Privacy Policy
PathFinder helps Sri Lankan students plan a PhD in New Zealand. To do that we handle some personal information about you. This policy explains, in plain language, what we collect, why, where it lives, who can see it, and the choices and rights you have. We designed PathFinder to work even without an account — you can browse anonymously, and your planning data can stay entirely on your own device.
01 Who we are
PathFinder ("PathFinder", "we", "us", "our") operates the website and web application that help Sri Lankan students assess, plan, and track an application for a doctoral (PhD) programme in New Zealand. For the purposes of data-protection law, PathFinder is the data controller for the personal information described in this policy.
If you have any question about this policy or how your data is handled, you can reach our privacy contact at privacy@pathfinder.app.
02 Scope & the laws we follow
This policy applies to the PathFinder website (index.html) and the PathFinder
web application (app.html), together "the Service". It does not apply to any
third-party website we link to (such as a university, Immigration New Zealand, a scholarship
provider, or a payment provider), each of which has its own privacy policy.
We aim to comply with the data-protection frameworks most relevant to our users:
- Sri Lanka — the Personal Data Protection Act, No. 9 of 2022 (PDPA), as our primary user base is in Sri Lanka.
- New Zealand — the Privacy Act 2020 and its Information Privacy Principles, as our subject matter and some partners are based in New Zealand.
- European Union / UK — the General Data Protection Regulation (GDPR) and UK GDPR, where they apply to visitors in those regions.
Where these frameworks differ, we apply the standard that gives you the greater protection.
03 Information we collect
We keep data collection to the minimum needed to run each feature. We collect:
| Category | Examples |
|---|---|
| Account & identity | Your email address and (if you sign in with Google) your name and Google account identifier. Anonymous visitors are issued only a random, non-identifying user ID. |
| Planning data you create | Your assessment answers, generated roadmap, saved labs/scholarships, application tracker entries, visa checklist progress, settlement/funds-planner scenarios, and research-studio drafts. |
| Lead / newsletter | The email address you submit to receive deadline alerts or updates. |
| Mentorship requests | The topic, your note, and the name and contact detail (e.g. email or phone) you provide so a mentor can reach you. |
| Phone & walk-in enquiries | If you contact a mentor or the platform by phone, WhatsApp, or in person instead of through the app, whoever takes the call or visit records your name, how to reach you, what you need, and when to call back, so you join the same request queue as an online enquiry. We also match your phone number or email against earlier enquiries so a mentor helping you can see your prior history instead of starting from zero. |
| Session records | For a mentoring session that is actually delivered — including one that happened over WhatsApp or a phone call, off-platform — the mentor records the topic, what was covered, agreed next steps, and the fee and payment status, so a proper invoice or receipt can be issued to you. A mentor's own private notes on a session are never shown to you or shared further. |
| Mentor profiles (mentors only) | Display name, fields, city, short bio, languages, and availability you choose to publish. |
| Payment-related | For paid mentor sessions and premium unlocks, payment is processed by PayHere, PayPal, or a manual bank/mobile-wallet transfer you report. We receive a payment status, amount, method, and any reference you provide; we do not receive or store your full card number or banking credentials. |
| Technical | Standard data your browser sends (IP address, device/browser type) and locally stored preferences. We do not run advertising trackers. |
| Analytics (consent only) | Collected only if you accept the analytics banner. Which pages and in-app screens you open; anonymous events describing what kind of thing happened (an assessment finished and its high/medium/low band, a course search term, a template downloaded, a plan bought and its price); approximate location from a truncated IP, device and browser type, and how you arrived. If you are signed in, the random Firebase account identifier is included so one person on two devices is counted once. Your name, email, phone, anything you type into a form, and the figures in your funds and cost plans are never included. See the Cookie Policy to accept, decline, or change your answer. |
04 How & why we use it
We use your information only to:
- Provide the core features — generate your assessment score, roadmap, and proposal drafts, and save your progress.
- Sync your data across your devices when you choose to sign in.
- Route mentorship requests to a suitable mentor and let that mentor contact you, however the enquiry arrived — through the app, by phone, or by WhatsApp.
- Keep a single history for someone who has contacted us more than once, so a mentor can see earlier sessions and what is still owed before the next one.
- Record delivered mentoring sessions and generate the invoices or receipts for them.
