Privacy Policy

1. Registration and login

Creating an account asks for an email address, password (stored encrypted), and name — or you sign in with a Google account, in which case we receive your email, name, and profile photo from Google via Google's own consent screen. We also store your browser's language and timezone, so we can render the interface and timestamps correctly.

For your login session we also record your IP address and browser identifier (user agent) — this protects your account by helping detect abuse.

2. Mentor and professional profile

If you sign up as a Mentor, we store your professional bio, photo (mandatory), experience, previous employers, education, professional credentials, languages, and industry experience — you upload this yourself, and can edit it at any time.

As a professional (Client), you can optionally provide a career goal and a short professional bio so the Platform can recommend relevant Mentors.

3. Tax data and reporting to the tax authority (DAC7)

As a digital platform, the Operator falls under the EU DAC7 rules (Directive 2021/514/EU amending Directive 2011/16/EU, and the Hungarian legislation implementing it). This means we are required to report annually to the tax authority on Mentors who earn income through the Platform. The sole purpose of processing the data listed here is to meet that obligation.

The legal basis for this processing is compliance with a legal obligation to which the controller is subject (Article 6(1)(c) GDPR). We therefore do not rely on your consent for these fields: without them a mentor application cannot even be submitted, because we would be unable to meet our statutory obligation.

From every Mentor we process: legal status (sole trader or private individual with a tax number), date of birth, residential address, tax identification number and its issuing state, and — where one exists — the VAT identification number. If a Mentor has no tax identification number at all, we record their place of birth instead.

From Mentors applying as sole traders we additionally process the official business name, the registration or company number, and whether they have a permanent establishment in the European Union.

The data reported to the authority also includes the consideration paid to the Mentor through the Platform, the number of finalized sessions, and the commission we deducted. We do not collect these separately: they are derived from our booking and payment records.

Your public Mentor profile NEVER displays this data, and it is not accessible to other users of the Platform. It is stored separately from your professional profile data.

4. Booking and payment

When you book, we record the booking time, the service chosen, the price, and the booking's status (e.g. cancelled, completed). Payment is processed by Stripe Connect — card details never reach the Platform's servers; Stripe handles them directly.

Transaction data needed for invoicing and financial reconciliation (amount, commission, refunds) is retained for the legally required retention period (typically 8 years, per accounting rules).

5. Sessions and messages

After a mentoring session, the Mentor can record notes and homework that the Client sees. Recording a session transcript or video is not active on the Platform today; the data model has a slot for it, but it is not a live feature yet.

A single, ongoing, text-only message thread exists between a Client and a Mentor, which the Platform keeps for as long as the connection exists.

6. Search and recommendations

We record which Mentors were shown in a search and what happened next (you opened a profile, started booking, booked), either anonymously or, if signed in, tied to your account. This is used only to improve search ranking and recommendations, for no other purpose.

7. Contact and email

We send booking- and account-related system messages by email, in your language and timezone. We never send SMS, and we do not currently send marketing email — if that is introduced, we will ask for separate consent.

The technical provider for sending email is Resend; as of the current state of development this connection is not yet live in production and will take effect at launch.

8. Video sessions

Mentoring sessions will run through an embedded, third-party video-room service (not self-built, not a Zoom link). The specific provider is still being chosen: [[VIDEO_SZOLGALTATO]]. As of the current state of this policy, this feature is not live yet.

9. Who we share your data with (processors and other recipients)

• Railway (hosting, EU West / Amsterdam region) — runs the Platform's entire database and server.
• Google Ireland Limited — only if you sign in with a Google account; Google authenticates you and passes us the basic profile data listed above.
• Stripe — processes payments and Mentor payouts; card details are handled exclusively by Stripe.
• [[VIDEO_SZOLGALTATO]] — for video sessions, from launch.
• Resend — for delivering system email, from launch.
• The Hungarian tax authority (NAV) — recipient of the annual DAC7 report. NAV is not a processor: it receives the data as an independent controller, on the basis of our statutory obligation. This transfer cannot be refused or withdrawn.
• None of our partners uses your data for their own purposes, independent of Liorio. Each requires a data processing agreement (DPA); the exact corporate details for each will be added here after legal review.

10. How long we keep your data

We keep your account data for as long as the account exists. Data tied to financial transactions is kept until the end of the legally required retention period, due to accounting and statutory obligations.

After account deletion, we anonymize your personal data. Historical records that also involve another user (e.g. a completed booking) are not deleted, so the other party's booking history stays intact — but the identifiers linking it to you are removed.

Tax data processed for DAC7 reporting, and the records underlying it, are retained even after an account is deleted or anonymized, until the end of the retention period required by law ([[ADO_MEGORZESI_IDO]]). An anonymization request does not affect this, because the retention is based on a statutory obligation.

11. Your rights

Under the GDPR you can request a copy of the data we hold about you, its correction, its deletion (subject to the anonymization limit in section 10), restriction of processing, and you can object to processing. Send requests to [[ADATVEDELMI_KAPCSOLAT]]; if you are not satisfied with our response, you can turn to Hungary's National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

12. Transfers outside the EU

Some of our processors (e.g. Google) may transfer data outside the European Union, under the safeguards the GDPR requires (such as Standard Contractual Clauses). Railway's and Stripe's European regions keep data within the EU by default.

13. Changes to this policy

We update this policy as the Platform evolves — a new feature, a new processor. We will notify you by email of any material change.