Privacy Policy

1. Introduction

NexPath Oy ("we," "our," or "us") operates the NexPath career guidance platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

We are committed to protecting your privacy and ensuring GDPR compliance. We believe in transparency about our data practices and your rights.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, organization affiliation
• Assessment Data: Responses to career assessments, interests, values, work styles
• Profile Information: Educational background, career goals, demographic data (optional)
• Communication Data: Messages sent through our platform, support requests

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, click patterns
• Device Information: Browser type, device type, operating system, IP address
• Cookies: Session management, preferences, analytics (see Cookie Policy)

2.3 Social Media

We post on our own pages and profiles (for example Instagram, Facebook, Threads, YouTube, LinkedIn, TikTok, X, Bluesky and Telegram). When you comment on or react to our posts, we can see your public name, your comment and the time, and we use them only to moderate, to answer, and to count how many people took part. We keep comment text for at most 30 days and the counts for as long as they are useful. We do not build profiles of commenters and we do not combine comments with any NexPath account. Each platform also handles your data under its own privacy policy. To ask us to delete a comment or any data we hold about you from social media, write to privacy@nexpath.eu.

3. How We Use Your Information

We use your information to:

• Provide personalized career guidance and recommendations
• Analyze assessment responses using our scoring engine (RIASEC, Work Adjustment Theory and related psychometric methods)
• Generate reports for counselors and administrators (when authorized)
• Improve our algorithms and platform functionality
• Communicate important updates, new features, or support responses
• Comply with legal obligations and prevent fraud

3.1 How We Use Artificial Intelligence

Your assessment is scored by a deterministic, rule-based engine — the calculations that produce your profile and career matches are mathematics, not AI. We use third-party artificial-intelligence services in a limited, supporting role only:

• Narrative interpretation: to phrase the already- computed results in clear, readable language.
• Counselor assistant (NexPilot™): to help counselors explore a participant's completed profile and general, publicly available career and legislative information.
• Career chat, resume builder and skill-gap analysis: to answer questions and draft text from your profile and from what you type or import.

The AI does not perform or alter the assessment scoring. To do its work it can receive your answers and the details you give, such as age, country and gender, your assessment results (including scores), and the text you type into AI features; your name, email address and username are removed before a request is sent. AI processing is carried out by our AI sub-processor (see §4.2), which we instruct to use only providers that do not collect or train on the content. The Trust Center's AI page lists every AI feature and what it receives.

4. Data Sharing and Disclosure

4.1 Within Your Organization

If you access NexPath through a school or organization, authorized counselors and administrators can view your assessment results and progress. Individual response data is aggregated for organizational insights.

4.2 Sub-processors

We rely on a small set of vetted service providers ("sub-processors") to operate NexPath. Each is bound by a data-processing agreement and processes your data only on our instructions:

• Hosting & infrastructure: Hetzner Online — servers located in Helsinki, Finland (EU), where your account and assessment data are stored.
• Network, edge & backup storage: Cloudflare — DNS, TLS termination, and R2 object storage holding our encrypted database backups.
• Authentication: Supabase — sign-in and social login only. No assessment data is stored there.
• Artificial intelligence: OpenRouter — routes requests to large language models to generate narrative interpretations and power the counselor assistant (see §3.1).
• Email: Resend — transactional email (account, consent and notification messages).
• Newsletter & contact forms: Loops (United States) — receives the name, email address and organisation you submit through our newsletter and contact forms, to send you what you asked for. Transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework (§9).
• Website analytics (only with your consent): Google Analytics and Google Tag Manager — page-usage measurement on this website. Nothing is sent until you accept analytics cookies in the cookie banner (see the Cookie Policy).
• Payments: Stripe — payment processing. Stripe receives payment-card details, billing address and email to process the transaction; NexPath does not store card numbers.
• Error reporting (Sentry): when something breaks, we receive a technical error report so we can fix it. It can sometimes include personal data, such as your account ID. It is always on and sets no cookies.
• Logging: Better Stack — captures technical log data to keep the service reliable and secure.

All sub-processors are contractually obligated to protect your data under GDPR standards. A current list is maintained in our Trust Center; we will notify customers of material changes.

4.3 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights, safety, or the safety of others.

Billing and payment details (organisation name, the name and email of the person who pays, and amounts) are shared with our accounting firm in Finland so that we can meet our statutory accounting and tax obligations.

5. Data Security

We implement industry-standard security measures:

• Encryption in transit (TLS 1.2+) for all connections, including to our databases
• Database backups encrypted at rest and stored separately from the live system; the primary database volume is encrypted at rest (LUKS2)
• JWT-based authentication and least-privilege access controls; administrative access only over secured, non-public channels
• EU-hosted, single-tenant infrastructure with strict network isolation and firewalling
• Continuous monitoring, off-site log aggregation, tested backups, and a documented incident-response process

6. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure ("Right to be Forgotten"): Request deletion of your data
• Portability: Export your data in machine-readable format (JSON)
• Restrict Processing: Limit how we use your data
• Object: Opt-out of certain data uses (e.g., marketing)
• Withdraw Consent: Revoke consent at any time

To exercise these rights, contact us at privacy@nexpath.eu or use the account settings within the platform.

7. Data Retention

• Account & assessment data: retained while your account is active, and deleted when you delete your account or your data.
• Deleted accounts: when you confirm deletion, your personal data is permanently and irreversibly deleted from our systems — including from our authentication provider — without undue delay, except where we are legally required to retain specific records (below).
• Billing data: invoices, payment records and transaction history are retained for 6 years as required by Finnish accounting law (Kirjanpitolaki 1336/1997).
• Unconfirmed minor accounts: where parental consent is requested but not confirmed within 7 days, the account is deleted automatically.

8. Children's Privacy

NexPath processes minors' data mainly in a school or guidance context. When a school or organisation uses NexPath, it decides whether a parent's or guardian's consent is needed for users under 16. Where it requires consent, we ask a parent or guardian to confirm, and if no one confirms within 7 days, the account and its data are deleted. If you are under 16 and use NexPath on your own, please ask a parent or guardian before you start. The traits we measure are limited to career interests and personality, and we do not ask for special-category data.

9. International Data Transfers

Your account and assessment data are hosted within the EU, on servers located in Helsinki, Finland. Some of our sub-processors (for example AI processing, payments, and error monitoring) may process limited data outside the EU. Where they do, such transfers are governed by the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated via email or in-app notification.

11. Contact Us

For privacy inquiries, data requests, or complaints: