Privacy Policy

1. Data Controller and Governance

Meridian Mentors is operated by the GoForth Foundation (“we”, “us”, or “our”), a 501(c)(3) non-profit organization dedicated to expanding educational and career mentorship opportunities. For participants located in the United States, European Economic Area (EEA), and other international regions, GoForth Foundation acts as the data controller responsible for personal information collected and processed through the Meridian Mentors platform.

While non-profit organizations are exempt from certain commercial privacy regulations such as the California Consumer Privacy Act (CCPA), Meridian Mentors voluntarily honors and extends core data protection rights—including access, deletion, and portability—to all participants globally.

2. Adults-Only Participation (18+) & Underage Discovery

Meridian Mentors is designed exclusively for adult students and professional mentors. Participation is restricted to individuals who are at least 18 years of age. We do not knowingly collect or solicit personal information from individuals under the age of 18, and Children’s Online Privacy Protection Act (COPPA) requirements do not apply.

If program staff or automated checks discover that an account has been created by or on behalf of a minor, that account is immediately locked, all active sessions and tokens revoked, and all personal identifiers permanently purged from active databases.

3. Information We Collect

• Account & Identity Data: Verified email address, full name, preferred name, profile biography, professional links (such as LinkedIn), and uploaded profile photographs.
• Mentorship Engagement & Correspondence: Educational and career questions submitted by students, clarifying exchanges, mentor responses, and accompanying files shared within approved program boundaries.
• Scheduling & Video Sessions: Session availability windows, calendar appointments, meeting links, and participation confirmations.
• Security & Technical Logs: IP address, user agent, session authentication timestamps, multi-factor verification events, and immutable audit logs.

4. Educational Records and FERPA Alignment

Where Meridian Mentors partners with participating educational institutions (such as BYU-Pathway Worldwide), student information is handled in accordance with institutional data agreements under the Family Educational Rights and Privacy Act (FERPA, 34 CFR § 99.31(a)(1) “School Official” exception). Student records remain under the authority of the home institution, are processed solely for educational mentoring, and are subject to strict restrictions against unauthorized re-disclosure under 34 CFR § 99.33.

5. Lawful Basis for Processing

We process your personal information under the following legal bases:

• Performance of Contract: Facilitating mentorship matches, delivering question correspondence, and coordinating scheduled sessions.
• Legitimate Interests: Protecting the safety, security, and integrity of our participants, preventing harassment, and operating support services.
• Consent: Where requested for specific voluntary profile enrichments, time zone coordination, or optional research feedback loops.

6. Data Hosting Geography and International Transfers

During our current beta and pilot operating phase, platform data is securely hosted in dedicated cloud infrastructure located in the United States (AWS/Supabase US-East). In accordance with our cross-border mentoring architecture (PRD-107 / Decision 0038), international pairings (including between U.S. mentors and EU students) operate under institutional data transfer agreements, Standard Contractual Clauses (SCCs), and GDPR Article 49(1)(b) contractual necessity for cross-border mentorship requested by the participant. GoForth Foundation does not claim certification under the EU-U.S. Data Privacy Framework (DPF).

7. Data Subject Rights (GDPR & CCPA)

Regardless of your geographic location, we respect your comprehensive privacy rights:

• Right of Access (Art. 15): Request a copy of all personal data held about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete biographical and contact information.
• Right to Erasure / Deletion (Art. 17): Request permanent deletion and referential anonymization of your account and personal identifiers.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (JSON). Confidential staff review notes and safety case files are excluded under Art. 20(4) to protect counterpart safety.
• Right to Restrict or Object (Arts. 18 & 21): Request limits on how your profile or correspondence is matched or surfaced.

To exercise any of these rights, visit our Support & Help Center or email our privacy team directly at [email protected]. We fulfill verified requests within 30 calendar days at no charge.

8. Referential Anonymization and Safety Audit Integrity

Personal data is retained while your account remains active. Upon an approved erasure request, we execute referential anonymization: your direct identifiers (name, email, avatar, biographical text) are permanently overwritten, credentials and sessions are revoked, and drafts are permanently deleted. Under GDPR Art. 17(3)(b/e), immutable safety audit records, moderation logs, and anonymized question threads are retained solely to preserve referential database integrity and protect community safety. Our append-only Deletion Ledger guarantees that restored backups do not resurrect deleted accounts.

9. Contact Us

For questions or concerns regarding this Privacy Policy or our data handling practices, contact: