Privacy Policy

1. Who operates Mentoskop

Mentoskop is operated by Olga Lipinskaya, who is the data controller for the personal data described in this Privacy Policy.

For privacy-related questions or requests, contact:

mentoskop.admin@gmail.com

2. Account and authentication information

Mentoskop uses Google and Firebase Authentication to sign users in.

Mentoskop stores:

• your Firebase user identifier (UID);
• your email address; and
• the date your Mentoskop user record was first created.

This information is used to authenticate you, provide and maintain your Mentoskop account, operate the service, and protect the service against misuse.

Firebase Authentication also processes certain technical information, including IP addresses and user-agent information, for authentication, security, account management, and abuse prevention.

Mentoskop does not sell your account information or use it for advertising.

3. Access to Google Sheets

Mentoskop requests the Google Drive drive.file permission. This allows Mentoskop to access Google Drive files that you explicitly select for use with Mentoskop. It does not give Mentoskop general access to all files in your Google Drive.

When you select a Google Sheets spreadsheet, Mentoskop may read information necessary to analyze and visualize its structure, including spreadsheet and sheet metadata, cell values, formulas, named ranges, data-source information, and Mentoskop data previously stored in that spreadsheet.

Spreadsheet processing

Spreadsheet content is retrieved directly from Google and processed in your browser.

Mentoskop's backend does not receive or store the contents of your spreadsheets, including cell values, formulas, spreadsheet names, or Mentograms.

Changes to your spreadsheet

Some Mentoskop features modify the Google Sheet you have selected.

Depending on the actions you perform, Mentoskop may:

• create or update a worksheet named mentogram;
• create or modify named ranges;
• write Mentogram structure and dependency information; and
• modify formulas when you explicitly use features that perform such changes.

These operations are performed directly between your browser and Google using Google's APIs.

4. Google API data

Information received from Google Workspace APIs is used only to provide Mentoskop's user-facing functionality.

Mentoskop does not sell Google user data, use it for advertising, or use spreadsheet content to train general-purpose artificial intelligence or machine-learning models.

Mentoskop's use of information received from Google Workspace APIs adheres to the Google User Data Policy, including its Limited Use requirements.

5. Usage information

Mentoskop does not collect usage analytics.

We do not track what you do, which spreadsheets you work with, when you use Mentoskop, or how often you use it.

Mentoskop does not use usage information for advertising or behavioral profiling.

6. Browser storage

Mentoskop and Firebase Authentication may use browser storage, such as local storage, session storage, or IndexedDB, where necessary to authenticate you, maintain your sign-in session, and provide the service you request.

Mentoskop does not use browser storage for advertising or behavioral tracking.

Mentoskop does not use analytics cookies or similar technologies for usage analytics.

7. Service providers and where information is processed

Mentoskop uses third-party services to operate the service, including Google services such as Firebase Authentication, Google Workspace APIs, Google Cloud, and Google BigQuery.

These providers may process personal data on Mentoskop's behalf where necessary to provide their services.

Firebase Authentication processes authentication data in the United States. This may include your email address, IP address, user-agent information, and other information necessary to authenticate and manage your account.

Other Google services may process data in countries where Google or its subprocessors maintain facilities.

Mentoskop does not provide the contents of your Google Sheets spreadsheets to its own backend for storage or analysis.

8. International data transfers

Some personal data processed in connection with Mentoskop may be transferred outside the European Economic Area, the United Kingdom, or Switzerland, including to the United States.

Where applicable data-protection law requires safeguards for an international transfer, Mentoskop relies on appropriate transfer mechanisms provided by its service providers, which may include applicable adequacy decisions or frameworks, standard contractual clauses, or other legally recognized safeguards.

Google states that it participates in the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework for applicable transfers.

9. Legal bases for processing

Where the EU GDPR or UK GDPR applies, Mentoskop processes personal data only where there is a legal basis for doing so.

Mentoskop processes your Firebase UID, email address, and related account information where this processing is necessary to provide authentication, account access, and the Mentoskop service you request.

Mentoskop may process limited account and technical information where necessary for its legitimate interests in operating, securing, maintaining, and preventing misuse of the service, provided those interests are not overridden by your rights and interests.

Access to a Google Sheets file occurs only after you connect your Google account and select a file for use with Mentoskop.

Mentoskop does not rely on consent as a legal basis merely because you use Google Sign-In or select a Google Sheets file. Where consent is specifically required by applicable law for a particular processing activity, it will be requested separately.

