Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) supplements the Terms of Service and governs the processing of personal data by MentorStack Inc. (“MentorStack,” “we,” “us,” or “our”) on behalf of the customer (“Customer”) in connection with the MentorStack platform. This DPA applies whenever MentorStack processes personal data as a data processor on behalf of Customer as data controller.

2. Definitions

• Controller: The entity that determines the purposes and means of processing personal data.
• Processor: The entity that processes personal data on behalf of the Controller.
• Data Subject: An identified or identifiable natural person whose personal data is processed.
• Personal Data: Any information relating to a Data Subject, as defined in GDPR Article 4(1).
• Sub-processor: Any processor engaged by MentorStack to carry out processing activities on behalf of Customer.
• Processing: Any operation performed on personal data, as defined in GDPR Article 4(2).

3. Scope & Roles

Customer is the Controller of personal data submitted to or processed through the MentorStack platform. MentorStack is the Processor acting on Customer's behalf. MentorStack will process personal data only on Customer's documented instructions, including as set out in this DPA and the Terms of Service, unless required to do so by applicable law. In such a case, MentorStack will inform Customer of that legal requirement before processing, unless the law prohibits such notification.

MentorStack is a Canadian company and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) in its own right, independently of this DPA and of any obligation Customer owes under its own law. Where Customer is subject to the GDPR, the UK GDPR, or another data protection law, this DPA is the instrument through which MentorStack meets the processor obligations that law places on Customer. Where the two sets of obligations differ, MentorStack applies whichever is stricter rather than treating one as displacing the other.

4. Processing Details

Categories of data subjects

Personal data processed under this DPA relates to the following categories of data subjects: Customer's employees, mentors, mentees, and administrators who use the MentorStack platform under Customer's subscription.

Categories of personal data

• Account information: Name, email address, and job title.
• Profile data: Skills, interests, goals, and other information provided by users to facilitate mentor-mentee matching.
• Usage data: Features used, session activity, timestamps, and engagement metrics.
• Communication data: In-app messages, meeting notes, and AI-generated session summaries and agendas.

Special categories of personal data

Where Customer enables diversity reporting, the platform can collect gender and ethnicity from participants. Ethnicity is a special category of personal data under GDPR Article 9, and gender may be depending on how a participant answers.

• Diversity reporting is off by default and is enabled by a Customer administrator, not by MentorStack.
• Participants supply these fields about themselves and may leave them blank. The platform does not infer them.
• They are stored separately from the rest of the profile and are used only for aggregate reporting. They are not used in mentor-mentee matching and do not affect any match a participant is offered.

Article 9 permits processing of this data only on a specific legal basis, most commonly the participant's explicit consent. As data controller, Customer is responsible for establishing that basis before enabling diversity reporting, for telling participants how the data will be used, and for honouring any withdrawal of consent.

Purpose of processing

Providing, maintaining, and improving the MentorStack platform in accordance with Customer's subscription agreement and the Terms of Service.

Programmatic and agent access

MentorStack exposes a Model Context Protocol (MCP) interface alongside the web application. It allows an external agent program, such as Claude Desktop, Cursor or any other MCP client, to read and write program data over an authenticated connection. This is a channel into the same data rather than a new category of it: profile data including the special category data described above where Customer has enabled diversity reporting, goals and milestones, matches, meetings, in-app messages, survey responses, reflections, cohorts, skills and program reports.

• Access requires a key issued inside MentorStack, either by an administrator for the organisation or by a participant for their own account. There is no access without one.
• A key is bound to one organisation and to the role of the account it was issued for, and requests are scoped accordingly. A participant key cannot reach another participant's record.
• Participant-issued keys expire after 90 days. Administrator-issued keys carry an expiry set at creation. Either can be revoked at any time, which ends access immediately. Requests are rate limited per key.
• Every tool invocation is written to the append-only audit log described in section 6, recording the tool, the acting account and its role, the data subject whose record was touched where the call names one, and whether the call succeeded. Argument names are recorded; argument values are not, so the log evidences a disclosure without duplicating its content.
• Customer chooses the agent host.The program at the far end of the connection is Customer's choice and Customer's responsibility, and it is not a MentorStack sub-processor. See section 5.

5. Sub-processors

MentorStack engages the following categories of sub-processors to assist in delivering the platform:

How the AI providers fit together. AI features in production reach OpenAI by two routes. Requests from the web application are sent to OpenRouter, which routes each to the provider serving the model configured for that feature. Background processing and all text-embedding requests are sent to OpenAI directly, without passing through OpenRouter. Requests routed through OpenRouter are constrained to providers that do not collect request content and that operate zero data-retention endpoints, so such a request fails rather than reaching a provider whose terms would permit training on it; OpenAI does not train on data submitted through its API. Anthropic remains named because MentorStack can address it directly, though no AI feature is configured to do so at present.

