Privacy

The short version

You can browse every course, career, and institution on this site without an account, without a cookie banner, and without us learning anything about you beyond what a web server necessarily sees to serve a page. We do not sell data, we do not run advertising trackers, and we do not profile readers.

If you create an account, subscribe to catalogue updates, use the AI Career Coach, or contact us, we collect the minimum information needed to provide that service. This policy explains exactly what we collect, why we collect it, where it is stored, who has access to it, how long we keep it, and what your rights are under Kenyan law.

We have written this policy in plain language because privacy documents that nobody can understand are not privacy protections. If anything here is unclear, write to us at [email protected] and we will explain it.

Who we are

Pathrel is a career guidance platform operated by Pathrel Limited, a company registered in Nairobi, Kenya. We are the data controller for all personal data collected through the platform, which means we decide what data is collected, why it is used, and how it is processed.

Our registered address is Pathrel Limited, Nairobi, Kenya. You can contact us at any time about your data using the details in the Contact section at the end of this policy.

What we collect

When you only read

Nothing you type, and no identifiers we set. Our hosting provider records ordinary server logs, including IP address, user agent, requested URL, and timestamp, which exist so we can keep the service running and investigate abuse. Those logs are retained for a short operational window, typically thirty days, and are not joined to any other record or used to build a profile of you.

Server logs are stored by Google Cloud Run as part of its standard infrastructure, and we do not have direct control over their retention period beyond what the platform provides. We do not export, copy, or analyse these logs for tracking purposes, and we do not combine them with any other data source to identify individuals.

Reading the catalogue does not require you to tell us who you are, where you are, or what you are interested in. We do not set any cookies when you read, we do not use fingerprinting techniques to identify your browser, and we do not embed third-party tracking scripts that might do so on our behalf.

When you contact us

The contact form asks for a name, an email address, and a message. We use them to reply to you and to keep a record of the exchange so we can refer back to it if you write again. The name and message are stored alongside your email address in our database, associated with the date and time of submission.

They are not added to any mailing list, and subscribing is a separate, deliberate act described below. Contact form submissions are retained for as long as needed to resolve your enquiry, and are deleted on request or after twelve months of inactivity, whichever comes first.

If you contact us about a correction to a catalogue record, we may keep a record of the correction and the person who reported it so we can credit the contribution and track the quality of submissions. This is stored separately from your contact message and does not include the content of your original message.

When you subscribe to catalogue updates

The subscribe form asks for an email address and nothing else. No name, no account, and nothing about you is inferred from it. We store the address, which surface you subscribed from, and the dates you subscribed and confirmed.

Subscribing takes two steps on purpose. The address is recorded but receives nothing until you follow the confirmation link we send, so somebody who types your address into our footer cannot sign you up. This is called double opt-in, and it is the strongest practical protection against being subscribed by someone else. If you never confirm, the record sits inert and is never written to or used.

We use the address for one thing: a short note when exposure ratings or fees in the catalogue change materially. We do not sell it, share it with institutions, or use it to advertise anything else. Mail is delivered by Resend, who process it on our behalf under a data processing agreement, and who do not use your address for their own purposes.

Every message carries an unsubscribe link. Unsubscribing deletes the address rather than flagging it, so nothing is kept behind on a suppression list. That means we hold no record afterwards that you were ever subscribed, and you can subscribe again later as though for the first time. We do not retain unsubscribed addresses for analytics or reporting purposes.

When you create an account

Accounts are for readers who want to save courses, careers, and institutions to a shortlist, use the AI Career Coach with full conversation history, track their self-discovery assessment results, and access paid features. If you hold one, we store:

• Your email address, used for sign-in and notifications
• Your name, if you choose to provide it, which is optional and can be left blank
• Your workspace membership and role within the platform
• Your shortlisted courses, careers, and institutions, with the dates you saved them
• Your self-discovery assessment responses and the results derived from them
• Your AI Career Coach conversation history, including the messages you sent and the responses you received
• Your subscription plan and billing history, if you are on a paid plan, including transaction references and dates
• Your preferred theme, light or dark, if you have chosen one
• The dates and times of your significant activity on the platform, such as when you created your account, when you last signed in, and when you changed your settings

Authentication is by a signed link sent to your email address, so there is no password for us to store or for anyone to steal. Each link expires after a short window, typically fifteen minutes, and can only be used once. If you sign in with Google or GitHub, we receive your email address and your name from the provider, but we do not receive your password, and we do not post anything to your account on those platforms.

