Privacy Policy
Effective [date]
This policy explains what personal information [PathFacts legal entity] ("PathFacts", "we") collects through pathfacts.com and map.pathfacts.com, why, who processes it on our behalf, and the choices you have.
What we collect
Account information
When you request access or are invited by your company: your name, work email address, company, and optionally a phone number. Your password is stored only as a salted one-way hash (scrypt); we cannot read it.
Sign-in and security records
Each sign-in, failed attempt, password change and similar event is recorded with the time and the IP address it came from. We use these records to detect and stop unauthorised access.
Your company's data
Microwave paths, sites and lists you upload or curate, the reports and audits you order, and the monitors you configure. This is your company's confidential information. We process it only to provide the service to your company.
Orders and payment
What you ordered and invoice details. Card payments are taken by Stripe; card numbers go to Stripe directly and never reach our servers.
Messages you send us
The contact form on pathfacts.com sends your name, email and message to our inbox.
Email from us
Service email (sign-in links, password resets, monitor alerts, order notices) is sent to account holders. Marketing email to business contacts may record whether a message was opened or a link clicked; every marketing message carries a one-click unsubscribe, and unsubscribing is honoured permanently.
How the sites are used
Our own analytics record how pathfacts.com and the map are used: the pages you view, the referring site and campaign tags, the buttons and links you click and where on the page, how far you scroll, how long a page is open, and your device type, browser and screen width. We work out an approximate location (country, region, city) from your IP address at the moment of the visit; the IP address itself is not stored, only a one-way keyed hash of it that we use to filter out automated traffic. We never record what you type into forms. If you are signed in, visits are linked to your account. None of this is shared with an analytics or advertising company; it is kept in our own database. Detailed records are deleted after 13 months.
If your browser sends Global Privacy Control or Do Not Track, no analytics are recorded at all.
Cookies
We set three cookies. Two are required for the service to work: a session
cookie that keeps you signed in, and an anti-forgery token. The third,
pf_vid, is a random identifier that lets our own analytics
recognise a returning browser across pathfacts.com and the map; it lasts 13
months and is not set when your browser sends Global Privacy Control or Do Not
Track. There are no advertising or third-party analytics cookies.
How we use it
To provide and secure the service, to deliver what you order, to send the notifications you configure, to answer you, and to meet legal obligations. We do not sell personal information, and we do not use your company's data to train models or for any purpose other than serving your company.
Who processes it for us
| Provider | Purpose | Location |
|---|---|---|
| Railway Corporation | Application hosting and database | United States |
| Amazon Web Services | Encrypted backups and secrets storage; AI processing (Claude on Amazon Bedrock) for drafting outreach email and sorting replies | United States (us-east-1) |
| Vercel | Hosting of pathfacts.com | United States |
| Resend | Transactional and outreach email delivery | United States |
| Stripe | Card payments | United States |
| Google Workspace | Company email | United States |
Each is bound by contract to process data only on our instructions. We will update this list before adding a provider that handles personal information.
How long we keep it
Account and company data are kept while your company's account is active and deleted within [90] days of the account closing, except where we must keep records (such as invoices) by law. Encrypted backups roll off on a fixed schedule; the longest-lived are kept for twelve months. Site analytics are deleted after 13 months.
Security
See Security at PathFacts for how data is protected.
Your choices and rights
You can ask to see, correct, export or delete your personal information by emailing privacy@pathfacts.com. If your account was created by your company, we may refer the request to your company's administrator, who controls that account. [Residents of California and other states with privacy laws have the rights those laws provide; counsel to complete.]
Children
The service is for businesses and is not directed at children under 16.
Changes
We will post changes here and update the date above. Material changes are emailed to account holders before they take effect.
Contact
[PathFacts legal entity], [postal address]. privacy@pathfacts.com