Agent hosts chosen by Customer are not sub-processors. Where Customer or its participants connect an external agent program to MentorStack over the Model Context Protocol interface described in section 4, that program is selected, operated and instructed by Customer. MentorStack neither chooses it nor has visibility of what it does with data after transmission. It is therefore not engaged by MentorStack and does not appear in the table above. Customer is responsible for the disclosure and, if applicable, the transfer safeguard for that recipient.

A current list of named sub-processors is available on request. MentorStack will provide at least 30 days' written notice before engaging a new sub-processor. Customer may object to the appointment of a new sub-processor by notifying MentorStack in writing within that period. If the parties cannot resolve the objection within 30 days, Customer may terminate the affected services without penalty.

6. Security Measures

MentorStack implements appropriate technical and organisational measures to protect personal data, including:

• Tenant isolation enforced in the database itself using PostgreSQL row-level security, so queries are scoped to a single customer organisation and cross-tenant access is blocked at the data layer rather than only in application code
• Encryption in transit using TLS 1.2 or higher, with TLS 1.3 preferred, HTTPS enforced on all endpoints and HSTS applied
• Encryption at rest provided by our infrastructure providers for the database and for object storage, with additional application-layer AES-256-GCM encryption applied to stored integration credentials such as calendar and HR system tokens
• Passwords stored using bcrypt hashing and never in recoverable form. Multi-factor authentication is available to every user and can be made mandatory for all members of a customer organisation
• Role-based access controls, with every server-side operation checking organisation membership and role before it runs, and schema validation applied to all input
• Rate limiting on authentication and other sensitive endpoints, and Cloudflare Turnstile bot protection on public authentication endpoints, which fails closed
• Append-only audit logging of authentication, data changes and administrative actions, with logs shipped to a separate monitoring system
• Logical database backups every 6 hours, retained for 30 days in normal operation with deletion completed by an automated lifecycle rule within 35 days at the latest, plus a separate point-in-time recovery window provided by the database host covering the most recent 6 hours
• Automated dependency vulnerability scanning, documented change management, and a documented incident response plan

MentorStack does not currently hold a SOC 2 report or ISO 27001 certification. SOC 2 control policies are documented and an independent audit is planned. Our infrastructure providers hold their own certifications, which cover their services and are not attestations covering MentorStack.

7. Breach Notification

In the event of a personal data breach, MentorStack will notify Customer without undue delay and no later than 72 hours after becoming aware of it. The clock starts when MentorStack becomes aware of the breach, not when its investigation concludes, so that Customer has time to meet its own reporting deadline. Where the full picture is not yet known, MentorStack will notify on what it has and follow up as more becomes clear rather than waiting. Notification will include, to the extent available:

• The nature of the personal data breach
• The categories and approximate numbers of data subjects and records affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate its effects

MentorStack will provide Customer with a written post-incident report covering root cause, impact and remediation within 30 days of the breach being contained.

These obligations are owed to Customer as controller. They are separate from MentorStack's own obligations under PIPEDA to report to the Office of the Privacy Commissioner of Canada, and to notify affected individuals, where a breach creates a real risk of significant harm. Both apply, and neither discharges the other.

8. Data Subject Rights

MentorStack will provide reasonable assistance to Customer in fulfilling its obligations to respond to data subject requests, including requests to exercise rights of:

• Access to personal data
• Rectification of inaccurate data
• Erasure (“right to be forgotten”)
• Data portability
• Restriction of processing
• Objection to processing

Where a data subject contacts MentorStack directly with a rights request, MentorStack will redirect that request to Customer without undue delay.

9. DPIA Cooperation

MentorStack will provide reasonable assistance to Customer in carrying out data protection impact assessments (DPIAs) as required under GDPR Article 35, and in prior consultations with supervisory authorities where a DPIA indicates a high residual risk.

10. Audit Rights

Customer may conduct, or commission a third-party auditor to conduct, one audit per calendar year upon at least 30 days' written notice. Audits must be conducted during normal business hours in a manner that does not unreasonably disrupt MentorStack's operations.

MentorStack does not currently hold a SOC 2 report, an ISO 27001 certification, or an equivalent third-party attestation, and does not offer one in place of an audit. In response to an audit request MentorStack will make available its written security policies, its record of processing activities, its sub-processor register, and a description of its technical and organisational measures. Where MentorStack later obtains a third-party attestation, the parties may agree that MentorStack offering that report satisfies this clause for the year in question.

11. International Transfers

MentorStack Inc. is a Canadian corporation with its principal place of business in Toronto, Ontario. The infrastructure that processes customer personal data is located in the United States, as set out in the sub-processor table in section 5. These are two separate transfers and they rely on different mechanisms.

