation, attacks, unauthorized access attempts, brute force, or misuse.
• Recording technical events, errors, and security audits.
• Responding to support requests and feedback.
• Generating documents with the APA title page tool.
• Sending transactional communications related to the account or service.
• Obtaining public-page statistics through optional analytics, if you accept it.
• Improving the stability, operation, and user experience of the application.
• Complying with legal or contractual obligations or requirements from competent authorities, when applicable.

5.1 Purposes requiring distinct legal grounds

Accounts, requested analysis and operational emails are part of providing the service; security and abuse prevention are purposes related to protecting it. They do not depend on analytics consent. Where the GDPR applies, performance of the requested service may support processing strictly necessary to provide it, but does not give blanket authorization for additional uses.

Optional analytics relies on your consent, which you can withdraw. Where Colombian or other applicable law requires authorization, it must relate to disclosed purposes and cannot be replaced by merely using the website. The legal grounds for additional uses, including reusing documents to improve the product, require specific review.

6. Guest users and registered users

You can analyze documents as a guest without creating an account. Access to a guest report requires both a valid temporary link and the authorized browser session that uploaded it. The identifier used to recognize guests and apply limits does not, by itself, grant report access.

Registered users may access additional features, save or consult reports associated with their account, and view results under the conditions defined by the application.

The number of visible errors, observations, or results may vary according to the type of user, document size, account status, or internal service rules.

Registering from a guest report can associate that particular document with the new account, provided valid access is maintained. This association is also available when returning from Google sign-in. It does not automatically transfer all previous guest documents.

If you enable sharing for an account report, anyone with the link can view what you have allowed, including the preview if enabled. You can disable that link.

7. Retention of documents, reports, and data

Drafting pending. This section will be completed after retention periods and scope have been defined, implemented and verified. It does not set out periods or deletion commitments that remain unimplemented.

8. Deletion of account, documents, and reports

Drafting pending. This section will distinguish between hiding a report, deleting its data, deleting an account and requesting erasure of personal data. Their effects will be described once the final technical behavior has been implemented and verified.

9. Administrative access, support, and technical improvement

Accounts with administration permissions can view user data, original documents, previews, reports, feedback and technical records. These functions support assistance, investigation of errors or abuse, and review of the analyzer's operation.

Manual review may involve opening or downloading a document and comparing its content with the report. It should be limited to information relevant to the purpose of the review. The application records certain administrative events, but this should not be understood to mean that every viewing of data is audited.

Reusing documents to improve the product is a separate purpose from the requested analysis. Simply uploading a file or accepting cookies does not provide blanket authorization for that reuse. Its conditions and legal basis require a specific assessment.

10. Providers and external services

Mentur uses the following services, depending on the feature you use:

• Hetzner: the main infrastructure and private storage of documents and derived files.
• Cloudflare: site delivery and network protection. It handles web traffic and may process connection and request data.
• Amazon SES: delivery of transactional emails, involving the recipient's address, message content and information needed for delivery.
• Google OAuth: Google sign-in, when you choose it. Mentur receives identification and profile information needed to manage your access.
• Google Analytics: browsing statistics on permitted public pages, only with prior acceptance.
• Microsoft Clarity: interaction analysis on permitted public pages, only with prior acceptance.
• Bunny Fonts: delivery of interface fonts. Downloading them involves a connection between your browser and that provider.

The APA analyzer is Mentur's own service: it receives the full document to process it and return the result. The current workflow does not send documents to external artificial intelligence providers. PDF previews are also generated using tools running on our own infrastructure.

Authentication, analytics and email services receive information for their respective purposes; they are not part of the analysis of academic content.

11. International transfers or storage

Mentur's main infrastructure and document storage are hosted by Hetzner in Falkenstein, Germany. This does not mean that all information processed by the service remains in Germany or the European Economic Area.

Transactional email uses Amazon SES in a United States region. Google authentication, optional Google and Microsoft analytics, external fonts and Cloudflare's network infrastructure may involve processing in other regions, depending on the service and its configuration.

Primary document storage is distinct from these connection, authentication, browsing and communication activities. You can email [email protected] for information about recipients of your data and applicable safeguards. Contractual review of providers and the mechanisms applicable to international transfers remains pending; this policy does not claim that specific contractual safeguards have been verified.

12. Cookies and similar technologies

Mentur uses necessary cookies to maintain sessions, protect requests and manage access, as well as language and interface preferences. Google Analytics and Microsoft Clarity analytics are optional and remain blocked until the visitor accepts them.

You can accept or reject analytics without losing access to Mentur. Your choice is saved for 180 days in that browser and can be changed or withdrawn through Cookies in the footer of public pages where optional analytics is offered.

