Privacy Policy
Last updated 2026-11-04
Who we are and this policy
Pathwize ('Pathwize', 'we', 'us', 'our') is an EU-native platform for sourcing, engaging and working with credential-verified experts to produce and evaluate data for AI training and evaluation. This Privacy Policy explains how we handle personal data across our websites, applications and services (the 'Service'). For personal data processed through our websites, accounts and operations, the controller is Note Buddy's GmbH, Dietkirchenstr. 70, 53913 Swisttal, Germany (Amtsgericht Bonn, HRB 25657), which operates the Service under the Pathwize brand. Where we process personal data on behalf of a customer as part of delivering the Service, we act as processor under our Data Processing Addendum (DPA). You can reach us about privacy at privacy@gopathwize.com.
Who this policy covers
This policy applies to Experts (students, graduates and specialists who join to be verified, take assessments and carry out data and evaluation work), Customers (organisations and AI teams that commission expert data, evaluation or services), Prospects (business representatives we contact about the Service), Partners (for example universities and institutions we work with), and Visitors to our websites. Some sections apply only to a particular group, as indicated.
Personal data we collect
We collect the following, depending on who you are and how you use the Service. From Experts: identity and contact data (name, email, phone); profile and credential data (education, qualifications, skills, CV or resume, links); verification and assessment data (verification status, qualification-test and assessment results); interview data (audio and video recordings and transcripts of AI-assisted interviews you choose to take, and related integrity signals); work product you create on the platform (annotations, evaluations, written reasoning); and payout data (bank or payment account details processed via our payment providers). From Customers: account and contact data (name, work email, company, role, phone), billing and transaction data, and the project instructions and content you submit. From Prospects: business contact data (name, role, company, business email) obtained from public sources or provided by you, used to introduce the Service. From everyone: usage and technical data (device and browser information, IP address, log and event data, cookies and similar technologies) and communications with us (support requests, emails and messages). We do not intentionally collect special categories of personal data unless you provide them for a specific, lawful purpose and, where required, with your explicit consent.
How and why we use your data
We use personal data to create and manage accounts and to provide, operate, secure and improve the Service; verify expert credentials and run assessments and AI-assisted interviews; match experts to suitable projects and enable the agreed work; process payments and expert payouts; respond to enquiries and provide support; send service communications and, where permitted, marketing, which you can opt out of at any time; introduce the Service to prospective customers; detect, prevent and investigate fraud, abuse and security incidents and verify the integrity of submitted work; develop and improve our features, including AI-assisted features; and comply with legal, accounting and reporting obligations.
Legal bases for processing (GDPR)
We rely on performance of a contract (Art. 6(1)(b)) to provide the Service, manage accounts, run projects and process payouts; legitimate interests (Art. 6(1)(f)) to keep the Service secure, prevent fraud and verify work integrity, analyse and improve the Service, and contact business prospects, balanced against your rights; consent (Art. 6(1)(a)) for marketing where required, non-essential cookies and analytics, and recording AI-assisted interviews; and legal obligations (Art. 6(1)(c)) to comply with applicable law. Where you provide special category data, we rely on your explicit consent (Art. 9(2)(a)) or another applicable exception. You can withdraw consent at any time without affecting prior processing.
How we share your data and our sub-processors
We do not sell personal data. We share it only as needed to run the Service: with Customers, where an expert's agreed work product and relevant profile information are made available to the customer who commissioned the project; with Experts, to the extent needed to carry out a project; and with service providers (sub-processors) that process data on our documented instructions under a contract. Our current sub-processors include Supabase (hosting, database, storage and authentication), Vercel (website and application hosting), Anthropic (AI model processing), LiveKit, Deepgram and ElevenLabs (real-time infrastructure, speech-to-text and text-to-speech for AI-assisted interviews), PostHog (product analytics), Stripe and Wise (payments and expert payouts) and Google Workspace (business communications). We may also disclose data to authorities or others where required by law or necessary to protect rights, safety or the integrity of the Service, and in connection with a merger, acquisition or similar transaction, subject to this policy. A current sub-processor list is kept in our DPA and available on request.
AI-assisted features and interviews
Parts of the Service use AI. AI-assisted interviews may be recorded and transcribed, and the audio, video and transcript are processed by our interview and model sub-processors named above to conduct the interview and generate a summary. We also run automated integrity and quality signals on submitted work and interviews to detect fraud and assess suitability. These signals support, but do not replace, human review: we do not make decisions producing legal or similarly significant effects about you based solely on automated processing. You can ask us about the logic involved and contest an outcome by contacting privacy@gopathwize.com.
Where your data is processed (international transfers)
Core personal and project data is stored within the EU/EEA by default, and our primary database and storage are EU-resident. Some sub-processors listed above operate or process data outside the EEA, including in the United States. Where that happens, we rely on an EU adequacy decision, the EU-U.S. Data Privacy Framework where applicable, or the EU Standard Contractual Clauses together with supplementary measures, so that your data keeps an equivalent level of protection.
How long we keep your data
We keep personal data only for as long as necessary for the purposes above and to meet legal, accounting and reporting requirements. As a guide: account and profile data is kept while your account is active and for a limited period afterwards; interview recordings and transcripts are kept for the period needed to assess and document the engagement and are then deleted or anonymised; prospect contact data is kept only while there is a legitimate interest in contacting you and is deleted on objection or when no longer relevant; and transaction records are kept for the periods required by tax and commercial law. When data is no longer needed, we delete it or irreversibly anonymise it.
Cookies and analytics
We use essential cookies required for the site and account to function and, subject to your consent where required, analytics (via PostHog) to understand and improve usage. You can manage non-essential cookies through our cookie controls or your browser settings.
Data security
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, least-privilege principles, logging and monitoring, and EU-resident storage for core data. Sensitive customer material can be worked in a controlled, no-download environment. No system is completely secure, and we continuously review and improve our safeguards. Our websites may link to third-party sites that we do not control and whose privacy practices are their own.
Age restrictions
The Service is intended for business and professional use by adults. It is not directed to children, and we do not knowingly collect personal data from anyone under 18.
Your rights and choices
You have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on legitimate interests, including direct marketing. Where processing is based on consent, you can withdraw it at any time without affecting prior processing. You can opt out of marketing emails using the unsubscribe link or by contacting us. To exercise any right, contact privacy@gopathwize.com; we respond within one month and will tell you if we need an extension. You also have the right to lodge a complaint with your local data protection supervisory authority.
Changes to this policy
We may update this Privacy Policy from time to time. The 'Last updated' date at the top reflects the latest version, and we will notify you of material changes where required by law.
Contact
For any privacy question or request, contact privacy@gopathwize.com or write to Note Buddy's GmbH, Dietkirchenstr. 70, 53913 Swisttal, Germany. If we appoint a Data Protection Officer, their contact details will be published here.
This document is a structural placeholder pending review by counsel.