Privacy Policy
Pathwei, AI Career Coach
Last updated: 2 November 2026 · Consent version: v1-2026-08-17
Contents
- Who we are
- About this policy
- What data we collect
- Why we process your data and our lawful basis
- Who we share your data with
- International transfers
- How long we keep your data
- Your rights
- Automated processing and profiling
- Security
- Children
- Cookies and the website
- Changes to this policy
- How to complain
1. Who we are
Pathwei Ltd. ("Pathwei", "we", "us", "our") is the data controller responsible for the personal data processed through the Pathwei app and website.
Contact for privacy matters Email: contact@pathwei.ai Company registration number: 17241634 Registered office: Triumph Road, Nottingham, United Kingdom, NG7 2TU
If you have any questions about this policy or about how we handle your data, please email us at the address above.
2. About this policy
This policy explains what personal data we collect when you use Pathwei, why we collect it, how we use it, who we share it with, how long we keep it, and the rights you have over your data. We have written it in plain English.
It applies to the Pathwei mobile app (iOS and Android) and to pathwei.ai.
Current status. Pathwei is in early access and being rolled out to a limited group of users before general release. The practices described here apply both to the current early access phase and to the app at general release. Where our current practice differs from what is described, we say so in the relevant section.
3. What data we collect
Account data. Email address, display name, username (@handle), and an optional phone number.
Profile data. Target sector and role, career stage or level, an optional avatar image, your preferences and settings, and your marketing consent choice. Two profile fields are optional and worth calling out on their own:
- Field of study: optional, used to tailor the opportunities and paths we suggest.
- Gender: optional, self-stated only, from a fixed list that includes "prefer not to say". We use it for exactly one purpose: deciding which gender-targeted opportunities you are eligible for, such as women-in-industry programmes, scholarships and networks. If you state a gender, that stated label is included in the instructions we send to our AI providers when generating opportunity suggestions, and a gender-derived hint (for example "women in") is added to the queries we send to our web-search provider when searching for events. We never infer your gender from anything else and never use it for any other purpose. If you leave it blank or choose "prefer not to say", no gender information is sent anywhere and gender-targeted opportunities are simply not shown to you.
CV and career documents. The structured fields you enter (work history, education, skills and similar) and any CV files you upload. CV content can contain sensitive information, for example health conditions, or details that imply ethnicity, religion or trade union membership. We process this kind of information only with your explicit consent.
Psychometric test data. Your answers to the career questionnaires and the indicative trait scores generated from them. Psychometric profiling is a form of sensitive-data processing, and we carry it out only with your explicit consent.
Coaching chat data. The messages you send to and receive from "Ask-Wei", our AI coaching chat.
What Wei remembers. To make coaching feel continuous, Wei keeps short notes drawn from your conversations, for example that you are preparing for a particular interview. Some of these notes can touch on sensitive subjects you raise yourself, such as health, family circumstances or financial pressure. You can see every note Wei holds, and delete any or all of them, in the app under Profile → What Wei knows.
Simulation results. Results from "Wei-Sim" career-scenario simulations.
Progress and usage data. Records of your path progress, your credit and usage counters, and basic technical information needed to run the service.
Consent records. The version of this policy you accepted, when you accepted it, your confirmation that you are 18 or over, and whether you consented to sensitive-data and AI processing. These records are append-only: withdrawing consent adds a new record rather than erasing the old one, because we have to be able to show what you agreed to and when. They are deleted along with everything else if you delete your account.
4. Why we process your data and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing the core Pathwei service, account, profile, paths, coaching chat, simulations | Consent, Article 6(1)(a) |
| Processing sensitive information contained in your CV, in your psychometric answers, and in the notes Wei keeps from your conversations | Explicit consent, Article 9(2)(a) |
| Running AI models on your CV text, chat messages and psychometric answers to generate coaching feedback, scores and recommendations | Explicit consent, Article 9(2)(a), with the safeguards in Section 9 |
| Using your stated gender, where you provide one, to decide eligibility for gender-targeted opportunities | Consent, Article 6(1)(a); explicit consent, Article 9(2)(a), where this constitutes sensitive-data context |
| Searching external sources, job feeds, event search, interview-question sources, using query terms derived from your target role, sector, location and, where stated, gender | Consent, Article 6(1)(a) |
| Emailing you your rendered CV or cover letter when you ask us to | Consent, Article 6(1)(a) |
| Sending you notifications about your progress or the service | Consent, Article 6(1)(a) |
| Understanding how the app is used so we can improve it | Consent, Article 6(1)(a) |
How we capture your consent. When you create an account you are asked to tick two separate boxes: one confirming you are 18 or over, and one confirming you have read this policy and consent to the processing described here, including AI processing of your CV, chat and psychometric data. You cannot create an account without both. Ticking them records a versioned consent entry against your account. If you created your account before this step existed, you are asked the same questions once, at your next sign-in.
How we enforce it. The features that send your data to AI providers, the coaching chat, CV analysis and building, the career test and the interview simulation, check your consent on our servers before processing anything. If you have not consented, or you have withdrawn consent, those requests are refused rather than processed.
5. Who we share your data with
We share your data only with the service providers we need in order to run Pathwei. We do not sell your data, and we do not share it with advertisers.
Infrastructure
- Supabase: our database, authentication and file-storage provider. UK, London region.
- AWS: hosts our AI backend service. UK, London region.
- Expo (EAS): app builds and the delivery of notifications.
AI inference: these providers process your CV text, coaching chat and psychometric answers to generate feedback and scores. We use paid or business tiers where available and rely on providers' zero-retention or no-training terms where they offer them.
- Cerebras (US), our primary provider.
- NVIDIA (US) and Groq (US), fallbacks, used when the primary is unavailable.
- Google Gemini paid tier (US), configured as a further fallback but not currently part of the active chain. If we ever activate it we would use only the paid API tier, where inputs are not used to train Google's models; we never use the free tier.
- Resend (US), when you use "Email my CV", your account email address and the complete rendered CV or cover letter are sent through Resend in order to deliver that email.
Search and listings: these providers receive search terms, never your account record, CV or chat.
- Tavily (US), web search used to find events and opportunities. Receives query strings derived from your target sector and location, and, only where you have stated a gender, a gender-derived hint.
- Adzuna and Reed (UK), job-listing APIs. Receive job-search terms derived from your target role, sector and location.
- Greenhouse and Lever job boards, we fetch public employer job boards; these requests contain no user data.
- Reddit (US), used to ground interview-simulation questions in real reported ones. Receives search queries containing a target job title and company.
Each of these providers acts as our processor: they may use your data only to deliver their service to us, not for their own purposes. We choose paid or business tiers specifically because those terms prohibit training on the inputs we send.
We are in the process of putting formal data processing agreements in place with each provider, and this is not yet complete for all of them. If you want to know the current position for a particular provider before you use a feature, email contact@pathwei.ai and we will tell you.
If you ask us for help, a member of the Pathwei team may look at your account (your plan, your path and your progress, never your CV text or your chats) to sort it out. Every look is logged.
A small number of Pathwei staff can see account email addresses to keep accounts secure and help with sign-in problems. Every view is logged.
We previously listed OpenRouter as a fallback inference provider. It has been removed from the service and receives no data.
6. International transfers
We host your core data with Supabase and AWS in the UK (London region) to keep it in the UK by default.
Several of the providers above are based in the United States: our AI inference providers (Cerebras, NVIDIA, Groq, and Gemini if activated), Resend for email, Tavily for web search, and Reddit for interview-question search. When our backend sends your CV text, chat messages, stated gender label, rendered CV document or profile-derived search terms to those services, that is a transfer of personal data outside the UK.
We are being straightforward about where we are with this. Putting the formal UK transfer safeguards in place, a UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses with the UK Addendum, or reliance on a provider's certification under the UK Extension to the EU–US Data Privacy Framework where they hold one, is work in progress, and it is not yet complete for every provider named above.
In the meantime we limit what leaves the UK:
- Your core record, account, profile, CV files, chat history and test results, is stored in the UK and stays there.
- The US providers receive only what is needed to answer a specific request, at the moment you make it, and we do not send your name, email address or account identifier alongside it. The one exception is Resend, which necessarily receives your email address and your CV document when you ask us to email your CV to you.
- The search providers (Tavily, Reddit) receive query terms only, never your account record, CV or chat.
- We use paid or business tiers whose terms prohibit training on our inputs, and rely on providers' zero-retention terms where they offer them.
You can ask us at any time which safeguard is in place for a specific provider, using the contact details in Section 1. If you would prefer your data not to be processed by these providers at all, you can withdraw your consent to AI processing in the app (Section 8) and the features that use them will stop.
7. How long we keep your data
We keep your personal data for as long as your account is active, so that the app works and your history is available to you. Two things expire sooner:
- What Wei remembers. The conversational notes described in Section 3 are given a lifespan of about 90 days and are deleted automatically by a nightly job once they expire. You can delete them yourself at any time, sooner.
- Early access data. Where we run a time-limited early access or pilot programme, data associated with that programme is deleted within 30 days of the programme ending, unless you continue as a general-release user.
When you delete your account, or ask us to erase your data, we carry out a hard delete: your authentication record, all of your database rows, and all of your stored files are permanently removed. We do not use soft-deletion or anonymisation as a substitute for deletion. Copies held in routine backups are removed in line with our backup cycle.
See Delete your account and Delete your data for how to do this.
8. Your rights
As a UK data subject you have the following rights. You can exercise any of them by emailing contact@pathwei.ai, and several of them directly in the app.
| Right | How to exercise it |
|---|---|
| Access: obtain a copy of your personal data | In the app: Profile → Privacy → Request export (JSON). Or email us. |
| Rectification: correct inaccurate data | Edit it in the app, or email us. |
| Erasure: the "right to be forgotten" | In the app: Profile → Privacy → Delete all my data. Or email us. This performs a hard delete. See Delete your account. |
| Restriction: limit how we process your data | Email us. |
| Data portability: receive your data in a machine-readable format | Profile → Privacy → Request export produces JSON. Or email us. |
| Objection: object to certain processing | Email us. |
| Withdraw consent: stop AI processing at any time | In the app: Profile → Privacy → AI processing consent → Withdraw consent. Or email us. |
About withdrawing consent. Withdrawal takes effect on our servers within about a minute, after which the features that rely on AI processing, coaching chat, CV analysis and building, the career test and the interview simulation, stop working for your account. You can re-grant consent in the same place at any time. Withdrawing consent does not delete data we already hold: if that is what you want, use account deletion or a data deletion request. Withdrawal does not affect the lawfulness of processing we carried out before you withdrew.
Your export covers every table that holds data about you, including the notes Wei keeps, your credit history, your paths and your saved opportunities.
We will respond to any request within one calendar month.
9. Automated processing and profiling
Pathwei uses AI models to generate career-coaching scores, path recommendations and feedback based on your CV, your psychometric answers and your chat messages. This involves automated processing and, in some respects, profiling.
We rely on your explicit consent, captured in the app, as the safeguard for this processing. You have the right to withdraw that consent and stop AI processing of your data at any time, to ask for human review of any automated output, and to object to a purely automated decision that produces a legal or similarly significant effect on you. To ask for human review, email contact@pathwei.ai.
Our scores and recommendations are guidance, not decisions about you. They do not determine access to employment, education or any service.
10. Security
We take reasonable steps to protect your data, including:
- encrypting data in transit using TLS,
- encrypting data at rest,
- Row-Level Security, so each user can only access their own data,
- rate limiting on our API endpoints,
- restricting database access to authorised roles only, and
- checking consent on our servers before any AI processing.
What is in our logs. Our operational logs contain your pseudonymous user ID, an opaque identifier, never your name or email address, together with short diagnostic messages the app sends when something goes wrong on your device, which are capped in length and sanitised. Where the opportunity-search feature filters by gender, the stated label appears in those server logs. Passwords, secrets, CV content and chat content are never written to logs. Logs are held in our hosting provider's log service in the London region and are accessible only to us.
11. Children
Pathwei is intended for adults aged 18 and over. You cannot create an account without confirming that you are 18 or over, and that confirmation is recorded with your consent entry. Users who registered before this check existed are asked to confirm at their next sign-in.
This is a self-declaration, not identity verification. If you believe someone under 18 has registered, please contact us at contact@pathwei.ai so that we can delete their data.
12. Cookies and the website
The Pathwei app itself does not use advertising cookies. Our website, pathwei.ai, may use essential cookies needed for the site to function, and where required will ask for your consent before setting any non-essential cookies.
When you arrive through a partner's link or QR code, we count which link brought the visit, using a random anonymous ID stored on your device for 30 days; turn this off with Usage analytics in Settings, Privacy.
When you join through a friend's invite link, your device keeps their code for up to 30 days and we record who invited you, so your friend can earn a discount. They see how many of the people they invited have joined and taken part, never who they are or what you do on Pathwei.
We also count visits to the website as daily totals. These use no ID: your device keeps only the date of its last visit, so a device counts once a day. The same setting turns this off.
13. Changes to this policy
We may update this policy from time to time, for example as the app develops or as our providers change. When we make a material change we will notify you by email or through an in-app notification, update the "Last updated" date at the top of this page, and, where the change affects what you consented to, ask you to review and accept the new version in the app.
14. How to complain
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We would always like the chance to resolve your concern first, so please email contact@pathwei.ai before contacting the ICO.
Questions about this policy? contact@pathwei.ai