Customer to MentorStack.No additional safeguard is required. The European Commission recognises Canada as providing an adequate level of protection for organisations subject to PIPEDA, a decision reviewed and maintained in January 2024, and the United Kingdom recognises Canada on the same basis under its own adequacy regulations. MentorStack is an organisation subject to PIPEDA. Customer may rely on adequacy for this transfer and is not required to execute Standard Contractual Clauses with MentorStack.

MentorStack to its sub-processors.This onward transfer leaves the adequate jurisdiction and does require a safeguard. For most of the providers named in section 5 the Standard Contractual Clauses are in force, incorporated into the data processing terms each provider applies from the moment an account is opened. Because MentorStack is Customer's processor and those providers are its sub-processors, the applicable module is Module Three (processor to processor), not Module Two. Where a provider acts as a controller in its own right for its own purposes, Stripe for payment processing being the clearest case, that provider's own transfer terms govern its processing and are referenced in its published data processing terms.

A small number of providers require their data processing agreement to be signed separately rather than applying it on signup, and the Standard Contractual Clauses sit inside that agreement. A review on 11 August 2026 examined every provider in section 5 against its published terms. One remains outstanding, covering log monitoring, and the logs concerned are stripped of personal data before they leave our systems. We describe this rather than stating a blanket position we cannot evidence for every provider. Customer may ask for the current status, and the date each agreement came into force, at privacy@mentorstack.co.

If Customer requires Standard Contractual Clauses with MentorStack directly. Adequacy makes this unnecessary, but some customers require SCCs as a matter of internal policy and MentorStack will enter into them on request. In that case Module Two (controller to processor) applies, with the docking clause at Clause 7 included, Option 2 general written authorisation at Clause 9 with a notice period of 30 days, the optional redress language at Clause 11 not included, and the law and courts of the Republic of Ireland for Clauses 17 and 18.

The information required by Annexes I and II of the SCCs is given by sections 4, 5 and 6 of this DPA. Where the UK GDPR applies, the same split holds: transfers to MentorStack in Canada are covered by the United Kingdom's own adequacy regulations, and onward transfers to US providers rely on the UK International Data Transfer Addendum issued by the Information Commissioner's Office alongside the SCCs. See our Privacy Policy for further details on international data transfers.

12. Data Deletion & Return

Upon termination or expiry of the subscription, MentorStack will, at Customer's election, delete or return all personal data processed on Customer's behalf within 30 days, including copies held by the sub-processors named in section 5, unless applicable law requires retention for a longer period.

Two exceptions, both bounded. Anonymised aggregate data from which no individual can be identified may be retained for up to three years after termination for analytics and product improvement. Copies present in backups are removed as the rolling 30-day backup window expires, so within 30 days of deletion from live systems.

On completion, MentorStack will give Customer written confirmation of what was deleted, what was retained and on what ground, and the date deletion finished. That is a confirmation issued by MentorStack, not an independent auditor's attestation, and MentorStack does not present it as one.

When an individual participant deletes their own account, the effect is different and Customer should understand it. After a 14-day cooling-off period their identifying details and free-text content are irreversibly overwritten, but the underlying programme records are kept with the personal content removed, so Customer retains a coherent history of its programme. That is erasure of the individual's personal content rather than destruction of every row.

Participants can trigger this themselves from inside the product. When one does, MentorStack notifies Customer's administrators at the start of the 14-day cooling-off period, naming the participant and the date the anonymisation will run, so that Customer has time to act if it holds a ground for refusing erasure under Article 17(3) or an equivalent provision.

Customer cannot presently place a hold on such a request inside the product. Where Customer needs one, it should contact the participant or MentorStack before the cooling-off period expires. MentorStack intends to add a hold mechanism and will update this section when it does.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. MentorStack's aggregate liability for all claims arising out of or related to data processing activities under this DPA will not exceed the liability caps set out in the Terms of Service.

14. Term & Termination

This DPA is effective for the duration of Customer's subscription and any subsequent renewal periods. The DPA will automatically terminate upon expiry or termination of the subscription agreement. Obligations relating to data already processed will survive termination for as long as MentorStack continues to hold that personal data.

15. Governing Law & Order of Precedence

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law principles, except where applicable data protection law requires otherwise. Each party submits to the exclusive jurisdiction of the courts located in Toronto, Ontario, Canada. This matches the governing law of the Terms of Service. The Standard Contractual Clauses referred to in section 11 are governed by the law named in those clauses, and disputes under them go to the courts named there.

Where this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. Where this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail for international transfers. Where Customer has signed a negotiated data processing agreement with MentorStack, that signed agreement prevails over this one in full.

16. Contact

For questions about this DPA or data processing activities, contact our privacy team at:

Email: privacy@mentorstack.co

MentorStack Inc.
Toronto, Ontario, Canada