PathrovaBack to PathrovaPrivacy Notice
Version 1.4 · Effective: 5 October 2026 · Last updated: 3 November 2026 — Launch interest and notifications
1. Who we are
Pathrova is a career-management service operated by Bhupinder Singh Virdi, a sole trader trading as Pathrova (referred to as “Pathrova”, “we”, “us” or “our”). We are the controller of the personal data described in this notice.
Contact address: Pathrova, The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY, England Privacy enquiries and rights requests: privacy@pathrova.com General support: support@pathrova.com Website: https://pathrova.com/
ICO registration: ZC259031
This notice explains how we use personal data when you visit our website, use the Pathrova web or mobile app, contact us, or pay for a Pathrova plan.
2. The short version
• Pathrova helps individual users organise career information, analyse job descriptions, compare roles with a CV, receive AI-assisted insights, track applications and create tailored CVs.
• We use your information to provide those services, secure your account, process payments and meet our legal obligations.
• We do not sell personal data and we do not use it for third-party advertising.
• Pathrova uses OpenAI’s API for AI-assisted features. AI output can be wrong or incomplete and must be checked by you.
• Do not enter health, disability, ethnicity, religion, trade-union membership, sexual-orientation or other special-category information into AI features. Contact privacy@pathrova.com first if you believe this is necessary.
• You can request access, correction, deletion or another data-protection right through Settings > Privacy and Security > Make a privacy request, or by emailing privacy@pathrova.com.
• You can delete your account through Settings > Privacy and Security > Delete Account.
3. Personal data we collect
We collect the following categories where they are relevant to your use of Pathrova.
| Category | Examples |
|---|---|
| Account and identity data | Name, email address, password credentials managed through Supabase, account identifiers, plan and account status |
| Contact and CV details | Telephone number, location used in a CV, LinkedIn or portfolio links, and an optional profile photograph. A photograph is not required and is not currently used by Pathrova features |
| Career data | Professional summary, work history, job titles, employers, achievements, skills, qualifications, education, courses, certifications and other CV content |
| Uploaded and generated content | Uploaded CVs and job descriptions; application notes; AI prompts created from your inputs; AI analysis, matching results, insights and tailored CV content |
| Application data | Roles, employers, job descriptions, application status, dates, reminders and application history |
| Subscription and transaction data | Plan, subscription status, Stripe customer and transaction references, billing status and limited payment metadata. Pathrova does not receive or store full payment-card details |
| Communications | Support enquiries, privacy requests, feedback and related correspondence |
| Technical and security data | IP address, device and browser information, login and session events, request and error logs, security events and abuse-prevention signals |
| Preferences | Theme, interface state, notification choices and marketing preferences |
Pathrova does not ask for your date of birth, salary expectations or relocation preferences at launch.
4. How we collect personal data
We collect information:
• directly from you when you register, complete your profile, upload or enter content, track an application, contact us, make a privacy request or buy a plan;
• automatically when you use Pathrova, including authentication, device, request, security and diagnostic information;
• from service providers, including subscription and payment status from Stripe and authentication or delivery events from Supabase and Resend; and
• when you ask Pathrova to process a CV, job description or other material that contains information about another person. You must have the right to provide that information.
5. Why we use personal data and our lawful bases
| Purpose | Data typically used | UK GDPR lawful basis |
|---|---|---|
| Create and operate your account | Account, contact, preference and technical data | Performance of our contract with you |
| Provide CV, job-matching, gap-analysis, AI-insight, application-tracking and tailored-CV features | Career data, uploaded content, application data, prompts and outputs | Performance of our contract with you |
| Provide free features before a paid contract is entered into | Account, career and usage data | Taking steps at your request before entering into a contract; and our legitimate interests in operating the service where appropriate |
| Process subscriptions, payments, cancellations and refunds | Account, plan, transaction and billing data | Performance of our contract; compliance with legal obligations |
| Keep Pathrova secure, prevent fraud and misuse, investigate incidents and enforce our Terms | Account, technical, security and content data where necessary | Our legitimate interests in protecting users, Pathrova and our providers; compliance with legal obligations where applicable |
| Respond to support enquiries and service messages | Account, communications and relevant service data | Performance of our contract; our legitimate interests in supporting users and improving the service |
| Handle privacy requests, complaints, tax, accounting and legal claims | Account, communications, transaction and relevant service data | Compliance with legal obligations; establishment, exercise or defence of legal claims; our legitimate interests |
| Send occasional career-guidance and Pathrova-tip emails | Name, email and email preferences | Our legitimate interests in supporting users who have been clearly informed and can opt out, where electronic-marketing law permits; consent where required |
| Send promotional or Pro product-update emails | Name, email and marketing preferences | Consent. You can withdraw consent at any time |
| Improve reliability, accessibility and usability | Aggregated or appropriately minimised usage, error and feedback data | Our legitimate interests in improving Pathrova, balanced against your rights |
Where we rely on legitimate interests, we assess whether the use is necessary and whether your rights and interests override ours. You may object to processing based on legitimate interests; see section 15.
6. AI-assisted features
Pathrova uses the OpenAI API to help parse and structure CV information, compare a CV with a job description, identify evidence and gaps, generate career insights and prepare tailored CV content.
When you use these features:
• relevant career data, CV content, job-description content and instructions may be sent to OpenAI for processing;
• Pathrova may store the prompts and AI outputs in your account so the feature works, results can be displayed again and you can manage your career record;
• current Pathrova API requests use OpenAI’s Responses API with storage disabled for the request;
• OpenAI states that API data is not used to train its models by default. OpenAI may retain limited abuse-monitoring logs for up to 30 days unless a different legal or security requirement applies; and
• Pathrova does not create automated decisions that produce legal or similarly significant effects. Scores and insights are advisory tools for you and are not decisions about whether you will obtain employment.
AI-generated information may be inaccurate, incomplete or unsuitable. Check every output before using, downloading or sharing it. Pathrova does not promise interviews, offers, employment or any particular career outcome.
6a. Public CV sharing
Public CV sharing is optional. The profile owner chooses which CV sections and contact details to publish and creates a revocable, expiring link. The link does not make the CV searchable or reveal its content by itself: a viewer must verify their email and receive the owner's approval before the selected profile is returned. The owner can remove access, revoke the link or replace it. A link expires after 30 days unless the owner extends it.
Before requesting access, viewers are told that their name, verified email address and optional phone number will be disclosed to the profile owner. We also record the disclosure acknowledgement, verification time and viewing activity to operate the access controls and let the owner manage access. This is not permission for marketing. Sharing is used to provide the requested service and protect the owner's CV; it is not an automated hiring decision.
Pathrova automatically manages viewer-record retention in the background. Viewer names, contact details and viewing records are scheduled for deletion 90 days after the most recent successful email verification, even when access was approved. A daily cleanup removes expired records and their sessions. A minimal approval record keyed by a hash of the verified email is retained separately until revoked, any configured approval expiry, link revocation/replacement or account deletion; this lets a returning viewer verify again without repeating owner approval. The owner can remove all approvals from the sharing controls. A new verification creates a fresh disclosed viewer record.
The profile owner's Download my data file includes their saved public profile, sharing settings and retention information, link metadata, access requests, approval metadata and viewer contact details and viewing records still held for their profile. Each retained viewer record includes its scheduled deletion date. Sharing tokens, email hashes, verification codes and session secrets are excluded. Records already deleted by cleanup or removal cannot be reconstructed through a data download or access request.
Verification codes expire after 10 minutes, pending access requests expire after no more than seven days and verified browser sessions last no more than 12 hours or the remaining link lifetime. Expired/used codes and expired/revoked sessions become eligible for cleanup after 24 hours; request and abuse-prevention records also have scheduled cleanup. Deleting the owner's account removes its sharing data. Contact support@pathrova.com for questions or a request concerning your viewer information.
7. Special-category and highly sensitive information
Career documents can contain information about health, disability, ethnicity, political or religious beliefs, trade-union membership, genetics, biometrics, sex life or sexual orientation. This is “special-category data” under UK data-protection law. Documents may also contain criminal-offence information.
Pathrova is not designed to require this information and does not use it to infer or score your employability. Pathrova does not currently offer a feature that requires special-category or criminal-offence information. Do not provide it to Pathrova's AI features. Remove or redact it before uploading a CV, job description or prompt.
Uploading or entering special-category or criminal-offence information does not count as explicit consent. Pathrova does not rely on an upload, prompt or other use of the service as consent under Article 9 of the UK GDPR or as consent for criminal-offence data.
If we identify such information, we may stop the relevant processing, restrict or remove the material, or ask you to provide a redacted copy. We will not deliberately use special-category or criminal-offence information unless we have first identified and documented an appropriate lawful basis and additional UK GDPR or Data Protection Act 2018 condition.
8. Payments and subscriptions
Paid plans are processed through Stripe-hosted or Stripe-managed payment pages. Stripe receives payment details directly. Pathrova receives information such as your Stripe customer reference, product or plan, payment and subscription status, renewal or expiry dates and limited transaction details.
The checkout page identifies the seller and relevant payment entity. Stripe processes personal data under its own privacy information and may also act as a processor for Pathrova for particular payment functions.