Managed trackers are excluded from protected document, report and viewer areas, account areas, sign-in and registration screens, and administration, even when acceptance has been saved.

The Cookie Policy explains the technologies used, their lifetimes and how to change your choice or clear browser data. Withdrawing consent prevents subsequent loading of analytics; it does not guarantee removal of cookies on third-party domains or information already sent.

13. Analytics and usage statistics

With your acceptance, Google Analytics helps us understand visits, pages viewed, traffic sources and general browser or device characteristics. Microsoft Clarity helps us analyze clicks, scrolling and interactions on public pages through heatmaps and session replays.

These services may process browser identifiers and technical browsing data. Their cookies and possible uses of identifiers by providers are explained in the Cookie Policy. They are not used to analyze academic documents and are not loaded in protected private areas.

Mentur also records internal activity and statistics to operate the tool, enforce limits, address errors and prevent abuse. These service records are separate from optional third-party analytics and are not disabled when you reject it.

14. Information security

Mentur adopts reasonable technical and organizational measures to protect information, including:

• Password protection using hashing.
• CSRF protection.
• Form validation.
• Request limits.
• Controls against abuse, brute force, and credential stuffing.
• Blocking or detection of suspicious patterns.
• Identity checks for access to account areas.
• Access policies and controls.
• Private document storage.
• Hashed guest tokens, with expiration, revocation, or rotation.
• Access control for reports and previews.
• Audit records for sensitive events.
• Content loading restrictions and security policies.
• Validation of file types and sizes.

Although we apply reasonable security measures, no system connected to the internet can guarantee absolute security. The user must also protect their credentials, log out on shared devices, and avoid uploading documents containing unnecessary sensitive information.

15. Rights of data subjects

Depending on applicable law and the conditions of each right, you may request:

• Access to your data and information about its processing, including a copy.
• Correction or updating of inaccurate data.
• Erasure of personal data where applicable.
• Restriction of processing or objection to particular uses.
• Data portability in the applicable circumstances.
• Withdrawal of consent for processing based on it, without affecting the lawfulness of processing before withdrawal.
• Information about the use of your data and proof of authorization, where applicable.
• The opportunity to lodge a complaint with the competent authority: in Colombia, the Superintendencia de Industria y Comercio; in the European context, the competent data protection authority.

To exercise these rights, email [email protected] and identify the data or documents concerned. We may need to verify your identity and clarify the scope to avoid disclosing or deleting someone else's data. The requirements and time limits of the law applicable to your case apply.

These rights do not depend on the availability of a button in the application. You can currently edit certain profile details; analytics is managed through “Cookies”. There is no download of all your data available through self-service. The description of deletion options remains pending together with section 8.

16. Sensitive data

Mentur does not intentionally request sensitive data to provide the service.

However, documents uploaded by the user may contain sensitive or confidential information included by the user, such as health data, family information, data of minors, financial information, personal academic information, opinions, third-party data, or other private information.

The user is responsible for reviewing the content of the document before uploading it and for avoiding inclusion of sensitive or unnecessary information for the analysis.

If you detect that you uploaded a document with sensitive information and want to request its deletion, you may contact us through the privacy email.

17. Minors

Mentur is not specifically directed to children or adolescents.

If a minor uses the application, they must do so with authorization from their parents, guardians, or legal representatives when applicable law requires it.

Mentur may delete accounts, documents, or information if it identifies that data of minors has been processed without the necessary authorization or under conditions that may affect their rights.

18. Transactional or operational communications

Mentur may send transactional communications related to:

• Account registration.
• Email verification.
• Password recovery.
• Account security.
• Operational confirmations or notifications.
• Support requested by the user.
• Necessary information about relevant changes to the service or this Policy.

19. Commercial communications

Registering an account and accepting cookies do not constitute subscribing to advertising. The application currently has no integrated email marketing campaign system or commercial subscription flow. The operational emails described above are independent of any advertising subscription.

20. Payments

Mentur currently has no integrated payment gateway or in-app payment flow. If you answer questions about pricing or payment preferences in a feedback form, those answers are retained as feedback; they are not a transaction and do not collect banking credentials.

21. Changes to this Policy

Mentur may update this Privacy Policy to reflect legal, technical, operational, or commercial changes.

When changes are relevant, Mentur will seek to inform users through the application, email, or other reasonable means.

The current version will be the one published on the Mentur website or application.

22. Contact

For questions, requests, inquiries, or complaints related to privacy and personal data protection, you may contact:

Privacy email: [email protected]
Support email: [email protected]
Website: https://mentur.co