Legal

Privacy Policy

Last updated: March 28, 2025 · GDPR Compliant

Plain English Summary: We collect only what's needed to run PMPath. We never sell your data. You can export or delete everything at any time from your Settings page.

Your Data Rights (GDPR)

Right to Access

Request a copy of all personal data we hold about you.

Right to Portability

Export your data in a machine-readable format (JSON) from Settings.

Right to Erasure

Request deletion of your personal data at any time.

Right to Object

Object to certain types of data processing, including marketing.

Export My Data Email Privacy Team

What Data We Collect

•Account information: name, email address, password (hashed using bcrypt), and optional profile fields.
•Learning data: course progress, quiz scores, module completions, streaks, and badges.
•Community data: forum posts, replies, and upvotes.
•Usage data: pages visited, features used, and session duration (anonymised and aggregated).
•Device information: browser type, operating system, and IP address for security purposes.

How We Use Your Data

•To provide and improve the PMPath learning platform.
•To personalise content recommendations and learning paths.
•To send transactional emails (account confirmation, password reset, progress updates).
•To send marketing emails only where you have explicitly opted in.
•To detect and prevent fraud, abuse, and security threats.
•To generate aggregated, anonymised analytics for platform improvement.

Data Sharing

•We do not sell your personal data to third parties. Ever.
•We use Stripe for payment processing. Stripe handles all card data — we never store it.
•We use analytics services (aggregated data only, no individual tracking).
•We may disclose data if required by law, court order, or to protect the safety of users.
•We share mentor match data only with the matched mentor and only with your consent.

Data Retention

•Account data is retained for as long as your account is active.
•After account deletion, personal data is removed within 30 days.
•Aggregated, anonymised analytics data may be retained indefinitely.
•Backup copies may persist for up to 90 days after deletion requests.

Cookies

•Authentication cookies: required for you to stay logged in.
•Preference cookies: store your settings (dark mode, language).
•Analytics cookies: anonymised usage tracking. You can opt out in Settings.
•We do not use third-party advertising cookies.

Security

•All data is transmitted over HTTPS with TLS encryption.
•Passwords are hashed using bcrypt — we cannot see your password.
•We conduct regular security audits and penetration testing.
•Access to user data by PMPath staff is logged and restricted to need.
•In the event of a data breach, we will notify affected users within 72 hours per GDPR requirements.

Questions About Privacy?

Our Data Protection Officer is available to answer any privacy-related questions.

privacy@pmpath.app

Your Data Rights (GDPR)

Right to Access

Request a copy of all personal data we hold about you.

Right to Portability

Export your data in a machine-readable format (JSON) from Settings.

Right to Erasure

Request deletion of your personal data at any time.

Right to Object

Object to certain types of data processing, including marketing.

What Data We Collect

•Account information: name, email address, password (hashed using bcrypt), and optional profile fields.

•Learning data: course progress, quiz scores, module completions, streaks, and badges.

•Community data: forum posts, replies, and upvotes.

•Usage data: pages visited, features used, and session duration (anonymised and aggregated).

•Device information: browser type, operating system, and IP address for security purposes.

How We Use Your Data

•To provide and improve the PMPath learning platform.

•To personalise content recommendations and learning paths.

•To send transactional emails (account confirmation, password reset, progress updates).

•To send marketing emails only where you have explicitly opted in.

•To detect and prevent fraud, abuse, and security threats.

•To generate aggregated, anonymised analytics for platform improvement.

Data Sharing

•We do not sell your personal data to third parties. Ever.

•We use Stripe for payment processing. Stripe handles all card data — we never store it.

•We use analytics services (aggregated data only, no individual tracking).

•We may disclose data if required by law, court order, or to protect the safety of users.

•We share mentor match data only with the matched mentor and only with your consent.

Security

•All data is transmitted over HTTPS with TLS encryption.

•Passwords are hashed using bcrypt — we cannot see your password.

•We conduct regular security audits and penetration testing.

•Access to user data by PMPath staff is logged and restricted to need.

•In the event of a data breach, we will notify affected users within 72 hours per GDPR requirements.