Effective: October 23, 2026
EduPath ("we", "us", "our") operates the edupath.com website and related services (the "Service"). This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and the rights you have over your data. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the Jordan Personal Protection Privacy Law No. 24 of 2023 (PPL), and other applicable data protection laws.
We collect information you provide directly to us: Account information: When you sign up, we collect your full name, email address, password (hashed), country, and field of interest. If you sign up via Google, we receive your Google account name and email. Profile data: As you use EduPath, we store your saved universities, Rihla AI chat sessions, scholarship matches, essay review history, and reviews you submit. Lead inquiries: When you contact a university through EduPath, we store your name, email, country, GPA, field of interest, and message. Usage data: We automatically collect information about how you interact with the Service — pages visited, time spent, clicks, search queries, and device information (browser type, screen size, approximate location by country). We use this data in aggregate to improve the Service. Cookies: We use cookies and similar technologies for authentication, language preference, and (with your consent) analytics. See our Cookie Policy for details.
We use your information to: • Provide, operate, and maintain the Service • Create and manage your account • Personalize your experience (e.g., recommend universities based on your saved list) • Process your inquiries to universities and deliver responses • Send you service-related emails (welcome email, deadline alerts, review status notifications) • Analyze usage patterns to improve features and fix bugs • Detect, prevent, and address fraud, abuse, and security issues • Comply with our legal obligations We do NOT sell your personal information to third parties. We do NOT use your data to train AI models without your explicit consent.
Under the GDPR, we process your personal data on the following legal bases: • Consent: You consent to our use of your data when you create an account and accept this Privacy Policy. You can withdraw consent at any time by deleting your account. • Contract: Processing is necessary to provide the Service you requested (e.g., saving universities, submitting reviews, contacting universities). • Legal obligation: We may process data to comply with legal requirements (e.g., tax records, responding to lawful requests). • Legitimate interests: We process usage data to improve security, prevent fraud, and enhance the Service — these interests are balanced against your privacy rights. Under Jordan's PPL No. 24 of 2023, we process your data based on your informed consent and to fulfill the Service's purpose.
We retain your personal data for as long as your account is active, or as needed to provide the Service. Specific retention periods: • Account data: Until you delete your account • Reviews: Until you delete them (or your account) • Rihla AI sessions: 24 months after your last activity • Essay reviews: 12 months after submission • Lead inquiries: 36 months (to comply with potential consumer-protection inquiries) • Analytics data (aggregated): Indefinitely (no personal identification) • Server logs: 90 days When data is no longer needed, we delete it or anonymize it so it cannot be linked to you.
Under the GDPR and Jordan PPL, you have the following rights: • Right of access: You can request a copy of all personal data we hold about you. • Right to rectification: You can correct inaccurate or incomplete data. • Right to erasure ("right to be forgotten"): You can delete your account at any time via Account Settings. We will remove your data within 30 days. • Right to restrict processing: You can ask us to limit how we use your data. • Right to data portability: You can request your data in a machine-readable format. • Right to object: You can object to processing based on legitimate interests. • Right to withdraw consent: You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise any of these rights, email privacy@edupath.com. We will respond within 30 days. If you are not satisfied with our response, you can complain to your local data protection authority (e.g., the Jordan Data Protection Unit, or your EU member state's DPA).
EduPath is hosted on Vercel (United States) and Supabase (United States/EU). Your data may be transferred to and processed in these countries. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, and we only transfer data to countries that provide an adequate level of protection. If you are in Jordan, your data is processed under Jordan's PPL which permits international transfers subject to appropriate safeguards.
We take reasonable technical and organizational measures to protect your data: • All data in transit is encrypted via TLS 1.2+ • Passwords are hashed by Supabase Auth using bcrypt • Database access is restricted to authenticated server-side code • API routes are protected by CSRF checks, rate limiting, and input validation • We monitor for suspicious activity and have an incident response plan No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we work hard to protect your data and will notify affected users within 72 hours of any breach as required by GDPR Article 33.
EduPath is intended for students aged 16 and older. We do not knowingly collect data from children under 16. If you believe we have collected data from a child under 16, please contact privacy@edupath.com and we will delete it immediately. Students aged 16–18 may use EduPath with the consent of a parent or legal guardian. By creating an account, you represent that you are 16 or older, or that you have parental consent.
We may update this Privacy Policy from time to time. We will notify you of material changes by email (if you have an account) and by posting a notice on the EduPath homepage 30 days before the change takes effect. The "Effective date" at the top of this page indicates when the policy was last revised. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or your personal data, contact us: • Email: privacy@edupath.com • Subject: Privacy Inquiry We aim to respond to all privacy inquiries within 5 business days. For urgent matters related to data deletion, mark your subject as "URGENT — Deletion Request".
Questions about privacy: privacy@edupath.com