You can delete your account at any time from your account settings. When you do, your personal data is removed within thirty days, though some records may be retained for legal reasons as described in the retention section below.

When you use the AI Career Coach

The AI Career Coach processes your questions and the catalogue records it references to generate responses. Your conversation history is stored in your account so you can refer back to it, and so the coach can maintain context across messages within a single conversation.

Conversation content is sent to our AI provider, currently OpenAI or Google depending on the model in use, for the purpose of generating a response. The provider processes this data under their own data processing agreement, and we have configured our integration to prevent them from using your data to train their models. We cannot, however, guarantee the practices of third-party providers beyond what their agreements require, and you should review their privacy policies if you have concerns.

Your AI Coach conversations are private to your account. We do not share them with institutions, employers, or any third party. Our engineering team may access anonymised conversation logs for the purpose of debugging, improving response quality, or investigating abuse, but this access is restricted and logged.

You can delete individual conversations or all of your conversation history at any time from your account settings. Deletion is permanent and cannot be undone.

When you use the self-discovery assessment

The self-discovery assessment asks you a series of questions about your interests, strengths, preferences, and values. Your responses are stored in your account and used to generate personalised recommendations for courses and careers.

Your assessment responses are processed by our recommendation engine, which matches your profile against catalogue records to produce ranked suggestions. The processing happens on our servers, and your raw responses are not sent to any third party except the AI provider described above, and only if the assessment uses AI-assisted scoring.

Your assessment results are retained for as long as your account is active, so you can refer back to them and so we can update your recommendations as the catalogue changes. You can retake the assessment at any time, and you can delete your previous results before or after retaking it.

When you make a payment

If you purchase a Pro or Professional subscription, we collect billing information through our payment provider. We receive only a transaction reference, the amount paid, the date of the transaction, and the last four digits of your card number. We do not store your full card number, your card's expiry date, or your card's security code, and we never see or handle your full payment details.

Payment processing is handled entirely by our payment provider, who is PCI-DSS compliant and operates under their own data processing agreement with us. If you request a refund, we may need to reference your transaction to process it, as described in our Refund Policy.

Where it lives

Application data is stored in a managed PostgreSQL database operated by Neon, with servers in the United States. Transactional email, including sign-in links and replies to the contact form, is sent through Resend. The application itself runs on Google Cloud Run. AI processing is handled by OpenAI and Google, depending on the model.

Each of these providers processes data on our instructions under data processing agreements, and each may store or process it outside Kenya, which means your information can be transferred and processed abroad. We have assessed these transfers under the Kenya Data Protection Act, 2019, and rely on the safeguards provided by the providers' own compliance programmes, including their adherence to international standards such as SOC 2 and ISO 27001 where applicable.

We do not store payment card details. Billing is handled by our payment provider, who processes and stores card information under their own PCI-DSS compliance framework. We receive only a transaction reference and the last four digits of the card, which is not enough to identify or charge the card.

The specific providers we use may change over time as we evaluate better or more cost-effective options. When we add a new provider that processes personal data, we will update this policy before the change takes effect, and we will only use providers that have signed a data processing agreement with us.

Who has access

Access to personal data is restricted to:

• Pathrel engineering staff, who maintain the platform and may access data to debug issues, investigate abuse, or respond to your support requests. Access is logged and reviewed.
• Pathrel support staff, who may access your contact form submissions and account details to respond to your enquiries. They do not have access to AI Coach conversations or assessment responses unless you explicitly share them.
• Our AI providers, OpenAI and Google, who process your AI Coach messages and assessment data solely to generate responses, under data processing agreements that prohibit them from using your data for any other purpose.
• Our email provider, Resend, who processes transactional email delivery on our behalf and does not use your data for their own purposes.
• Our payment provider, who processes billing transactions and stores card details under their own compliance framework.

