Last updated: 5 August 2026
Privacy Policy
This Privacy Policy explains how Shreyash Sakhare (operating the unregistered business "Metis Labs" - the parent - and its brand "Mentr", hereinafter "Mentr", "we", "us") collects, uses, and protects your personal data when you use our website at metislabs.in and the Mentr application (together, the "Service").
Mentr is an exam-preparation platform that prepares students for the National Defence Academy (NDA) examination - currently NDA Mathematics - by projecting a student's likely exam score, running a daily adaptive practice loop, generating AI "coach's notes", and providing mock tests. It is also used by coaching institutes to manage their students' practice.
Where this policy refers to "you", we mean a registered user of the Service - a Student, an Institute (the coaching center and its administrators), or a visitor to our website.
1. Who is responsible for your data
The Data Fiduciary (the person legally responsible for your data under the Digital Personal Data Protection Act, 2023, "DPDP") is:
Shreyash Sakhare, proprietor, operating the unregistered business "Metis Labs" and its brand "Mentr".
Address: D6, Hermes Complex, Sangamwadi, Pune, 411001
Email: metr@metislabs.in
Mentr is currently operated as a sole proprietorship (neither "Metis Labs" nor "Mentr" is a registered company yet). If Mentr is in the future operated by a company or other entity (for example, "Metis Labs Private Limited", an OPC, or an LLP) incorporated by the proprietor, that entity will automatically step into our place as the Data Fiduciary under this policy, with no change to how your data is handled and without requiring you to give consent again. We will update the name and address above when that happens. (See §13.)
2. Data we collect
A. Data you give us directly
- Account data: your full name, email address, and a password.
- If you are a Student: the institute code linking you to your coaching institute (if any).
- If you are an Institute: your institute name, and the institute code issued to you.
- Parental consent data (Students under 18): the parent's or legal guardian's name and, where provided, their email address.
B. Data created when you use the Service
- Your practice answers, attempted questions, mistakes, topic-wise performance, projected marks, mock-test attempts and results, and the AI-generated coach's notes produced from your activity.
- For Institutes: information about the batches and Students you manage, and aggregate/anonymised insights derived from those Students' activity.
C. Technical and usage data collected automatically
- Device and browser details, IP address (used for security and rate-limiting), pages viewed, features used, and similar product-analytics data.
- This is collected through our hosting, analytics, and error-tracking tools (listed in §7).
D. Payment data (when payments are live)
- We do not store your card number, CVV, or full net-banking credentials. Payment details you enter at checkout are received and processed by our payment processor Razorpay. We only receive a transaction status and a limited reference from Razorpay.
3. Why we use your data, and the legal basis
We process your personal data only for the purposes stated here, and only as permitted by DPDP as a "legitimate use" - namely (a) for a specified purpose you have consented to, (b) data you voluntarily provided to us, and (c) certain functions necessary to provide the Service you requested.
| Purpose | Which data | Why |
|---|---|---|
| Create and run your account | Account data | To register you and let you sign in. |
| Provide the core learning Service | Practice answers, performance, projections, coach's notes, mocks | This is the Service. Projections, the mistake engine, and the daily plan cannot work without it. |
| Show institutes their students' progress | Student performance data | Where a Student is linked to an Institute, that Institute can see the Student's projected marks, trajectory, coach's notes, topic heat map, and mock performance. See §6. |
| Keep the Service safe and prevent abuse | IP address, device/usage data, activity logs | Fraud, cheating, rate-limiting, security. |
| Improve and fix the Service | Technical/usage data, error data | Product analytics and stability. |
| Communicate with you | Account issues, important notices, support. | |
| Process payments (when live) | Limited payment reference | To enable paid features. |
4. How the AI features work
Some features - including the projected-marks model, the mistake engine, and the coach's notes - are produced by artificial-intelligence / large-language-model services we use (see §7).
- These features are generated by analysing your own practice data (your answers, mistakes, and pace).
- Where your data is sent to an AI provider to generate a coach's note or similar output, we send only what is necessary to produce that output; we do not sell your data to AI providers, and we do not allow our AI providers to use your data to train their general models beyond what is required to serve our request, to the extent their terms permit.
- AI outputs are estimates and guidance, not guarantees or professional advice. A projection is a statistical estimate of likely exam performance and can be wrong. A coach's note is generated guidance, not advice from a qualified human counsellor. See our Terms for the full disclaimer.
5. Children and parental consent
Many NDA aspirants are under 18. Under DPDP, a person under 18 is a "child", and processing a child's personal data requires verifiable consent from a parent or lawful guardian.
