Legal
Privacy Policy
This explains what Pathfinder collects when you use the assessment, why we hold it, who else sees it, and what you can make us do with it. It is written to be read rather than to be survived.
Last updated 6 September 2026
Draft — not yet in force
This draft describes the processing accurately but still needs a legal entity name, a registered address, a contact address and a review by someone qualified. Do not remove this notice until those are in place.
Who we are
Pathfinder AI (“Pathfinder”, “we”) operates path-ai.co.uk and the career assessment on it. For UK data protection law we are the data controller for the personal data described here.
[LEGAL ENTITY NAME] · [REGISTERED ADDRESS] · [PRIVACY CONTACT EMAIL] · ICO [ICO REGISTRATION NUMBER, if registered]
What we collect
Three things, and nothing else:
Your account. Your name, email address and password when you sign up. The password is hashed by our authentication provider; we never see it and cannot recover it.
Your profile. Optionally your current job title and location, if you give them, so the roadmap reflects where you actually are.
Your assessment. The conversation you have with the diagnostic — everything you type about your work, your skills and what you want next — together with the roadmap generated from it. This is stored against your account so you can return to it.
We do not ask for and do not want special category data: health, ethnicity, religion, sexuality, political opinions, biometrics or trade union membership. Please do not enter any of it into the assessment. If you do, you are asking us to process it and we would rather you did not.
We do not buy personal data, and we do not sell yours. Ever.
Why we hold it, and on what basis
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, password | To create your account, sign you in and contact you about it | Contract |
| Job title, location | To make the roadmap specific to your situation | Contract |
| Assessment conversation | To produce your roadmap and let you return to it | Contract |
| Aggregate usage counts | To understand whether the platform works and improve it | Legitimate interests |
Where we rely on legitimate interests, we have considered whether it is fair to you. Aggregate counts — how many roadmaps were produced, how many people returned — carry no identifying detail and are what let us tell whether the thing is doing any good.
How the AI part works
The assessment is a conversation with a large language model. What you type is sent to Google (Gemini) to be processed into a skills profile and a roadmap. That is the core of the service and it cannot be switched off while still using it.
The roadmap is generated, not human-reviewed. It is guidance — named certifications, projects and a sequence — and you should treat it as a considered suggestion rather than advice about your career, finances or immigration status. No decision with a legal or similarly significant effect on you is made automatically.
Where it goes
Some of those suppliers process data outside the UK, including in the United States. Where that happens we rely on the UK International Data Transfer Addendum, or on the UK extension to the EU Standard Contractual Clauses, to keep your data protected to a UK standard.
How long we keep it
Your account and assessment stay for as long as your account is open, because the point of the platform is that you can come back and adjust the plan.
Delete your account and we remove your profile and your assessment within 30 days, except where we must keep something to meet a legal obligation. Aggregate counts that can no longer identify you may be retained.
Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it to another provider in a portable form, or object to processing we base on legitimate interests. You can withdraw consent where we rely on it, without affecting what came before.
Write to [PRIVACY CONTACT EMAIL] and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first and gave us the chance to put it right.
Security
Data is encrypted in transit and at rest by our hosting and database providers. Access is limited to those who need it to operate the service. Passwords are hashed and never stored in a readable form.
No system is perfect. If a breach affects your rights we will tell you and the ICO within the timescales the law sets.
Age
Pathfinder is for people of working age and is not intended for anyone under 16. If you believe a child has given us data, tell us and we will remove it.
Changes
If we change how we handle your data we will update this page and move the date at the top. Where a change materially affects you we will tell you directly rather than expecting you to notice.