Privacy Policy

2.1 Account Data

When you register or sign in, we collect:

• Email address (required for authentication)
• Full name (optional, from OAuth profile)
• Profile picture (optional, from OAuth provider)
• Authentication provider (Apple, Google, or email)
• Account creation date and last login timestamp

2.2 Assessment & Psychometric Data

To provide our career guidance service, we collect and process your assessment responses. This data is classified as special category data under GDPR Article 9 (psychometric/personality data).

• Answers to career assessment questions
• RIASEC personality type scores
• OCEAN/Big-5 personality trait scores
• Derived career match scores and fit percentages
• Assessment drafts (auto-saved during completion)

2.3 Usage & Technical Data

We automatically collect certain technical information when you use the Service:

• IP address (anonymised after 24 hours)
• Browser type, operating system, and device type
• Pages visited and features used (anonymised analytics)
• Session duration and interaction patterns
• Error logs (when the Service malfunctions)

2.4 Payment Data

If you subscribe to PathFinder Pro, payment processing is handled entirely by Stripe, Inc. (Web) or Apple, Inc. (iOS). We do not store your full credit card number, CVV, or bank account details. We receive only a payment confirmation token and subscription status from these processors.

2.5 Communications Data

If you contact us or opt in to email communications, we collect your email address and the content of your messages.

3.1 Contract Performance — Art. 6(1)(b)

Processing your account data and assessment results is necessary to provide you with the PathFinder service you requested.

• Account creation and authentication
• Generating career pathways and roadmaps
• Subscription management and billing

3.2 Explicit Consent — Art. 6(1)(a) & Art. 9(2)(a)

For the processing of psychometric data (RIASEC, OCEAN scores), which is considered special category data under GDPR Article 9, we rely on your explicit consent given at the start of the assessment.

For optional analytics and email marketing communications, we also rely on consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

3.3 Legitimate Interests — Art. 6(1)(f)

We rely on legitimate interests for:

• Security monitoring and fraud prevention
• Service improvement using aggregated, anonymised analytics
• Internal error logging to maintain service quality

3.4 Legal Obligation — Art. 6(1)(c)

We may process data where required to comply with applicable law, including tax and accounting obligations, or in response to lawful requests by public authorities.

5.1 Infrastructure & Database

• Supabase, Inc. (USA) — Database hosting and authentication. Data stored in EU (Frankfurt) region. Transfer mechanism: Standard Contractual Clauses (SCCs) + EU hosting.
• Vercel, Inc. (USA) — Application hosting and edge network. Transfer mechanism: SCCs.

5.2 AI Processing

• Anthropic, PBC (USA) — AI model inference for career pathway generation. Your assessment data is sent to Anthropic's API for analysis. Transfer mechanism: SCCs. Anthropic does not use API inputs to train models.

5.3 Payments

• Stripe, Inc. (USA) — Payment processing for Web subscriptions. Transfer mechanism: SCCs + EU data residency options.
• Apple, Inc. (USA) — In-App Purchase processing for iOS subscriptions. Governed by Apple's Privacy Policy.

5.4 Communications

• Resend, Inc. (USA) — Transactional email delivery. Transfer mechanism: SCCs.

5.5 Public Data Sources

• European Commission ESCO API — Skills and occupation data (no personal data transmitted).

5.6 Legal Disclosures

We may disclose your data to law enforcement or regulatory authorities when required by law, or to protect the rights, property, or safety of the Company, our users, or others.

6.1 Essential Cookies

We use strictly necessary cookies to operate the Service:

• Session cookies for authentication state
• CSRF protection tokens
• User preference cookies (language, theme)

6.2 Analytics Cookies

With your consent, we may use privacy-preserving analytics to understand how the Service is used. We do not use Google Analytics. Any analytics tools we use are configured to anonymise IP addresses and not share data for advertising purposes.

6.3 No Advertising Cookies

We do not use advertising or tracking cookies, retargeting pixels, or share your data with advertising networks.

8.1 GDPR Rights (EU & EEA Users)

• Right of Access (Art. 15): Obtain a copy of all personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to Erasure / Right to be Forgotten (Art. 17): Request deletion of your data (subject to legal retention obligations).
• Right to Restriction (Art. 18): Restrict processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent for psychometric data processing at any time.
• Right to Lodge a Complaint: File a complaint with the CNIL (France) at cnil.fr or your local supervisory authority.

8.2 Swiss FADP Rights

Swiss users have equivalent rights under the Federal Act on Data Protection (FADP/nDSG), including the right of access, correction, deletion, and to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

8.3 California Privacy Rights (CCPA/CPRA)

California residents have the following additional rights:

• Right to Know: Know what personal information we collect, use, share, or sell.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out of Sale: We do NOT sell your personal information.
• Right to Non-Discrimination: Exercise your privacy rights without discriminatory treatment.
• Right to Correct: Correct inaccurate personal information.

8.4 How to Exercise Your Rights

Submit a request to privacy@pathfinder.app with the subject line "Privacy Rights Request". We will respond within 30 days (GDPR) or 45 days (CCPA). We may require identity verification before processing certain requests.