Back to OwlPath
UK GDPR Compliant

Privacy Policy

Last updated: 10 May 2026Forge Gate Limited

The short version

  • Your profile and job descriptions are sent to OpenAI to generate your analysis. OpenAI does not use API data to train its models.
  • We store your analyses so your coach can learn your patterns over time. This is what makes Career Intelligence and proactive coaching possible.
  • We never sell your data. We never share it with advertisers. We never use it to train AI models.
  • You can delete everything — your profile, analyses, and account — at any time from Settings.
  • We are registered with the UK Information Commissioner's Office (ICO) as a data controller.

1Who we are

OwlPath is operated by Forge Gate Limited, a company registered in England and Wales (Company No. 17196398). References to "we", "us", or "our" refer to Forge Gate Limited.

We are the data controller for all personal data collected through owl-path.com. To contact us: hello@owl-path.com

We are registered with the Information Commissioner's Office (ICO) as required under UK GDPR.


2What data we collect and why

Account data

When you register, we collect your name, email address, and a hashed password. If you sign in via Google, we receive your name and email from Google.

Lawful basis: Contract.

Profile and job description content

When you upload or paste your profile and job descriptions, this content is processed by OpenAI's API. Profile text is stored so it can be reused across analyses. You can delete individual profiles and analyses at any time.

Lawful basis: Contract.

Analysis history and career profile

Every analysis you run is stored. On the Pro plan, OwlPath uses this history to build a persistent career profile powering Career Intelligence and proactive coaching.

Lawful basis: Contract (Basic) and Legitimate interests (Pro pattern analysis).

Payment data

Payments are processed by Paddle. We never see or store your full card details. Transaction records are kept for 7 years as required by UK financial regulations.

Lawful basis: Contract and Legal obligation.

Email communications

We send transactional emails via Resend. We do not send marketing emails unless you opt in.

Lawful basis: Contract (transactional) and Consent (marketing).

Usage and security data

Basic usage logs for security monitoring, retained for 90 days. This does not include analysis content.

Lawful basis: Legitimate interests.


3How we use AI to process your data

OwlPath uses OpenAI's API to generate your analysis, coaching, cover letters, interview strategy, and career intelligence. When you submit a profile and job description, this content is transmitted to OpenAI for processing.

OpenAI's API data practices: OpenAI does not use API data to train its models. API data is retained for up to 30 days for abuse monitoring, then deleted. We have agreed to OpenAI's Data Processing Agreement.

Important: All AI-generated outputs are informed guidance, not professional career advice. OwlPath does not guarantee specific employment outcomes.


4Third-party processors and data transfers

We share data with the following processors, all acting under our instruction:

OpenAIUnited States
Purpose: AI analysis, coaching, OCR processing
Transfer safeguard: UK-US Data Bridge / Standard Contractual Clauses
PaddleUnited Kingdom / United States
Purpose: Payment processing and subscription management
Transfer safeguard: Adequacy decision / SCCs
NeonAWS EU West 2 (London)
Purpose: Database hosting
Transfer safeguard: Data stored in UK/EU — no international transfer
VercelUnited States
Purpose: Application hosting and serverless functions
Transfer safeguard: Standard Contractual Clauses
ResendUnited States
Purpose: Transactional email delivery
Transfer safeguard: Standard Contractual Clauses

We do not sell, rent, or share your personal data with advertisers or data brokers.


5How long we keep your data

Account dataRetained for the duration of your account, plus 30 days after deletion.

Profile and job description contentRetained for the duration of your account. Delete individual items at any time.

Analysis history and career profileDeleted immediately when you delete your account.

Billing and transaction recordsRetained for 7 years (Companies Act 2006).

Usage and security logsRetained for 90 days, then automatically deleted.

Verification and password reset tokensDeleted immediately after use, or after 24 hours / 60 minutes if unused.


6Your rights under UK GDPR

Right of accessRequest a copy of all personal data we hold about you.

Right to rectificationAsk us to correct inaccurate data.

Right to erasureAsk us to delete your data. Delete your account instantly from Settings.

Right to restrictionAsk us to restrict how we process your data in certain circumstances.

Right to data portabilityRequest your data in a machine-readable format.

Right to objectObject to processing based on legitimate interests.

Rights related to automated decisionsNo decisions with legal or significant effects are made solely by automated means.

To exercise any right, email hello@owl-path.com. We will respond within 30 days. You may also complain to the ICO at ico.org.uk or 0303 123 1113.


7Cookies

OwlPath uses only essential cookies:

Session cookie (next-auth.session-token)Essential — keeps you signed in. Cannot be disabled.

CSRF protection (next-auth.csrf-token)Essential — prevents cross-site request forgery. Required for security.

Analytics / advertising cookiesWe do not use any.

See our full Cookie Policy.


8Security

Passwords hashed using bcrypt (cost factor 12)
All data encrypted in transit via TLS
Database encrypted at rest (Neon PostgreSQL)
Rate limiting on authentication endpoints
Email verification required for all new accounts
Access to production data restricted to authorised personnel only

If you believe your account has been compromised, contact us immediately at hello@owl-path.com.


9Children

OwlPath is not directed at persons under the age of 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.


10Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or a prominent notice on the site. Continued use after changes constitutes acceptance.


11Contact

Forge Gate Limited (trading as OwlPath)

Company No. 17196398 · Registered in England and Wales

hello@owl-path.com