- A Student who is under 18 may not register without the consent of a parent or guardian. Our registration requires a parent/guardian to provide their name and confirm they have read this Privacy Policy and agree to their child's use of Mentr.
- We do not undertake behavioural monitoring or targeted advertising directed at children, and we do not process children's personal data for the purpose of targeted advertising. DPDP prohibits this.
- For accounts known to belong to a child, we run product analytics in the most limited form available to us and do not bind analytics to a persistent personal identity where we can avoid it (see §11).
- If you believe a child has registered without parental consent, please contact us at metr@metislabs.in and we will delete the account and associated data.
6. How your data is shared
A. With your Institute (for Students).
If you registered using an Institute code, the Institute that issued that code can access your name, projected marks, trajectory, AI coach's notes, topic heat map, and mock performance, in order to coach you. The Institute is responsible for how it uses data it can see through Mentr; you consent to this sharing by joining that Institute.
B. With our service providers (processors).
We use trusted third parties to operate the Service. They process data only on our instructions and for the purposes below:
| Provider | Purpose | Data they may process |
|---|---|---|
| Supabase | Authentication and database hosting | Account data, learning data |
| OpenRouter / DeepSeek | AI features (coach's notes, projections) | Learning data needed to generate the output |
| Vercel | Website/application hosting | Technical/usage data |
| Upstash / QStash | Caching, rate-limiting, background jobs | Operational data |
| PostHog | Product analytics | Usage data (limited for children - §5) |
| Vercel Analytics | Traffic analytics | Aggregate traffic data |
| Sentry | Error tracking | Technical error data |
| Razorpay | Payments (when live) | Payment data at checkout |
C. For legal reasons.
We may disclose data where required by law, court order, or a lawful request from a government or regulatory authority, or to protect the rights, property, safety, or security of Mentr, our users, or others.
D. We do not sell your data.
We never sell your personal data to anyone, and we do not exchange it for any consideration.
7. International transfers
Some of the providers above (for example Supabase, Vercel, OpenRouter/DeepSeek, PostHog, Sentry) may store or process data outside India. Where your data leaves India, we rely on DPDP's permitted transfer mechanism and choose providers we reasonably believe protect it. Your data is only transferred to the extent needed to provide the Service described here.
8. How long we keep your data
- We keep your personal data for as long as your account is active, and afterwards only for as long as needed to meet legal obligations, resolve disputes, and protect our rights - or until you ask us to delete it (see §12).
- You can request deletion at any time; we will erase your personal data within a reasonable time, except where we are required to retain it by law or for legitimate legal/defence purposes.
9. Security
We use reasonable technical and organisational measures to protect your data - encrypted authentication, access controls, and secure infrastructure through our providers. No method of transmission or storage is fully secure, but we work to protect your data and to notify affected users and authorities as required by law if a breach occurs.
10. Links and third-party services
The Service may contain links to third-party websites or services (for example your Institute's own systems, or a payment page hosted by Razorpay). We are not responsible for the privacy practices of those third parties; please review their policies.
11. Cookies and analytics
We use cookies and similar technologies for security, to remember your sign-in, and to understand how the Service is used (product and traffic analytics). We do not use cookies for cross-context behavioural advertising. You can control cookies through your browser settings; some features may not work if you disable them. See also our cookie notice on the Service and §5 on the limited analytics posture for children.
12. Your rights
Under DPDP and applicable law, you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct or update inaccurate or incomplete data.
- Erase your personal data (the "right to be forgotten"), subject to limited legal exceptions.
- Nominate another individual to exercise your rights in the event of your death or incapacity.
- Withdraw consent at any time - withdrawal does not affect processing that already happened, and may mean we can no longer provide the Service.
- Grievance redressal - see §13.
To exercise any right, email metr@metislabs.in. We will respond within the time required by law (typically within 30 days, or the period DPDP prescribes).
13. Grievance Officer
If you have a complaint about how we handle your personal data, contact our Grievance Officer:
Shreyash Sakhare - Grievance Officer, Mentr (a brand of Metis Labs)
Email: metr@metislabs.in
Phone: +91 9404626275
Address: D6, Hermes Complex, Sangamwadi, Pune, 411001
We will acknowledge your complaint within the timeframes required under the Information Technology Rules, 2011 and DPDP, and aim to resolve it within 30 days.
14. Changes to this policy
We may update this Privacy Policy. When we do, we will change the "Last updated" date above and, for material changes, give you notice in the Service or by email. Continued use after a change means you accept the updated policy.
15. Contact
Questions? Email metr@metislabs.in or write to the address in §1.