Privacy Policy

1. Introduction

NexPath Oy ("we," "our," or "us") operates the NexPath career guidance platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

We are committed to protecting your privacy and ensuring GDPR compliance. We believe in transparency about our data practices and your rights.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, organization affiliation
• Assessment Data: Responses to career assessments, interests, values, work styles
• Profile Information: Educational background, career goals, demographic data (optional)
• Communication Data: Messages sent through our platform, support requests

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, click patterns
• Device Information: Browser type, device type, operating system, IP address
• Cookies: Session management, preferences, analytics (see Cookie Policy)

3. How We Use Your Information

We use your information to:

• Provide personalized career guidance and recommendations
• Analyze assessment responses using our scoring engine (RIASEC, Work Adjustment Theory and related psychometric methods)
• Generate reports for counselors and administrators (when authorized)
• Improve our algorithms and platform functionality
• Communicate important updates, new features, or support responses
• Comply with legal obligations and prevent fraud

3.1 How We Use Artificial Intelligence

Your assessment is scored by a deterministic, rule-based engine — the calculations that produce your profile and career matches are mathematics, not AI. We use third-party artificial-intelligence services in a limited, supporting role only:

• Narrative interpretation: to phrase the already- computed results in clear, readable language.
• Counselor assistant (NexPilot™): to help counselors explore a participant's completed profile and general, publicly available career and legislative information.

The AI does not perform or alter the assessment scoring, and it works from qualitative profile information rather than your raw numeric scores. AI processing is carried out by our AI sub-processor (see §4.2). We are progressively minimizing the personal data included in AI requests.

4. Data Sharing and Disclosure

4.1 Within Your Organization

If you access NexPath through a school or organization, authorized counselors and administrators can view your assessment results and progress. Individual response data is aggregated for organizational insights.

4.2 Sub-processors

We rely on a small set of vetted service providers ("sub-processors") to operate NexPath. Each is bound by a data-processing agreement and processes your data only on our instructions:

• Hosting & infrastructure: Hetzner Online — servers located in Helsinki, Finland (EU), where your account and assessment data are stored.
• Network, edge & backup storage: Cloudflare — DNS, TLS termination, and R2 object storage holding our encrypted database backups.
• Authentication: Supabase — sign-in and social login only. No assessment data is stored there.
• Artificial intelligence: OpenRouter — routes requests to large language models to generate narrative interpretations and power the counselor assistant (see §3.1).
• Email: Resend — transactional email (account, consent and notification messages).
• Payments: Stripe — payment processing. Stripe receives payment-card details, billing address and email to process the transaction; NexPath does not store card numbers.
• Error monitoring & logging: Sentry and Better Stack — capture technical error and log data to keep the service reliable and secure.

All sub-processors are contractually obligated to protect your data under GDPR standards. A current list is maintained in our Trust Center; we will notify customers of material changes.

4.3 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights, safety, or the safety of others.

5. Data Security

We implement industry-standard security measures:

• Encryption in transit (TLS 1.2+) for all connections, including to our databases
• Database backups encrypted at rest and stored separately from the live system (at-rest encryption of the primary database volume is being rolled out)
• JWT-based authentication and least-privilege access controls; administrative access only over secured, non-public channels
• EU-hosted, single-tenant infrastructure with strict network isolation and firewalling
• Continuous monitoring, off-site log aggregation, tested backups, and a documented incident-response process

6. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure ("Right to be Forgotten"): Request deletion of your data
• Portability: Export your data in machine-readable format (JSON)
• Restrict Processing: Limit how we use your data
• Object: Opt-out of certain data uses (e.g., marketing)
• Withdraw Consent: Revoke consent at any time

To exercise these rights, contact us at [email protected] or use the account settings within the platform.

7. Data Retention

• Account & assessment data: retained while your account is active, and deleted when you delete your account or your data.
• Deleted accounts: when you confirm deletion, your personal data is permanently and irreversibly deleted from our systems — including from our authentication provider — without undue delay, except where we are legally required to retain specific records (below).
• Billing data: invoices, payment records and transaction history are retained for 6 years as required by Finnish accounting law (Kirjanpitolaki 1336/1997).
• Unconfirmed minor accounts: where parental consent is requested but not confirmed within 7 days, the account is deleted automatically.

8. Children's Privacy

NexPath processes minors' data only in a school or guidance context, or with appropriate consent. For users under 16, we require verifiable parental consent — or, where a school acts as the data controller, the school's authorization — before their assessment data is processed, in line with GDPR Article 8. Where parental consent is requested but not confirmed within 7 days, the account and its data are automatically deleted. The traits we measure are limited to career interests and personality; we do not collect special-category data.

9. International Data Transfers

Your account and assessment data are hosted within the EU, on servers located in Helsinki, Finland. Some of our sub-processors (for example AI processing, payments, and error monitoring) may process limited data outside the EU. Where they do, such transfers are governed by the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated via email or in-app notification.

11. Contact Us

For privacy inquiries, data requests, or complaints: