Privacy Policy
Last updated: 15 October 2026
Mentis is an AI-powered interview practice service operated by Grey Space Technologies Ltd, a company registered in England and Wales (company number 17249153) whose registered office is at 71-75, Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (“Mentis”, “we”, “our” or “us”).
This Privacy Policy (“Policy”) describes the Personal Data we collect about people who visit our website at https://www.mentis.training/ use the Mentis application, or otherwise interact with us (together, the “Services”), why we collect it, who we share it with, and the rights and choices you have. Please read it alongside our Terms of Use, available on our website.
1Key Terms and Scope
(a) Key terms. In this Policy, “Personal Data” means any information relating to an identified or identifiable individual, such as your name, email address, CV or the content of your interview answers. “Input” means the content you provide when using the Services, including your CV, job descriptions, practice settings, your spoken interview answers and their transcripts, and any other text and files you upload. “Output” means the content the Services generate for you, including interview questions, feedback, scores, performance observations and recommendations. “UK GDPR” means the UK General Data Protection Regulation, read together with the Data Protection Act 2018. Capitalised terms not defined here have the meaning given in our Terms of Use.
(b) Our role. For the processing described in this Policy, Mentis is the controller of your Personal Data: we decide why and how it is processed and are responsible for it under UK data protection law. Our contact details are in Section 13.
(c) What this Policy does not cover. Where we provide the Services to an organisation (for example, a law firm, employer or university) and process Personal Data on its instructions, we act as that organisation’s processor. That processing is governed by our agreement with the organisation and by its own privacy notice, not by this Policy.
2The Personal Data We Collect
(a) Information you give us
- Account & Contact Details.
- When you register, we ask for your name, email address and account credentials, and we record your account settings and contact preferences.
- Profile Information & User Content.
- To tailor your practice, you may tell us about your career stage, practice area, the role or firm you are preparing for and your practice goals, and you may add notes or other content to your account.
- Services Input & Output.
- We process your Input, including your CV and employment history, job descriptions, interview-preparation materials and the answers you give in practice interviews, and the Output generated from it. Your spoken answers are transcribed into text so that the interview can continue and feedback can be produced; the transcript, feedback, scores and recommendations are stored in your account so that you can review them and so that future sessions can build on them. We do not retain audio or video recordings of your answers once they have been transcribed. Input and Output may contain Personal Data about you and, if you include it, about other people; please see Section 3(e) before including information about clients or other third parties.
- Payment Details.
- If you buy a paid plan, our third-party payment processor collects your payment information, such as your name, email address, billing address and card details, directly from you. We do not receive or store your full card number; we receive confirmation of your purchases, transactions and billing status so that we can administer your plan.
- Age Confirmation.
- We ask you to confirm that you are at least 18 years old before you can use the Services, and we keep a record of that confirmation.
- Feedback & Communications.
- If you contact us, request support, report a problem, respond to a survey, take part in a user interview or otherwise give us feedback, we collect your name, email address, the content of your message and any attachments, together with any other information you choose to share. If you subscribe to our newsletter or other updates, we collect your name, email address and marketing preferences and keep a record of any consent you give. When we send you emails, we may record whether they are opened and which links are clicked so that we can understand what is useful to you and improve our communications.
- Other Information You Provide.
- We may also collect Personal Data you provide when you try early-access or beta features, take part in research, testing or referral programmes, attend an event we host, or interact with us on social media or elsewhere online or offline. Some of these activities may have their own terms.
(b) Information we may collect from you or your device
When you use the Services, we and our service providers may collect some information automatically, including through cookies and similar technologies (“Cookies”, described in Section 7):
- Device Information.
- Information about the device and software you use, such as IP address, browser type, operating system and device identifiers.
- Usage Information.
- How you move through the website and the Services, the pages and features you use, the length and settings of your practice sessions, and the dates and times of your activity.
- Approximate Location.
- A general location, such as your country or city, inferred from your IP address.
- Security Records.
- Login history, technical logs and information about suspected unauthorised or abusive activity, which we use to keep accounts and the Services secure.
(c) Information we receive from others
- Third-Party Sign-In.
- If you choose to register or sign in through a third-party account (for example, Google), that provider sends us Personal Data such as your name, username, email address and profile picture, according to its own privacy settings.
- Service Providers.
- We may receive Personal Data from providers who support the Services, for example confirmation of payment from our payment processor or delivery and engagement information from our email provider.
Some Personal Data is essential to the Services: we cannot create your account without an email address, and we cannot run a practice interview or give feedback without processing your answers. If you do not provide this information, some or all of the Services may be unavailable to you. Where information is optional, we will say so.
3How We Use Personal Data and Our Lawful Bases
(a) Purposes and lawful bases
UK data protection law requires us to have a lawful basis for each way we use your Personal Data. The table below sets out the purposes for which we may process your Personal Data when acting as a controller and the lawful basis we rely on for each. Where we rely on our legitimate interests, you have the right to object to that processing by contacting us as described in Section 8.
| Purpose | What we do | Lawful basis |
|---|---|---|
| Providing the Services | We process your Personal Data to create and administer your account, to make the Services available to you and to provide the features you request, as described in our Terms of Use. | Necessary to enter into, or perform, our contract with you. |
| Running practice interviews and producing feedback | We may process your Input to generate relevant interview questions and follow-ups, conduct a live, conversational practice interview, transcribe your answers and produce Output, including feedback, scores and recommendations against stated assessment criteria. We may also use your previous sessions to personalise later ones and to show your progress over time. Section 3(b) explains how this works. | Necessary to enter into, or perform, our contract with you. |
| Payments and accounting | We and our payment processor may process your Personal Data to take payment, manage your subscription and keep records of transactions. | Necessary to enter into, or perform, our contract with you. Keeping financial records is also necessary to comply with our legal obligations, such as tax and accounting rules. |
| Storing your data | We may store your Personal Data, including your Input and Output, using third-party cloud hosting and storage providers. | Our legitimate interest in storing data reliably and securely in order to provide the Services. Storage may also be necessary to perform our contract with you. |
| Communicating with you | We may use your Personal Data to respond to your questions and comments, provide customer and technical support, and send you updates and other information about the Services, such as changes to the Services, our Terms of Use or this Policy. | Our legitimate interest in keeping you informed about the Services you use and supporting you in using them. Some communications are also necessary to perform our contract with you. |
| Marketing | We may send you information about Mentis’s own interview-preparation and related legal-career products, features, content and offers. You can opt out at any time (see Section 8). | Existing customers: Our legitimate interest in telling you about our own similar products and services. Prospective users and newsletter subscribers: your consent. |
| Maintaining and improving the Services | We may process your Personal Data to keep the Services reliable and to improve them, including diagnosing and fixing technical problems, checking that features work as intended and improving the user experience. | Our legitimate interest in providing a reliable, secure and effective service. |
| Checking the quality and fairness of feedback | To check that the feedback the Services produce is accurate, consistent and fair, authorised members of our team, under strict confidentiality obligations, may review samples of transcripts and the related Output, including by comparing them with assessments made by human reviewers. | Our legitimate interest in ensuring that our feedback is reliable and does not disadvantage particular groups of users. |
| Understanding usage | We may process your Personal Data to understand how the Services are used, to identify trends and preferences, and to develop new products, features and functionality. Where we use Cookies or similar technologies for analytics, Section 7 explains your choices. | Our legitimate interest in understanding how the Services are used and developing them. Where required, your consent to the placement of non-essential Cookies. |
| Aggregated and de-identified data | We may use your Personal Data to create aggregated or de-identified data, for example statistics about how answers to particular types of question are assessed, which we may use for any lawful purpose, including improving our assessment criteria and the Services. We will not attempt to re-identify this data unless the law requires it. | Our legitimate interest in improving the Services using data that does not identify you. |
| Security, safety and preventing misuse | We may process your Personal Data to protect the Services, our users and our business, including to detect and prevent unauthorised access, fraud, abuse and other malicious, deceptive or unlawful activity; to investigate security incidents; and, where necessary, to review Input or Output that we have reason to believe breaches our Terms of Use. | Our legitimate interest in keeping the Services, our users and our business safe and secure. Such processing may also be necessary to perform our contract with you or to comply with a legal obligation. |
| Administrative and legal matters | We may use your Personal Data to handle queries, complaints, disputes and claims; to enforce our Terms of Use; to protect our rights, property and intellectual property; to establish, exercise or defend legal claims; and to respond to lawful requests from courts, regulators, law enforcement and other public authorities. | Our legitimate interest in managing our business and protecting our legal position and the rights of our users. The processing may also be necessary to establish, exercise or defend legal claims. |
| Legal compliance | We may process your Personal Data where we need to in order to comply with the law, for example accounting, tax or anti-money-laundering rules, or a court order or other binding legal process. | Necessary to comply with a legal obligation to which we are subject. |
| Other purposes | If we want to use your Personal Data for a purpose not described in this Policy, we will tell you at the time we collect it and, where required, ask for your consent. | As described in the specific notice we give you at the time. |
Where we rely on our legitimate interests, we have assessed that those interests are not outweighed by your rights and interests, taking into account your reasonable expectations and the likely impact on you, and we use no more Personal Data than is needed for the purpose. Where a lawful basis listed above is not available in your jurisdiction, we will rely on your consent or another available basis. You can ask us for more information about our legitimate-interest assessments using the details in Section 13.
