Privacy Policy

This Privacy Policy explains how Grad Path LLC ("we", "us", "our") collects, uses, and shares personal data when you use our website and the Career First Nexus service. Grad Path LLC — a Wyoming limited liability company at 30 N Gould St Ste N, Sheridan, WY 82801 — is the data controller for the personal data described below.

1. Information we collect

• Account data: name, email, password (hashed), role (graduate / parent), and parent–graduate link.
• Profile data: degree program, graduation date, career goals, quiz responses, and onboarding answers you provide.
• Product data: resumes, applications, tasks, lesson progress, notes, and files you upload.
• Support messages: emails and in-app messages you send us.
• Usage & device data: log data, IP address, browser, device identifiers, and pages viewed, collected automatically.
• Payment data: handled by Paddle.com, our Merchant of Record. We receive transaction metadata (status, amount, last 4 digits, country) but not full card details.

2. How we use your data

• Create and operate your account and the parent–graduate link.
• Provide lessons, resume tools, application tracking, and progress dashboards.
• Process purchases, refunds, and entitlement to features.
• Provide customer support and respond to your messages.
• Secure the Service, prevent fraud and abuse, and meet legal obligations.
• Improve and develop new features (using aggregated or de-identified data where possible).
• Send essential service emails. Marketing emails only with your consent; you may opt out at any time.

3. Legal bases (UK / EEA users)

We rely on: performance of a contract (providing the Service you bought), legitimate interests (securing the Service, preventing fraud, improving the product), consent (marketing emails, optional cookies), and legal obligation (tax, accounting, responding to lawful requests).

4. How we share data

• Paddle.com — our Merchant of Record, processes payments, taxes, refunds, invoicing, and subscription management.
• Service providers / subprocessors — hosting, database, email delivery, analytics, and error monitoring, all under contract and only to provide the Service.
• Parents linked to a graduate — graduates' progress, applications, and lesson data are visible read-only to their linked parent account.
• Professional advisers — legal, accounting, and insurance, where needed.
• Authorities — where required by law, court order, or to protect rights and safety.
• Successor entity — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell your personal data.

5. International transfers

Your data may be processed in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses or adequacy decisions) for transfers from the UK or EEA.

6. Retention

We retain account and product data for as long as your account is active and for a reasonable period afterward to comply with legal, tax, and dispute-resolution obligations. You can request deletion at any time (see Your Rights below). Backups are purged on a rolling schedule.

7. Your rights

Depending on your location, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion ("right to be forgotten");
• restrict or object to certain processing;
• request a portable copy of your data;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise these rights, email support@careerfirstnexus.com. We respond within 30 days.

8. Security

We use industry-standard technical and organisational measures including encryption in transit, encrypted-at-rest storage, role-based access control, and row-level security on user data. No system is perfectly secure; report concerns to support@careerfirstnexus.com.

9. Cookies

We use essential cookies and local storage for authentication and session management. We may use limited analytics cookies to understand product usage. You can control cookies in your browser settings; disabling essential cookies will break login.

10. Children

The Service is intended for users 18 and older (graduates near or past graduation and their parents). We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact support@careerfirstnexus.com and we will delete it.

11. Changes

We may update this Policy. Material changes will be announced in-app or by email. Continued use after the effective date constitutes acceptance.

12. Contact

Questions or requests: support@careerfirstnexus.com. For payment-related privacy questions, you may also contact Paddle.com at paddle.net.