Privacy Notice

Who operates MyPathPlan

MyPathPlan is an independent digital career-planning service. In everyday use of the product - navigation, on-screen messages, and account emails - you will only ever see the MyPathPlan brand. For who is legally responsible for your personal data, and how to reach us with privacy questions, see Controller and contact below.

Controller and contact

MyPathPlan is an independent digital service operated in Poland by Reza Gholami, who is the data controller for personal data processed through the service.

Privacy and data-rights requests: privacy@mypathplan.com

Categories of data we collect

Depending on how you use MyPathPlan, we may process: your account email address; authentication and session data (such as a session identifier, needed to keep you signed in); your Professional Profile and career information (name, role, work history, education, skills, and similar details you enter or choose to save); information derived from a CV you upload; your career target; skill-gap and roadmap information generated from your profile and target; progress and evidence text you write about completed work; and essential technical/security data needed to operate the service safely (such as basic request and error information).

How we obtain your data

Most data comes directly from you - when you create an account, fill in your Profile, upload a CV, set a career target, or write evidence of your progress. Some information (such as a skill-gap analysis or a roadmap) is generated by MyPathPlan's systems, with AI assistance, based on the information you have provided.

Why we process your data

We process your data to operate the core features of MyPathPlan: creating and managing your account, building your Professional Profile, generating career-target, skill-gap, and roadmap suggestions, tracking your own reported progress, sending essential account emails (such as a password-reset message), and keeping the service secure and reliable.

Legal basis for processing

In general terms: processing needed to provide the features you use is based on the performance of our contract with you (our Terms of Use). Certain processing - such as basic security logging - is based on our legitimate interest in keeping the service reliable and secure, balanced against your rights. Where we are subject to a legal obligation (for example, responding to a lawful authority request), processing is based on that obligation. We do not currently rely on consent as the basis for the core features described in this Notice; if we ever introduce a genuinely optional feature that requires your consent, we will ask for it separately and clearly at that time.

How CV upload works

When you upload a CV, the file is processed entirely in memory to extract its text. MyPathPlan does not intentionally keep a permanent or temporary copy of the uploaded file itself after this process completes. The information extracted from your CV is shown to you as a draft for review - nothing is saved to your Profile unless and until you choose to review and save it.

How AI is used

MyPathPlan uses OpenAI's API to help extract information from CVs and to generate career-related suggestions (such as skill-gap analysis and roadmap content) from your saved Profile and career information. Before CV text is sent to OpenAI, MyPathPlan automatically removes common patterns such as email addresses, phone numbers, and web links where they can be reliably detected. This automated step reduces, but cannot guarantee the removal of, every personal detail - we recommend removing anything from your CV that you would rather not have processed before uploading it. We configure these requests so that OpenAI does not use them to train or improve its own models.

Service providers we use

We use a small number of external service providers to operate MyPathPlan, each for a specific purpose: OpenAI, for AI-assisted extraction and generation features described above; Render, for hosting the application, its database, and associated logs and backups; Resend, for sending transactional account emails such as password resets; and Cloudflare, for DNS, TLS (secure connections), and proxy/security protection in front of our servers. We do not sell your data, and we do not share it with any third party for that party's own independent advertising or marketing purposes.

International data transfers

Our hosting infrastructure is located in the EU (Frankfurt, Germany). Some of our service providers, or their own sub-processors, may process data outside the European Economic Area, including in the United States. Where this occurs, applicable contractual and legal safeguards for international transfers - such as the Standard Contractual Clauses or the EU-U.S. Data Privacy Framework - apply as required by law.

How long we keep your data

We keep your account and Profile data for as long as your account remains active. If you would like your account and its data deleted, please contact privacy@mypathplan.com and we will act on your request. Operational logs and backups maintained by our hosting and email providers are kept only for as long as necessary for the purposes described in this Notice, in line with those providers' own data-retention practices.

Your rights

Subject to applicable data-protection law, you generally have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion, request restriction of processing, object to certain processing, and request portability of certain data. To exercise any of these rights, please contact privacy@mypathplan.com. You also have the right to lodge a complaint with the Polish supervisory authority, the Urząd Ochrony Danych Osobowych (UODO), or with the supervisory authority in your own EU/EEA country of residence.

Security

We take reasonable technical and organizational measures to protect your data, including encrypted connections, hashed passwords, and access limited to what is necessary for operating, securing, and supporting the service. No system can be guaranteed to be completely secure, and we do not claim otherwise.

Adult use only

MyPathPlan is intended for use by adults aged 18 and over. We do not knowingly collect data from anyone under 18.

Changes to this Notice

We may update this Privacy Notice from time to time. A new version will carry a new version identifier and effective date. If you have an account, we will ask you to acknowledge a materially updated Notice before you continue using MyPathPlan.

Contact

For any question about this Notice or about your data, please contact privacy@mypathplan.com.