Privacy Policy

PathFinder helps university students navigate internship applications. This policy explains what we collect, why, and the rights you have over your data. It is written to be readable; where a term has a specific legal meaning under UK GDPR / the EU GDPR, that meaning applies.

This is a starting-point policy for an early-access product and should be reviewed by legal counsel before a public launch.

What we collect

• Account data: your email address and a securely hashed password.
• Career data you enter: CV text, target roles, applications, networking contacts, interview notes, and progress. Your CV may contain personal data; you choose what to paste or upload.
• Usage data: basic technical information (e.g. approximate request timing) needed to operate and secure the service.

How we use it

• To provide the product: analysing your CV, matching opportunities, generating outreach and interview prep.
• To personalise recommendations across the six phases (your profile improves as you use it).
• To secure the service (authentication, rate limiting, abuse prevention).

Legal basis

We process account and career data to perform the service you request (contract), and process minimal security data on the basis of our legitimate interest in keeping the platform safe. You can withdraw and delete your data at any time.

AI processing

Some features send the text you provide (e.g. CV or job-description content) to a third-party AI provider (OpenAI) to generate analysis. We do not send your email or password. AI output is a draft for you to review. It is not advice, and you are responsible for what you submit to employers.

People you add

The contacts board lets you keep notes on people you are networking with. That is someone else's personal data, so we keep it small and on your side.

• What is stored: a name, company, optional role, how you met, an optional web link (http or https only), your own notes, an optional follow-up date, a stage, and when it was added and last changed. Please do not add personal phone numbers or home addresses; the board has no fields for them and your notes are not the place for them.
• Where it lives: in your browser's local storage. If you are signed in, it is also synced to your account's data in Supabase so it follows you between devices.
• AI: a contact is never sent to the AI provider unless you act on that specific contact (for example by asking for research, outreach or coffee-chat prep). Then only what that action needs is sent.
• Export and delete: contacts are included in your data export and are deleted with your account. You can also use “Delete all contacts” at any time.
• LinkedIn import: if you import your LinkedIn Connections.csv, the file is read in your browser only and is never uploaded. Only the name, company and position of the rows you tick are kept.
• Keeping it tidy: the board will ask “still relevant?” about contacts you have not touched for 12 months and offer a one-click delete. It does not delete anything on its own.

Our basis for holding this data is the legitimate interest you have in managing your own professional network for a job search. If you are someone a student has added and you want your details removed, ask the student, or contact us at the address below.

Third parties we rely on

• Supabase: database hosting. It stores your account, career data and contacts described above.
• OpenAI: AI text generation. It receives only the text a feature needs, as described under “AI processing”.
• Resend: email delivery. It receives your email address and the content of the verification and password-reset emails we send you.
• Vercel: hosting for the app. It handles your requests to the site and so processes request logs, including your IP address.
• Job data providers: when you search for live opportunities, PathFinder queries Adzuna (a job-search API) and pulls from open, community-maintained internship lists published on GitHub (e.g. the Summer-internship repos). We only send your search terms (role, location) to these sources; every listing links out to the original posting, and we do not re-host or claim ownership of it.
• Employers' public careers pages: once a day the server fetches public job boards hosted on Greenhouse, Lever and Ashby. These are fetched by our server, not by you, and receive no student data.

Retention

We keep your data while your account is active. When you delete your account, your user record and all associated data are permanently removed. Backups are rotated on a rolling basis.

Your rights

You can access and export all your data, and permanently delete your account and data, from Settings → Data & privacy. You also have the right to rectification and to object to processing. To exercise any right you cannot action in-app, contact us.

Security

Passwords are hashed (PBKDF2). Sessions use signed, http-only cookies. Traffic is served over HTTPS with a strict content-security policy, and API requests are rate limited.

Contact

Questions or requests: privacy@pathfinder.app (replace with your real contact before launch).