(b) How our AI interviews work
Mentis uses artificial intelligence to run practice interviews. During a session, your spoken answers are converted into text by speech-recognition technology. The transcript, together with the context you have given us (such as your CV and the job description), is processed by large language models to produce the interviewer’s questions and follow-ups and, after the session, your feedback, scores and recommendations against stated assessment criteria. The interviewer’s voice is produced by text-to-speech technology. Some of this processing is carried out by third-party AI and voice service providers acting on our instructions; the categories of provider we use are described in Section 4.
(c) AI feedback
The feedback, scores and recommendations you receive are generated automatically to help you practise and improve. AI-generated content can be incomplete or inaccurate, and our scores are diagnostic indicators against stated criteria rather than an objective hiring standard. You should review Output critically and use your own judgement before relying on it. Nothing in the Services constitutes legal, careers or professional advice. We do not use Output to make any decision that produces legal effects concerning you or similarly significantly affects you, and we do not share your Input, Output or scores with employers, recruiters or law firms.
(d) AI model training
We do not use your CVs, interview answers, transcripts or feedback to train our own or third-party AI models. Our AI providers process your Personal Data only to provide the Services to us and are prohibited from using it to train their models.
(e) Sensitive and confidential information
Please do not include the following in your CV, uploads or interview answers unless it is genuinely necessary for your practice:
- Special Category Data
- : information about your health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, political opinions or trade union membership, or information about criminal convictions or offences; and
- confidential client information
- , including anything subject to legal professional privilege. When describing matters you have worked on, please anonymise clients, counterparties and other individuals.
If you include Special Category Data anyway, we will process it only as part of providing the Services to you, we will not use it to draw inferences about you, and you can delete it at any time by removing the relevant content or contacting us.
5Transfers Outside the UK
Some of the service providers described in Section 4 are located, or process data, outside the United Kingdom, and your Personal Data may be transferred to and stored in those countries. We may transfer Personal Data to the following categories of recipient:
| Recipient category | Countries | Purpose of transfer | Data types transferred |
|---|---|---|---|
| Cloud hosting and storage providers | United States | Hosting the Services and storing data | Account details, Input and Output, session history, billing status, usage records |
| AI and speech-recognition providers | United States | Transcribing spoken answers, generating interview questions and producing feedback | Audio of your spoken answers, transcripts, CV and job-description context, generated questions and feedback |
| Text-to-speech providers | United States | Producing the interviewer’s voice | The interviewer’s own scripted lines only. No CV, answer, transcript or account data is sent. |
| Payment processors | United States | Payment processing | Name, email address, billing address, card details |
| Identity and sign-in providers | United States | Authenticating you where you choose to sign in with a third-party account | Name, email address, profile picture |
| Error-monitoring and security tools | United States | Detecting, diagnosing and fixing faults, and protecting the Services | IP address, device and browser information, account identifiers, technical logs and error reports, which may include your email address |
| Email, analytics and support tools | United States; Ireland | Communications, analytics and customer support | Contact details, marketing preferences, device and usage information |
Whenever we transfer Personal Data outside the UK, we make sure it is protected to a standard equivalent to the UK GDPR by using one or more of the following:
- transferring to countries, or to organisations certified under schemes, that the UK Government has recognised as providing adequate protection, including the UK Extension to the EU-US Data Privacy Framework; and
- entering into contracts that incorporate the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Agreement, as approved by the Information Commissioner.
You can request further information about these transfers, or a copy of the relevant safeguards, by contacting us as described in Section 13. Please be aware that data held in another country may be accessible to that country’s courts, law enforcement and national security authorities.
