Your Rights

1. Rights You Have

Depending on where you live, the following rights apply:

• Access — a copy of the personal data we hold about you.
• Correction — fix inaccurate or incomplete data.
• Deletion / erasure — delete your account or specific conversation sessions or date ranges without closing your account.
• Export / portability — a downloadable file of your data (in JSON or CSV format) that you can open in standard tools or import to another service.
• Objection — ask us to stop using your data for specific purposes. For example, if we use your data for platform improvement or fraud prevention under our legitimate business interests, you can ask us not to.
• Restriction — restrict how we process your data while a dispute is resolved.
• Withdraw consent — for anything processed on the basis of consent.
• Complaint — if you are not satisfied with how we handle your data, you can complain to your country's data protection regulator (for example, the ICO in the UK, CNIL in France, or the Data Protection Board in India).

2. How to Submit a Request

Email privacy@menthra.ai with:

• The email address associated with your account
• The right you want to exercise
• Enough detail for us to act (for example, which sessions to delete, or what field to correct)

For India DPDP Act grievances, email dpo@menthra.ai.

3. Identity Verification

Before we act on a request, we verify you are who you say you are. Verification methods depend on the sensitivity of the request:

• Low-sensitivity (marketing unsubscribe, preference changes) — clicking a verified email link.
• Standard (access, export, correction) — logged-in session plus email confirmation.
• High-sensitivity (full deletion, data transfer) — logged-in session, email confirmation, and (for minor accounts) parental verification.

4. Response Timeframes

We respond within 30 days of verified request, consistent with GDPR and DPDP requirements. For complex requests we may extend by an additional 60 days and will tell you why.

5. What Deletion Actually Deletes

• Primary data — deleted within 30 days of verified deletion request.
• Backups — purged within 180 days.
• Aggregate, de-identified data — may remain, because it cannot be re-identified.
• Data we must retain by law (tax records, crisis-report documentation) — retained for the minimum legally required period, then deleted.

6. Minors and Parents

For users aged 13 to 17, either the minor or the parent or legal guardian can submit a deletion request. Parental revocation closes the minor's account. See the Minor Signup consent.

7. Complaints

If we do not resolve your request to your satisfaction, you may:

• Contact legal@menthra.ai to escalate internally.
• EU / UK: lodge a complaint with your national supervisory authority.
• India: approach the Data Protection Board of India under the DPDP Act.
• United States (HIPAA-related): file with the HHS Office for Civil Rights.
• California (CCPA/CPRA): contact the California Privacy Protection Agency.