Deleting your Pathrova account triggers an attempt to cancel an active Stripe subscription immediately before deletion. If cancellation cannot be confirmed, account deletion stops and Pathrova will tell you how to retry or contact support, helping prevent charges after the account is removed.
9. Browser storage and similar technologies
Pathrova currently uses only storage needed to operate, secure or remember the user interface. We have not implemented advertising or analytics tracking at launch.
| Technology or storage | Purpose | Typical duration |
|---|---|---|
| Supabase authentication storage | Keeps you signed in, maintains and refreshes your authenticated session and supports account security | Session or until sign-out/expiry; longer only if “keep me signed in” is selected |
| Local or session storage | Temporary interface state, navigation state and service continuity | Session or until cleared/replaced |
| Theme preference | Remembers light, dark or system appearance | Until changed or browser storage is cleared |
| Stripe checkout storage | Security, fraud prevention, checkout continuity and payment preferences on Stripe-hosted pages | Controlled by Stripe and described in Stripe’s information |
| Cloudflare Turnstile | Confirms that authentication requests are made by a person and helps prevent abuse | Short-lived security data as determined by Cloudflare |
Because these uses are currently necessary for the service, security or a requested appearance preference, Pathrova does not show a consent banner solely for them. We will update this notice and introduce consent controls before adding non-essential analytics, advertising or similar technologies where consent is required.
10. Who we share personal data with
We disclose personal data only as needed to operate Pathrova, follow your instructions, protect the service or comply with law.
| Provider or recipient | Main role | Information involved |
|---|---|---|
| Supabase | Authentication, database, storage and backend services in the West EU (Ireland) region | Account, career, uploaded, application, session and technical data |
| OpenAI | AI processing through the API | Relevant CV, career, job-description, prompt and output data |
| Stripe | Checkout, payments, subscription management, fraud prevention, refunds and billing | Identity, contact, plan, payment and transaction data |
| Resend | Transactional and service-email delivery | Name, email address, message content and delivery events |
| Apple iCloud Mail | Mail hosting for support and privacy correspondence | Names, email addresses, message content and attachments sent to those addresses |
| Cloudflare | Turnstile bot and abuse protection; encrypted backup storage | IP address, device/browser and security signals; encrypted backup copies of service data |
| OpenAI (ChatGPT Sites) | Current website hosting and delivery | Website request, device and network data |
| Namesco (Names.co.uk) | Domain registration and DNS services; email routing where configured | Domain-management and limited routing/technical data |
| Duport Associates Limited | Business-address and physical-mail handling | Physical correspondence addressed to Pathrova and sender details contained in it |
| Professional advisers, authorities or a buyer of the business | Legal, regulatory, accounting, insurance, claims or a genuine business reorganisation | Only information reasonably necessary for the relevant purpose |
We do not sell or rent personal data. We do not disclose career data to employers or recruiters unless you choose to download, share or send it yourself.
11. International transfers
Some providers, including OpenAI, Supabase, Stripe, Resend, Cloudflare and website or email infrastructure providers, may process personal data outside the United Kingdom. Where UK data-protection law requires safeguards, we rely on an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. You may ask privacy@pathrova.com for information about the safeguard relevant to your data.
As at 4 October 2026, the published transfer terms for our principal providers include the following. We review these arrangements when a provider updates its terms.
OpenAI: its data processing addendum incorporates the UK Addendum to the EU Standard Contractual Clauses for relevant UK transfers.
Supabase: Pathrova's primary project is hosted in the West EU (Ireland) region. Supabase's data processing agreement incorporates the UK Addendum for relevant processing outside the UK.
Stripe: its Data Transfers Addendum provides UK international-transfer safeguards, including the UK Addendum where applicable.
Resend: its data processing agreement uses the EU Standard Contractual Clauses as amended by the UK Addendum for relevant UK transfers.
Cloudflare: its data processing addendum uses the EU Standard Contractual Clauses as amended by the UK Addendum and may also rely on an applicable adequacy framework.
For other overseas processing, we use the safeguard stated in the relevant provider terms or another lawful mechanism available under UK data-protection law.