We do not share personal data with institutions, employers, government agencies, or any other third party, except where required by law, where we have your explicit consent, or where the data is necessary to provide the service you have requested.

How long we keep it

We follow the principle of data minimisation, which means we only keep personal data for as long as it is needed for the purpose it was collected. Here is how long we keep each type of data:

• Server logs: Retained by the hosting provider for approximately thirty days, then automatically deleted. We do not export or copy them.
• Contact form submissions: Retained for as long as needed to resolve your enquiry, then deleted on request or after twelve months of inactivity, whichever comes first.
• Subscriber records: Retained until you unsubscribe, at which point the record is deleted entirely. We do not retain unsubscribed addresses on a suppression list.
• Account data: Retained for as long as your account is active. If you delete your account, your personal data is removed within thirty days, though anonymised usage statistics may be retained for aggregate reporting.
• AI Coach conversations: Retained for as long as your account is active, and deletable by you at any time from your account settings. Deletion is permanent.
• Assessment responses and results: Retained for as long as your account is active, so we can update your recommendations as the catalogue changes. Deletable by you at any time.
• Shortlist items: Retained for as long as your account is active, and deletable by you at any time, individually or in bulk.
• Billing records: Retained for seven years as required by Kenyan tax and accounting law, even after account deletion. These records contain transaction references and amounts, not card details.

When we delete your data, we remove it from our active database and from our backups within thirty days. We do not retain residual copies beyond what is technically necessary for backup integrity, and those copies are overwritten on the normal backup rotation schedule.

What we never do

We have written this section to be explicit about the things we will never do with your data, so you do not have to wonder:

• Sell, rent, or trade personal data to anybody, for any purpose, at any price
• Run third-party advertising or cross-site tracking scripts on this site
• Use the contact form or an account to build an advertising profile
• Publish anything about an individual reader in the catalogue itself
• Add a contact form submission to any mailing list without a separate, explicit subscription
• Share your AI Coach conversation history with institutions, employers, or any third party
• Use your data to train AI models without your explicit, informed consent
• Send you marketing email you did not ask for
• Track your reading behaviour across pages to build a profile of your interests
• Share your assessment results with anyone other than you
• Use your data for any purpose that is incompatible with the purpose for which it was collected

Cookies

There is no cookie banner on this site because there is nothing to consent to. Reading the catalogue sets no cookies at all. A signed-in account sets a single session cookie so you stay signed in, and nothing else. No analytics cookies, no advertising cookies, no tracking cookies.

Full details are in our Cookie Policy, which explains exactly what cookies the signed-in areas use, why they exist, and how to control them.

Your rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

Right to access

You may ask us for a copy of the personal data we hold about you, in a structured, machine-readable format. We will provide it within thirty days of receiving your request, and there is no charge for the first copy in any twelve-month period.

Right to correction

You may ask us to correct any personal data that is inaccurate, incomplete, or out of date. You can correct most of your information directly through your account settings, including your name, email address, and theme preference. For data you cannot edit yourself, write to us and we will correct it within thirty days.

Right to deletion

You may ask us to delete your personal data, subject to legal retention obligations such as tax records. You can delete your account and most of your data directly through your account settings. For data that requires manual deletion, write to us and we will remove it within thirty days.

Right to object

You may object to a particular use of your data, such as processing for direct marketing or profiling. We will stop the processing unless we have a compelling legitimate reason to continue, which we will explain to you in our response.

Right to data portability

You may receive your data in a portable, structured, machine-readable format and transmit it to another service. We will provide your data in JSON format, which is widely supported by data import tools.

Right to withdraw consent

Where processing is based on your consent, such as your subscription to catalogue updates, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal. Withdrawing consent does not require a reason, and it will not affect your ability to use the platform.