10. Data retention and account deletion

Mentoskop retains your Firebase UID, email address, and account creation date while your Mentoskop account remains active.

If you request deletion of your Mentoskop account, Mentoskop will, within 30 days:

• delete your Mentoskop user record, including your Firebase UID, email address, and account creation date, from systems under Mentoskop's control; and
• initiate deletion of your Firebase Authentication user account.

Certain information may be retained for longer where required by law or reasonably necessary for the establishment, exercise, or defense of legal claims, security, or prevention of abuse.

Firebase Authentication may retain certain information according to Google's own retention processes. Google states that Firebase Authentication keeps logged IP addresses for a few weeks. After deletion of a Firebase Authentication user is initiated, Google states that associated authentication information is removed from its live and backup systems within 180 days.

Google Sheets content processed in your browser is not retained by the Mentoskop backend.

Information that Mentoskop writes into your Google Sheet remains in that spreadsheet until you modify or delete it through Mentoskop or Google Sheets.

Deleting your Mentoskop account does not automatically delete information previously written into your Google Sheets.

11. Your privacy rights

Depending on where you live and the law that applies to you, you may have rights concerning your personal data.

These may include the right to:

• request access to personal data held about you;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of certain processing;
• object to certain processing;
• receive certain personal data in a portable format where applicable; and
• withdraw consent where processing is based on consent, without affecting processing that occurred before withdrawal.

Not all rights apply in every circumstance.

To exercise a privacy right relating to information controlled by Mentoskop, please use the contact details in Section 18 below.

You may also manage or revoke Mentoskop's access to your Google Account through your Google Account settings.

European Economic Area

If the EU GDPR applies to you, you have the right to lodge a complaint with a competent data-protection supervisory authority.

Because Mentoskop is operated from Denmark, the Danish Data Protection Agency (Datatilsynet) is the supervisory authority for Mentoskop's establishment in Denmark.

Depending on the circumstances, you may also have the right to lodge a complaint with the supervisory authority in the EEA country where you live or work, or where an alleged infringement occurred.

United Kingdom

If the UK GDPR applies to you, you may have the rights provided by the UK GDPR and the Data Protection Act 2018.

You also have the right to lodge a complaint with the United Kingdom's data-protection regulator, the Information Commissioner's Office (ICO).

Switzerland

If the Swiss Federal Act on Data Protection (FADP) applies to you, you have the rights provided by Swiss data-protection law, including the right to request information about personal data processed about you and, where applicable, to request correction or deletion.

The competent federal data-protection authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

12. United Kingdom representative

Mentoskop is operated from Denmark and offers its service to users in the United Kingdom.

Where required under the UK GDPR, Mentoskop maintains a representative in the United Kingdom whose contact details are made available to users in accordance with applicable law.

Until separate UK representative contact details are provided here, privacy questions and requests concerning Mentoskop may be sent directly to:

mentoskop.admin@gmail.com

13. Security

Mentoskop is designed to minimize the amount of spreadsheet data handled by its own infrastructure.

Spreadsheet analysis is performed in your browser.

Google OAuth access tokens used for spreadsheet operations are not sent to or stored by the Mentoskop backend.

Mentoskop uses reasonable technical and organizational measures appropriate to the nature and scope of the personal data it processes.

However, no online service can guarantee absolute security.

14. Automated decision-making and AI

Mentoskop does not use personal data to make automated decisions about users that produce legal or similarly significant effects.

Mentoskop does not use spreadsheet content to train general-purpose artificial intelligence or machine-learning models.

15. Children

Mentoskop is not directed to children and is not intended for use by anyone below the minimum age at which they may lawfully use the service or consent to relevant processing under applicable law.

If Mentoskop becomes aware that personal data has been collected from a child in circumstances where the processing is not permitted by applicable law, appropriate steps will be taken to delete the information.

16. Experimental status

Mentoskop is experimental software under active development and is not intended for production-critical use.

Features and data practices may change as the service develops.

You should not use Mentoskop with spreadsheets containing sensitive or confidential information unless you are comfortable using them with an experimental service.

17. Changes to this Privacy Policy

This Privacy Policy may be updated when Mentoskop's functionality, data practices, service providers, or legal obligations change.

The "Last updated" date at the top of this Privacy Policy indicates when it was most recently revised.

If a change materially affects how personal data is processed, Mentoskop will take reasonable steps to provide appropriate notice where required by applicable law.

18. Contact

For questions, requests, or concerns relating to this Privacy Policy or the processing of personal data, contact:

Olga Lipinskaya
Denmark
mentoskop.admin@gmail.com