Your firm owns its data. We just process it.

Your firm is the data controller. You decide that the observation happens, who takes part, and what it is for. The data about your employees is yours.

Mehak Learning is the processor. We hold and process that data on your behalf, to deliver the service you are paying for. We do not decide what to collect or why, we do not use it for our own purposes, and we do not have an independent right to it.

These are yours, and we cannot do them for you:

• Tell your employees. You must inform the people on your team that this tool observes their work for training purposes, before an observation week begins. The onboarding flow asks the firm owner to confirm this.
• Obtain any consent the law requires. Employment and privacy law differs by state and by country, and your own employment agreements or works council arrangements may add requirements. Meeting them is your firm's responsibility.
• Have the authority to share what is uploaded. Your firm is responsible for ensuring work samples don't contain privileged, medical or regulated client material — see Acceptable Use.
• Handle your employees' requests. If someone on your team wants to see, correct or remove their data, that request comes to you as the controller. We will help you carry it out.

• ✓We process your data only to provide the service, and only on your instruction.
• ✓We do not sell it, and we do not use it to train public AI models.
• ✓We keep each firm's data isolated, enforced on the server for every request.
• ✓We encrypt check-in text, work-sample text and skill reports before storing them.
• ✓We log access for 12 months, and record every support access to your workspace with a reason.
• ✓We tell you before adding a new subprocessor.
• ✓We delete your data on request and give you a dated receipt.
• ✓We return your data on request — you can export all of it yourself at any time.

We use these companies to run the service. Each processes data only as needed for its role, and the full detail is on the Privacy Policy.

• Neon — Database hosting (United States)
• Vercel — Application hosting (United States)
• Clerk — Authentication
• Stripe — Payments
• Resend — Transactional email
• Anthropic and/or Ollama — AI analysis of check-ins and work samples

All of them are US-based. If your firm has a requirement that data stay in a particular jurisdiction, talk to us before signing up — we would rather tell you we can't meet it than find out later.

If we become aware of a breach affecting your firm's data, we will tell you without undue delay, with what we know: what happened, what data was involved, and what we are doing about it. We will not sit on it while we work out the messaging.

As controller, any notification to your employees or to a regulator is your firm's decision and responsibility. We will give you what you need to make it.

You can export everything at any time, including after cancelling, for as long as the account exists. When you ask us to delete, we remove your firm's records permanently and send a dated receipt listing what was removed.

Two things survive deletion on purpose: the deletion receipt itself, and the record that our support accessed your workspace and why. Both exist to prove what happened, and deleting them would defeat the point of keeping them.

These terms describe how we handle your data and how responsibility is divided. They are written plainly rather than as a formal data processing agreement, and they do not assert compliance with any particular regulation — we have not been audited against one. If your firm needs a signed DPA with specific terms, email aqeek@mehaklearning.com and we will work through it with you.