How to exercise your rights

To exercise any of these rights, write to [email protected] with a description of what you would like to do. We will respond within thirty days, and we will verify your identity before making any changes to your data, to protect you from unauthorised requests.

If you are unhappy with the outcome, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke. The ODPC is the independent public authority that oversees data protection in Kenya, and their services are free.

Children

The catalogue is intended for students, graduates, and professionals choosing courses and careers. It is not directed at children under sixteen, and we do not knowingly collect personal information from them. If you are under sixteen, please do not create an account or submit personal information without the involvement of a parent or guardian.

If you believe a child's data has been collected, write to [email protected] and we will delete it promptly and permanently. We do not use age-verification technology, because the platform does not collect age information, but we rely on this policy statement and parental supervision to prevent collection.

Data security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, or alteration. These measures include:

• Encryption in transit: All connections to the platform use HTTPS with TLS 1.2 or higher, so data cannot be read as it travels between your browser and our servers.
• Encryption at rest: The database provider encrypts stored data at the infrastructure level, so a physical disk removed from the data centre cannot be read.
• Access controls: Access to personal data is restricted to named individuals on our team, is logged, and is reviewed periodically. Staff access is revoked when their role changes or their engagement ends.
• Secure authentication: Sign-in is by passwordless email links, which eliminates the risk of password breaches. Where staff access requires passwords, we enforce strong passwords and two-factor authentication.
• Regular reviews: We review our security practices and provider configurations on a regular schedule, and we engage external security review for significant changes.
• Minimal data collection: The best security measure is not collecting data you do not need. We collect the minimum data required to provide each feature, and we do not collect data speculatively.

No system is perfectly secure, and we cannot guarantee that your data will never be compromised despite our efforts. If a breach occurs, we will respond as described in the next section.

Data breaches

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

1. Notify the Office of the Data Protection Commissioner within seventy-two hours of becoming aware of the breach, as required by the Kenya Data Protection Act, 2019.
2. Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms, with a description of what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.
3. Conduct an internal investigation to determine the cause, contain the breach, and prevent a recurrence.
4. Document the breach and our response, as required by law.

For urgent data breach concerns, we will respond within seventy-two hours. If you believe your data has been compromised through Pathrel, write to [email protected] immediately.

International transfers

Your data may be processed and stored outside Kenya, as described in the "Where it lives" section. The Kenya Data Protection Act, 2019, requires that cross-border transfers of personal data be protected by adequate safeguards.

We rely on the following safeguards for international transfers:

• Data processing agreements: Each of our providers has signed a data processing agreement with us that requires them to protect your data to a standard at least equivalent to that required by Kenyan law.
• Provider compliance programmes: Our providers maintain certifications such as SOC 2, ISO 27001, and GDPR compliance, which provide independent verification of their security and privacy practices.
• Minimal transfer: We only transfer data that is necessary for the specific service being provided. We do not transfer your entire account to a third party, and we do not permit providers to use your data for their own purposes.

If a provider's practices change in a way that affects your data, we will update this policy and notify you before the change takes effect.

Changes to this policy

If we change what we collect, how we use it, where it lives, or who has access to it, we will update this page and bump the version before the change takes effect. The "Last updated" date on the page reflects the most recent revision. Continued use after a change constitutes acceptance of the revised policy.

For material changes that affect existing data, such as a new processing purpose, a new third-party processor, or a change in retention periods, we will provide at least fourteen days' notice via email before the change takes effect, so you have the opportunity to review the changes and exercise your rights before they apply.

Previous versions of this policy are available on request from [email protected].

Contact

Questions about this policy or your data go to [email protected]. We aim to respond within thirty days. For urgent data breach concerns, we will respond within seventy-two hours.

You can also write to us at: Pathrel Limited, Nairobi, Kenya.

If you are not satisfied with our response to a privacy concern, you have the right to complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke. The ODPC can investigate your complaint and order remedies, and their services are free.