Privacy Policy

1. Data Controller

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and other applicable privacy laws, the data controller is:

We do not currently have a formally appointed Data Protection Officer (DPO). All privacy enquiries should be directed to the contact above. If that changes, we will update this section.

2. Information We Collect

2.1 Information you provide directly

2.2 Information collected automatically (with consent)

If you choose "Accept analytics & ads" in our cookie banner, we also collect the following via our first-party analytics system and third-party tools:

We do not collect this data if you choose "Essential only." Your consent choice is stored locally in your browser and can be changed at any time (see Section 5).

2.3 Special categories of data

We do not intentionally collect special category data as defined under GDPR Article 9 (e.g., health, biometric, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning sex life or sexual orientation). Please do not include such data in your resume or quiz responses. If you do, you consent to our processing it solely to provide the requested service and we will delete it promptly upon request.

3. Legal Bases for Processing (GDPR)

For users in the EEA and UK, we rely on the following legal bases under GDPR Article 6:

4. How We Use Your Data

We use your personal data to:

• Provide and personalise the Service: Operate your account, generate career recommendations, match you with relevant learning roadmaps, and analyse your resume.
• Send transactional communications: Email you your quiz results, personalised roadmap recommendations, account-related notices, and security alerts.
• Send marketing communications (with consent): Newsletters and product updates. You can opt out at any time.
• AI-powered features: Pass quiz answers, resume content, and career data to AI models (via OpenRouter) to generate recommendations, summaries, and analyses. Data is processed to generate a response and is not used to train AI models beyond the scope of the API agreement with the provider.
• Analytics (with consent): Understand how users interact with the Service, diagnose bugs, and improve features.
• Security & fraud prevention: Monitor for and protect against abuse, unauthorised access, and other harmful activity.
• Legal compliance: Comply with legal obligations, enforce our Terms of Service, and resolve disputes.

We do not sell your personal data to third parties and we do not use it for purposes that are incompatible with those stated above.

5. Cookies & Tracking Technologies

5.1 Essential cookies (always active)

5.2 Analytics & advertising (only with consent)

5.3 Managing your preferences

You can reset your cookie consent choice and re-display the banner at any time:

You can also control cookies through your browser settings. Note that blocking certain cookies may affect Service functionality. For more information on managing cookies, visit allaboutcookies.org.

6. Sharing & Third-Party Processors

We do not sell, rent, or trade your personal data. We share data only with the following categories of recipients and only to the extent necessary:

6.1 Sub-processors (service providers)

Each sub-processor is bound by a data processing agreement requiring them to protect your data and process it only on our documented instructions.

6.2 Other disclosures

We may also disclose your data:

• Legal requirements: If required by law, court order, or government authority, or to protect our legal rights.
• Business transfers: If we are involved in a merger, acquisition, financing, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and a prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.
• Safety: To protect the rights, property, or safety of CareerPath, our users, or the public as required or permitted by law.

7. International Data Transfers

We are based globally and our sub-processors operate primarily in the United States. If you are located in the EEA, UK, Brazil, or another jurisdiction with data transfer restrictions, your personal data will be transferred to countries that may not provide the same level of data protection as your home country.

We implement appropriate safeguards for these transfers, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where required for EEA/UK-to-US transfers.
• Reliance on adequacy decisions where applicable.
• Data Processing Agreements with all sub-processors containing appropriate security obligations.

You may request a copy of the relevant transfer safeguards by contacting us at support@ourdomain.com.

8. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy, or as required by law.

After the applicable retention period, data is permanently deleted or irreversibly anonymised.

9. Your Rights

9.1 Rights under GDPR (EEA & UK residents)

Under the GDPR and UK GDPR, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): Request deletion of your personal data where there is no compelling reason to continue processing it.
• Right to restriction (Art. 18): Request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Receive a copy of your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making (Art. 22): Not to be subject to solely automated decisions that produce legal or similarly significant effects. Our AI features generate recommendations that are presented to you; final decisions are always yours.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: Lodge a complaint with your local supervisory authority. UK residents may contact the ICO. EEA residents should contact their national Data Protection Authority.

9.2 California Consumer Privacy Act (CCPA / CPRA) — California residents

If you are a California resident, you have the following additional rights under the CCPA and CPRA:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of your personal information, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt-out of sale / sharing: We do not sell or share your personal information for cross-context behavioural advertising as defined under California law. No opt-out is required, but you may submit a request to confirm.
• Right to limit use of sensitive personal information: We do not use sensitive personal information beyond the purposes set out in CPRA regulations.
• Right to non-discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.

To submit a CCPA/CPRA request, contact us at support@ourdomain.com with the subject line "California Privacy Request."

9.3 Lei Geral de Proteção de Dados (LGPD) — Brazil residents

If you are located in Brazil, you have rights under the LGPD including the right to access, rectify, delete, and port your data, to know with whom your data is shared, to object to processing, and to review automated decisions. Contact us at support@ourdomain.com to exercise these rights.

9.4 PIPEDA — Canada residents

If you are located in Canada, you have the right to access and correct your personal information and to challenge our compliance with PIPEDA by contacting us or the Office of the Privacy Commissioner of Canada at priv.gc.ca.

9.5 How to exercise your rights

To exercise any of the above rights, email us at support@ourdomain.com with the subject line "Privacy Request." Please include:

• Your full name and the email address associated with your account.
• A description of the right you wish to exercise.
• Sufficient information to verify your identity (we may ask for additional verification to protect against fraudulent requests).

We will respond within 30 days (or as required by applicable law). We may extend this period by a further 60 days for complex requests, in which case we will notify you. There is no charge for reasonable requests; we may charge a reasonable administrative fee for manifestly unfounded or excessive requests.

10. Children's Privacy

The Service is not directed at, and we do not knowingly collect personal data from, anyone under the age of 16. Users under 16 must not use the Service or submit any personal data.

If you are the parent or guardian of a child under 16 and believe they have provided us with personal data, please contact us at support@ourdomain.com and we will delete that information promptly.

We comply with the US Children's Online Privacy Protection Act (COPPA) for users under 13, the EU GDPR minimum age requirements, and applicable local laws where the required age for lawful consent is higher than 16.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, disclosure, or access. These measures include:

• Password hashing using bcrypt with a minimum of 12 rounds (plain-text passwords are never stored).
• JWT authentication tokens transmitted only via HTTPS and stored in HTTP-only cookies with the Secure flag.
• Encrypted connections (TLS/HTTPS) for all data in transit.
• Database access via connection pooling with role-based access controls.
• Input sanitisation to protect against injection attacks.
• Regular review of access permissions for internal team members.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay as required by law.

12. Third-Party Links & Resources

Our roadmaps, blogs, and other content may contain links to third-party websites, tools, courses, and resources. These third parties operate under their own privacy policies, which we encourage you to read. We are not responsible for the content, privacy practices, or security of any third-party site and our linking to them does not constitute an endorsement.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users by email at least 14 days before the changes take effect (for material changes that affect your rights).
• Display a prominent notice on the Service where appropriate.

We encourage you to review this policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

14. Contact & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

EU/EEA residents: If you are not satisfied with our response, you have the right to lodge a complaint with your national Data Protection Authority. A list of EU DPAs is available at edpb.europa.eu.

UK residents: You may also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

California residents: You may also contact the California Attorney General's office regarding CCPA rights.