- Process payments for optional paid mentor sessions and plan purchases (via PayHere or PayPal).
- Send the updates or deadline alerts you asked for (you can unsubscribe at any time).
- Operate, secure, debug, and improve the Service.
- Comply with legal obligations and enforce our Terms.
We do not sell your personal data, and we do not use it for third-party advertising or profiling.
05 Lawful bases for processing
Where the GDPR or a comparable framework applies, we rely on:
- Consent — for newsletter/lead emails and optional cloud sync. You may withdraw consent at any time.
- Performance of a contract / request — to deliver a feature you actively use, such as submitting a mentor request or paying for a session.
- Legitimate interests — to keep the Service secure, prevent abuse, and improve it, balanced against your rights.
- Legal obligation — where we must retain or disclose data to comply with law.
Under Sri Lanka's PDPA we process data on equivalent lawful bases, including your consent and the necessity of processing to provide a service you have requested.
06 Where your data is stored
PathFinder uses a deliberately lightweight, privacy-respecting architecture:
- On your device — your planning data is cached in your browser's local storage for instant, offline access. If you never sign in or enable cloud sync, it can stay only here.
- In the cloud (optional) — if cloud features are enabled, your data is mirrored to Google Firebase (Authentication and Cloud Firestore). Each signed-in user's data is isolated to their own account and protected by server-side security rules.
Lead emails and mentorship requests, when submitted, are stored in the cloud so they can be actioned. Access to those records is restricted by security rules to the platform administrator and, for a request, the assigned mentor.
08 International data transfers
Because we use cloud providers such as Google Firebase, your data may be stored or processed on servers located outside Sri Lanka, including in regions operated by those providers. When we transfer personal data across borders, we rely on the provider's contractual safeguards and recognised transfer mechanisms (such as standard contractual clauses) and take reasonable steps to ensure your data remains protected to the standard described in this policy.
09 How long we keep your data
- Account & planning data — kept while your account is active. Delete your account (or clear your browser storage for local-only data) to remove it.
- Mentorship requests — kept for the lifecycle of the request and a reasonable period afterwards for support and dispute resolution.
- Phone/walk-in enquiries & session records — kept as part of the client history and invoicing trail for as long as you (or the person who contacted us) remain a client, and afterwards for accounting and legal record-keeping.
- Lead / newsletter emails — kept until you unsubscribe or ask us to delete them.
- Payment records — kept as long as required for accounting and legal obligations.
- Analytics — event-level data is retained by Google for 14 months and then deleted automatically; the aggregate reports built from it are kept indefinitely because they identify no one. Your consent answer is stored on your own device for 6 months, after which we ask again.
When data is no longer needed, we delete or anonymise it.
10 Your rights & choices
Depending on where you live, you have the right to:
- Access a copy of the personal data we hold about you.
- Correct inaccurate or incomplete data — much of which you can edit directly in the app.
- Delete your data ("right to be forgotten"), subject to legal retention.
- Withdraw consent at any time, e.g. unsubscribe from emails, or decline analytics from the Cookie Policy.
- Object to or restrict certain processing.
- Portability — receive your data in a usable format. You can also export much of your planning data from within the app.
- Complain to a supervisory authority — in Sri Lanka, the Data Protection Authority established under the PDPA; in New Zealand, the Office of the Privacy Commissioner; or your local EU/UK authority.
To exercise any right, email privacy@pathfinder.app. We will respond within the timeframe required by applicable law.
11 Children & minors
PathFinder is intended for prospective postgraduate students and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
12 Security
We use technical and organisational measures appropriate to the data we hold, including authentication, server-side access rules that isolate each user's records, encryption in transit (HTTPS), and restricting administrative access. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.
13 Changes to this policy
We may update this policy as the Service or the law evolves. We will revise the "Last updated" date above and, for material changes, provide a more prominent notice. Continuing to use the Service after a change takes effect means you accept the updated policy.
14 Contact us
Questions, requests, or complaints about privacy:
- Privacy enquiries — privacy@pathfinder.app
- General support — support@pathfinder.app
- Phone & WhatsApp — 071 270 7074 (message on WhatsApp)
If you contact us on WhatsApp or by phone, that conversation is handled the same way as any other enquiry — see what we collect — and whoever answers may write down your name, your number and what you need so a mentor can pick it up.