6How Long We Keep Personal Data
We keep Personal Data for no longer than is necessary for the purposes described in this Policy, unless the law requires or permits a longer period. After that, we delete it or convert it into a form that no longer identifies you. In setting retention periods, we take into account the type of data and the Services involved, how long you have used the Services, statutory retention requirements and the limitation periods for legal claims. Our standard periods are:
| Personal Data | Retention period |
|---|---|
| Account and contact details | While your account is open, and for 12 months after it is closed. |
| CVs and other uploaded materials | Replaced when you upload a new one, and deleted on request or when you close your account. |
| Audio of your interview answers | Not retained once transcribed. |
| Transcripts, feedback, scores and session history | Until you delete them or close your account. |
| Payment and transaction records | 6 years from the end of the financial year in which the transaction took place, in line with UK tax and accounting requirements. |
| Marketing preferences and consent records | Until you unsubscribe, after which we keep a record of your opt-out so that we can respect it. |
| Correspondence, queries and complaints | 2 years after the matter is closed, or longer where needed for a legal claim. |
| Security and technical logs | 90 days, or longer where deemed necessary for security purposes. |
8Your Rights and Choices
(a) Your rights
Under UK data protection law, and depending on the circumstances, you have the right to:
- Access.
- Confirm whether we process your Personal Data and obtain a copy of it, with information about where it came from and who we share it with. You can also view your interview history, transcripts and feedback in your account at any time. Certain exemptions may mean that we cannot provide everything you ask for.
- Rectification.
- Have inaccurate Personal Data corrected and incomplete data completed. You can update most account details in your account settings.
- Erasure.
- Have your Personal Data deleted, including your account, CVs, transcripts and feedback. You can delete individual sessions and uploads, or your whole account, by requesting it in your account settings.
- Restriction.
- Ask us to limit how we use your Personal Data, for example while we check its accuracy.
- Objection.
- Object to processing based on our legitimate interests. You can object to direct marketing at any time, and we will stop.
- Portability.
- Where we process your Personal Data under our contract with you or with your consent, receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation.
- Withdrawal of Consent.
- Withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before you withdrew it.
- Automated Decisions.
- Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. As explained in Section 3(c), we do not make such decisions.
- Marketing Opt-Out.
- Unsubscribe from marketing emails using the link in any email we send or by contacting us. You will still receive essential messages about your account and the Services.
(b) How the lawful basis affects your rights
| Lawful basis | Rights that may apply |
|---|---|
| Contract | All rights above except the right to object. |
| Legitimate interests | All rights above except data portability. |
| Consent | All rights above except the right to object; you may withdraw your consent at any time. |
| Legal obligation | All rights above except erasure, objection and data portability. |
(c) How to exercise your rights
Email us at info@mentis.training, stating which right you want to exercise (for example, “Access Request”). We may ask for information to verify your identity before acting. We will respond without undue delay and within one month; for complex or multiple requests we may extend this by up to two further months, and we will tell you if so. We do not normally charge a fee. The law allows some exceptions to these rights, and we will explain if any apply. The ICO’s website has more information about your rights.
(d) Complaints
If you are unhappy with how we handle your Personal Data, please contact us first so that we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (“ICO”), the UK’s data protection regulator, whose details are in Section 13.
9Links to Other Services
The Services may link to websites, products or services that we do not control. This Policy does not apply to them, and we are not responsible for how they handle your information. Please check their privacy policies before sharing information with them.
10How We Protect Personal Data
We use appropriate technical and organisational measures to protect your Personal Data from unauthorised access, loss, misuse and alteration. These include encrypting data in transit and at rest, restricting access to Personal Data to those who need it, and choosing service providers who meet recognised security standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to put you at high risk, we will notify you and the ICO as the law requires.
11Age Requirements
The Services are intended for adults. You must be at least 18 years old to create an account, and we do not knowingly collect Personal Data from anyone younger. If we learn that we hold Personal Data about someone under 18, we will delete it. If you believe this has happened, please contact us.
12Changes to This Policy
We may revise this Policy from time to time and will update the “Last updated” date when we do. If a change is significant, we will give you notice by email or through the Services before it takes effect.
13How to Contact Us
For questions about this Policy, to exercise your rights or to make a complaint, email us at info@mentis.training or write to:
- Grey Space Technologies Ltd
- 71-75, Shelton Street,
- Covent Garden, London,
- United Kingdom,
- WC2H 9JQ
If you remain dissatisfied after contacting us, you can complain to the ICO:
- Information Commissioner’s Office
- 4th Floor, No.3 Circle Square
- 5 Hawkshaw Street
- Manchester
- M1 7BL
Helpline: 0303 123 1113. Website: ico.org.uk/make-a-complaint