SMPHR Connections
Powered by PurposeMentor
Privacy Policy
Last updated: February 25, 2026
PurposeMentor ("PurposeMentor," "we," "us," or "our") operates the SMPHR Connections mobile application and website (collectively, the "Service"). SMPHR Connections is built and operated by PurposeMentor and is currently made available to members of SMPHR, Inc. ("SMPHR") as part of a pilot program. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.
By creating an account and accepting this Privacy Policy during sign-up, you consent to the collection and use of your information as described in this policy. If you do not agree, please do not create an account or use the Service.
Our Role: PurposeMentor acts as the data controller for personal information collected directly through the Service (account data, profile data, usage data). SMPHR is a pilot client organization whose members are the current users of the Service. SMPHR does not have direct access to your personal data unless separately agreed upon. When we process data on behalf of an organizational client, we act as a data processor under that organization's instructions. In such cases, the organization's own privacy policy may also apply to you.
1. Information We Collect
1.1 Information You Provide
- Account information: Name, email address, password, profile photo, job title, company, and HR function when you create an account.
- Profile data: Professional background, skills, mentorship goals, career interests, and any other information you choose to add to your profile.
- Content: Posts, comments, messages, event RSVPs, goal entries, survey responses, and other content you create or share through the Service.
- Communications: Information you provide when contacting our support team, including the content of your messages and any attachments.
- Referral data: When you use our referral feature, we collect the referral code usage and the relationship between referrer and referred user.
- Consent records: When you accept our Terms of Service and Privacy Policy during sign-up, we record the date, time, and version of the documents you accepted.
1.2 Information Collected Automatically
- Usage data: Pages viewed, features used, actions taken, session duration, and interaction patterns.
- Device information: Device type, operating system, app version, unique device identifiers, screen resolution, and language settings.
- Log data: IP address, browser type, referring/exit pages, timestamps, and error logs.
- Location data: Approximate location derived from your IP address. We do not collect precise GPS location.
1.3 Information from Third Parties
- OAuth providers: If you sign in with Google, Apple, or LinkedIn, we receive your name, email address, and profile photo from those services.
- Organizational clients: If your employer or organization has deployed SMPHR Connections, they may provide us with your name and work email address to set up your account.
2. Lawful Basis for Processing (EEA/UK Users)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
| Processing Activity | Lawful Basis |
|---|
| Providing the Service and your account | Performance of a contract |
| Mentor/mentee matching | Performance of a contract |
| AI coaching features | Consent (you choose to use the feature) |
| Push notifications | Consent |
| Analytics and service improvement | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Legal compliance | Legal obligation |
| Marketing communications | Consent |
Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may contact us to request details of these assessments.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service.
- Match mentors and mentees based on professional profiles and goals.
- Power AI coaching features that provide personalized career guidance.
- Send push notifications about messages, events, and relevant activity (with your consent).
- Track gamification progress (badges, leaderboard rankings, streaks).
- Facilitate event management, RSVPs, and calendar integration.
- Respond to your requests and provide customer support.
- Detect, prevent, and address technical issues, fraud, or abuse.
- Conduct analytics to understand how the Service is used and to improve user experience.
- Send you marketing or promotional communications (only with your prior opt-in consent; you may opt out at any time).
- Comply with legal obligations.
4. AI Features
SMPHR Connections includes an AI coaching feature powered by third-party AI models (Google Gemini via OpenRouter). When you use the AI Coach:
- Your messages are sent to our backend, which forwards them to the AI provider to generate responses.
- We enforce per-user rate limits (100 requests/day, 100,000 tokens/day) to prevent abuse.
- AI conversations are stored on our servers for your convenience but are not used to train third-party AI models.
- You should not share sensitive personal information (SSN, financial data, medical records) with the AI Coach.
- AI-generated responses may contain inaccuracies. They are not a substitute for professional advice from a licensed career counselor, therapist, attorney, or other qualified professional.
No Automated Decision-Making: The AI Coach does not make decisions that produce legal or similarly significant effects on you. Mentor/mentee matching is algorithmically assisted but always subject to your review and acceptance. You are never required to accept a suggested match.
5. Cookies and Tracking Technologies
We use cookies and similar technologies to operate the Service. Below is a summary of the types of cookies we use:
| Category | Purpose | Duration |
|---|
| Strictly Necessary | Authentication, security, session management | Session / up to 30 days |
| Functional | Remembering your preferences (language, theme) | Up to 1 year |
| Analytics | Understanding usage patterns to improve the Service | Up to 2 years |
We do not use advertising or cross-site tracking cookies. We do not sell data collected through cookies.
Your choices: You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies may prevent the Service from functioning properly.
Do Not Track: Some browsers offer a "Do Not Track" (DNT) signal. At this time, we do not respond to DNT signals because there is no industry-standard method for handling them. We will update this policy if a standard is adopted.
6. How We Share Your Information
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We may share your information with the following categories of recipients:
| Recipient | Purpose | Data Shared |
|---|
| Convex (backend) | Database hosting and real-time sync | All app data |
| WorkOS (authentication) | Account sign-in and identity verification | Email, name, OAuth tokens |
| OpenRouter / Google (AI) | AI coaching responses | Chat messages (no PII attached) |
| Apple (push notifications) | Delivering push notifications | Device token, notification content |
All third-party service providers are bound by contractual obligations to process your data only as instructed by us, to maintain confidentiality, and to implement appropriate security measures.
We may also share information:
- When required by law, regulation, legal process, or governmental request.
- To protect the rights, property, or safety of PurposeMentor, our users, or the public.
- In connection with a merger, acquisition, bankruptcy, or sale of all or a portion of our assets (see Section 7).
- With your consent or at your direction.
7. Business Transitions
In the event that PurposeMentor undergoes a business transition — such as a merger, acquisition by another company, reorganization, or sale of all or a substantial portion of its assets — your personal information may be among the assets transferred. In such a case, we will provide notice via the Service or email before your personal information is transferred and becomes subject to a different privacy policy. You will have the opportunity to delete your account before such a transfer takes effect.
If the pilot relationship between PurposeMentor and SMPHR ends, we will provide users with at least thirty (30) days' notice and the opportunity to export their data or delete their accounts before any changes take effect.
8. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes described in this policy:
- Active accounts: Data is retained for as long as your account is active.
- Deleted accounts: Upon account deletion, we will delete or anonymize your personal data within ninety (90) days, except where retention is required by law or for the establishment, exercise, or defense of legal claims.
- AI conversation logs: Deleted within thirty (30) days of account deletion.
- Server logs: Retained for up to twelve (12) months for security and troubleshooting purposes, then automatically purged.
- Backup copies: May persist in encrypted backups for up to thirty (30) additional days after deletion from live systems.
9. Data Security
We implement industry-standard security measures to protect your personal information, including:
- Encryption in transit (HTTPS/TLS) for all data transfers.
- Encryption at rest for stored personal data.
- Secure authentication via WorkOS with support for OAuth (Google, Apple, LinkedIn).
- Per-user rate limiting on AI and API endpoints.
- Regular security reviews and vulnerability assessments of our infrastructure.
- Access controls limiting employee access to personal data on a need-to-know basis.
No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee absolute security.
10. Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within seventy-two (72) hours of becoming aware of the breach, where required by applicable law.
- Notify affected users without undue delay, and no later than thirty (30) days after discovery, via email and/or an in-app notification.
- Provide a description of the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address the breach.
11. Your Rights
Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete information.
- Deletion: Request deletion of your personal data ("right to be forgotten").
- Data portability: Request your data in a structured, commonly used, machine-readable format.
- Restriction: Request that we restrict the processing of your personal data under certain circumstances.
- Objection: Object to processing of your personal data based on legitimate interests or for direct marketing.
- Withdraw consent: Where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
- Opt out of push notifications: Manage notification preferences via your device settings or in-app preferences.
- Lodge a complaint: File a complaint with your local data protection supervisory authority.
To exercise these rights, contact us at [email protected]. We will acknowledge your request within ten (10) business days and respond substantively within thirty (30) days (or as required by applicable law). We may need to verify your identity before processing your request.
We will not discriminate against you for exercising any of your privacy rights.
12. Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.
- Right to delete: You may request deletion of your personal information, subject to certain exceptions.
- Right to correct: You may request correction of inaccurate personal information.
- Right to opt out of sale/sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising. No opt-out is required, but you may still submit such a request.
- Right to limit use of sensitive personal information: To the extent we collect sensitive personal information, you may request we limit its use to what is necessary to perform the Service.
- Right to non-discrimination: We will not deny you services, charge different prices, or provide a different quality of service because you exercised your CCPA/CPRA rights.
To submit a request, email [email protected] with the subject line "California Privacy Request." We will verify your identity before processing your request.
13. Children's Privacy
The Service is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18. If we learn that we have collected personal data from a minor, we will delete it promptly. If you believe that a child under 18 has provided us with personal information, please contact us at [email protected].
14. International Data Transfers
Your information may be transferred to and processed in the United States, where our servers and service providers are located. If you are located in the European Economic Area, United Kingdom, or another jurisdiction with data transfer restrictions:
- We rely on the EU-U.S. Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs), or other legally recognized transfer mechanisms to ensure adequate protection of your personal data.
- Our service providers are contractually required to provide a level of data protection at least as protective as required under applicable data protection laws.
- You may request a copy of the transfer safeguards we have in place by contacting us at the address below.
15. Third-Party Links
The Service may contain links to third-party websites, services, or content that are not operated by us. We have no control over, and assume no responsibility for, the privacy practices of any third-party sites or services. We encourage you to review the privacy policies of any third-party site you visit.
16. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Post the updated policy in the app and on our website with a new "Last updated" date.
- Notify you via email or in-app notification at least fourteen (14) days before the changes take effect.
- Where required by law, obtain your consent to material changes.
Your continued use of the Service after the effective date of a revised policy constitutes acceptance of the updated terms.
17. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:
If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.