12. How long we keep personal data
We keep information only for as long as reasonably needed for the purposes above, including legal, accounting, security and dispute requirements.
| Record | Retention |
|---|---|
| Active account, career, CV, application, prompt and AI-output data | For the account lifetime |
| Data following account deletion | Removed from active systems within 30 days, subject to a legal hold or another necessary exception |
| Backup copies following deletion from active systems | Deleted or overwritten within a further 30 days |
| Uploaded files replaced or removed by the user | Removed from active use promptly and from remaining systems according to the deletion and backup periods above |
| Support communications | 24 months after the matter closes |
| Security and technical logs | 12 months, or longer where reasonably necessary for an active investigation, dispute or legal duty |
| Personal-data breach and incident records | Six years from closure, subject to review and any longer legal requirement |
| Payment, tax and accounting records | Six years, or longer if required by law or an active dispute |
| Marketing records | Until consent is withdrawn or the contact is no longer used, plus a minimal suppression record so we respect an opt-out |
| Privacy requests and related correspondence | Normally six years from closure where needed to demonstrate compliance or manage a claim |
We may retain a restricted copy for longer if required by law, a court order, fraud prevention, an active complaint or the establishment, exercise or defence of legal claims. Where possible, we isolate that data and stop ordinary use.
13. Security
Pathrova uses organisational and technical measures designed to protect personal data. Measures implemented for launch include:
• email confirmation and strengthened password requirements;
• secure password and email-change controls;
• multi-factor authentication for administrator access;
• encrypted connections, including enforced SSL for database connections;
• Supabase Row Level Security and private access controls for user data and uploaded files;
• server-side storage of Supabase service credentials and OpenAI secrets;
• request rate limits and Cloudflare Turnstile abuse protection;
• logging and review of relevant security events; and
• a personal-data breach and incident-response procedure.
If a personal-data breach is likely to risk your rights and freedoms, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. If it is likely to result in a high risk, we will also notify affected people without undue delay unless an exception applies.
No service can guarantee absolute security. Use a unique password, protect your device and tell support@pathrova.com promptly if you suspect unauthorised access.
14. Children
Pathrova is for people aged 18 or over. We do not knowingly provide accounts to children. If you believe a person under 18 has provided data, contact privacy@pathrova.com.
15. Your data-protection rights
Depending on the circumstances, UK law gives you the right to:
• be informed about how personal data is used;
• request access to your personal data;
• ask us to correct inaccurate or incomplete data;
• ask us to erase personal data;
• ask us to restrict processing;
• object to processing based on legitimate interests or to direct marketing;
• receive data you provided in a portable format where the right applies;
• withdraw consent at any time, without affecting earlier lawful processing; and
• not be subject to a solely automated decision with legal or similarly significant effects.
Use Settings > Privacy and Security > Make a privacy request or email privacy@pathrova.com. We may need to verify your identity. We normally respond within one month, although the law permits an extension for a complex or numerous request. Rights are not absolute, and we will explain if an exemption applies.
You may also delete your account through Settings > Privacy and Security > Delete Account. Account deletion is different from some individual rights because it initiates closure of the service as well as deletion.
16. Email choices
Essential account, security and service messages—such as account confirmation, password reset, payment, subscription or material service notices—are necessary to operate your account and cannot be switched off while the relevant service is active.
For new accounts, occasional career-guidance and Pathrova-tip emails may be enabled by default where the signup screen clearly explains this. You can switch them off immediately in email preferences or use the unsubscribe link in a message. We do not activate these emails retrospectively for existing users without a recorded choice.
We send promotional or Pro product-update emails only after you make the separate optional choice to receive them. You can withdraw that consent at any time through email preferences, the unsubscribe link, or privacy@pathrova.com. Switching off optional emails does not stop essential service messages.
17. Complaints
privacy@pathrova.com is Pathrova's official contact for data-protection complaints. You can also submit a complaint through Settings > Privacy and Security > Make a privacy request.
We will acknowledge receipt of a complaint within 30 days. Without undue delay, we will investigate it, take appropriate steps, keep you informed and tell you the outcome. We may ask for information reasonably needed to understand the complaint or verify identity.
If you are unhappy with our outcome, you have the right to complain to the UK Information Commissioner's Office (ICO):
• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
18. Changes to this notice
We may update this notice when Pathrova, our providers or the law changes. We will post the current version with its last-updated date. If a change materially affects how we use personal data, we will provide a prominent in-service or email notice before it takes effect where appropriate.
19. Contact us
Privacy: privacy@pathrova.com Support: support@pathrova.com Post: Pathrova, The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY, England
Launch interest and notifications
If you ask to be notified when registration opens, we store your email address, request and confirmation dates, and your launch-notification choice separately from Pathrova accounts. We send a verification email through Resend. Confirming joins the launch list only: it does not create an account or start welcome, onboarding, career-guidance or promotional email sequences. We will send one separate launch announcement when registration opens.
You can withdraw your launch-notification choice using the link in the email. Existing account preferences are unchanged. Unconfirmed requests are removed after seven days without another request. Launch-list records are kept for no longer than twelve months. Short-lived hashed request identifiers help prevent automated abuse. For access, correction or deletion of launch-list data, contact privacy@pathrova.com.