Privacy Policy

01 Who we are

Pathly is operated by Pathly Labs, Inc., a Delaware corporation, headquartered in South Carolina. In this Policy, "Pathly," "we," and "us" mean Pathly Labs, Inc.

Pathly Labs, Inc. is the successor to Pathly Ltd Co.

02 Who this covers

Where a signed agreement with a school or an organization conflicts with this Policy as to data processed on that organization's behalf, the agreement controls. Nothing in any agreement reduces the protections Pathly gives students directly.

03 What we collect

The data inventory lists every field, its purpose, and its retention period. This is the summary.

3.1 What you give us

3.2 What we collect automatically

• Login timestamps and last-active signal
• Page views, feature usage, and device type, collected in anonymized form for product analytics
• IP address, logged briefly for rate limiting and security. It is anonymized in analytics and not retained long term.
• Error and performance data, with personal information scrubbed before it is stored

We do not use session recording, we do not autocapture clicks, and we do not collect precise location.

3.3 What we get from others

• Google sign-in. If you sign in with Google, we receive your name and email address from Google. Nothing else.
• Your school. If your account is linked to a partner school, that school may provide your name and graduation year to associate your account.
• A connected counselor. A counselor you have connected can enter a GPA and test scores on your profile. See Section 4.

3.4 What we do not collect

04 Grades and test scores

Pathly holds academic data only where you or a counselor you connected typed it in. It is always self-reported. We do not receive official transcripts, verified score reports, or feeds from a school information system or a testing agency.

• You can see any GPA or test score on your profile, whoever entered it.
• You can change it or delete it at any time.
• If a counselor entered a value and you correct it, your correction stands. Pathly will not restore theirs over yours.

You never have to enter a GPA or a test score. Pathly works without them.

05 How we use it

We send you account and platform emails, such as verification, password resets, and notices about changes to this Policy. We do not send marketing email to students.

06 AI

Pathly uses third-party AI services to generate guidance. The subprocessor list names every provider.

Training. Pathly does not permit AI providers to train their models on your data, and uses the provider settings and contractual terms available to it to disable training and minimize retention. Pathly does not train models on individual student conversations. De-identified, aggregated patterns may inform how we design prompts and improve the product.

Storage. Your messages and Pathly's responses are stored so you can reread them. They are accessible to you. They are not accessible to a counselor, a school, or a parent through the platform. Pathly personnel access them only where a documented support or security need requires it.

Limits. AI guidance is a suggestion, not a decision, and it can be wrong. Verify anything that matters with the school, program, or provider directly.

07 How Pathly makes money

Students are never charged. Recommendations are never paid placement. Pathly does not sell personal information.

Revenue comes from counselors and institutions that subscribe to professional tools, and from optional family subscriptions. Colleges, programs, employers, and training providers cannot buy ranking, position, or enhanced listings in what a student sees, and no third party pays us to be recommended.

If that ever changes, it will be disclosed here and in the changelog at least 30 days before it takes effect, and any paid relationship will be labeled everywhere it appears.

08 What we never do

09 Who we share with

9.1 Service providers

We use a small set of third parties to run Pathly: database hosting, AI services, product analytics, transactional email, error monitoring, and payment processing for paid plans. Each is under a written data processing agreement that limits them to providing services to us. Every one is named, with what it touches, at pathly.com/legal/subprocessors. We give at least 30 days' notice before adding a new one.

9.2 Counselors you connect

A counselor sees what Section 10 describes, and only after you connect them. You can disconnect at any time.

9.3 Your school

If your account is linked to a partner school, authorized staff at that school can see the data described in Section 10, scoped to students at that school. What they can access is set by the school's agreement with Pathly.

9.4 Legal reasons

We may disclose information to comply with law or valid legal process, to enforce our Terms, or to protect the rights, safety, or property of Pathly, our users, or the public. Where we are permitted to tell you about a legal request, we will.

9.5 A change in ownership

If Pathly is involved in a merger, acquisition, or sale of assets, information may transfer to the successor. We will notify users before any transfer of personal information, and the successor will be bound by this Policy until it is changed under Section 18.

9.6 Aggregated and de-identified information

We may publish or share aggregated statistics and de-identified research findings that cannot reasonably be used to identify anyone. We do not re-identify de-identified data, and we require anyone who receives it to agree not to.

10 What counselors and schools see

Engagement summaries shown to a counselor are generated from metadata: message counts, timestamps, saved careers, assessment completion. The system that writes them does not read conversation content. If you want to share part of a conversation with your counselor, you can, but it is always your choice and never automatic.

Counselor access is restricted to students connected to them, enforced in the database, and logged.

11 How long we keep it

The full table is in the data inventory. The essentials:

• Your account data is kept while your account is open.
• If you delete your account, there is a 15-day grace period in case you change your mind, then permanent deletion from our systems within 2 business days and removal from backups within the 7-day backup rotation.
• If your school's agreement ends, your account stays open. You keep everything and can keep using Pathly for free.
• If a counselor cancels, their connection to you ends. Your account is unaffected.
• Inactivity does not delete anything.
• Email delivery logs are kept 30 days. Error logs are kept 90 days.
• De-identified and aggregated data may be kept indefinitely. It cannot reasonably be linked back to you.
• Business records such as contracts and invoices may be kept as long as tax and audit requirements need.

12 Your rights

Every Pathly user has these rights, wherever they live, as a matter of policy and not only where a law requires it.

To make a request, use account settings or write to privacy@pathly.com. We verify identity before acting, and we respond within 45 days. We will not treat you differently for exercising any of these rights.

If your account is linked to a school, some requests may be coordinated with that school where its policies or the law require it. We will tell you if that applies.

13 Parents and guardians

If your child has a Pathly account, you can review their information, ask for corrections, and request deletion. Write to privacy@pathly.com and we will verify the relationship before acting.

Two things worth knowing before you ask:

• Conversations with Pathly's AI are private to the student. We designed it that way so students will ask honest questions about their future. We will tell you what topics the platform covers, and we will show you everything else in the account, but we do not hand over a teenager's conversation history.
• If your child's account is linked to a school, some requests may run through the school, consistent with its policies and applicable law.

To raise a safety concern with us directly, write to privacy@pathly.com.

14 Children under 13

Pathly is not directed to children under 13. We do not knowingly collect their personal information or let them create accounts. If we learn that someone under 13 has registered, we delete the account and the information associated with it.

If you believe a child under 13 has given us information, write to privacy@pathly.com.

15 Cookies

We use cookies and similar technologies for three things: keeping you signed in, keeping the platform secure, and understanding which features get used. We do not use them to build advertising profiles of students.

You can block or delete cookies in your browser settings. Blocking essential cookies will sign you out and break parts of the platform.

We advertise Pathly itself to counselors, educators, and parents, and we may use cookies to measure those campaigns. Student data from student accounts is never used for that. We do not show advertising to students inside Pathly.

16 Where your data is processed

Pathly is designed for and directed to users in the United States. All data is processed and stored in United States data centers. We configure every service to use US regions, and we do not intentionally transfer data internationally. Limited access from outside the US may occur for vendor support or security operations.

If you use Pathly from outside the United States, you are choosing a US service, and your information will be processed here under United States law. The rights in Section 12 are available to you regardless of where you live.

17 Security

We encrypt data in transit and at rest, enforce row-level security so students reach only their own data, use role-based access control, require multi-factor authentication for administrative access to production systems, and log administrative access. Anyone with access to platform data is bound by written confidentiality obligations, on a least-privilege basis.

Our infrastructure and AI subprocessors hold SOC 2 Type II or comparable attestations, linked on the subprocessor list so you can check for yourself. We hold internal security reviews and are working toward independent certification; we do not hold a SOC 2 Type II attestation of our own today, and we do not claim one.

No system is perfectly secure. If you find a vulnerability, tell us at security@pathly.com.

18 Changes

We may update this Policy. If a change materially affects your rights, we will notify you by email and on this page at least 30 days before it takes effect. Continued use after that date means you accept it. Other changes take effect on posting.

Every version is dated and kept in the archive. Every change is listed in the changelog.

19 Contact