Data Rights (GDPR)
This declaration provides transparency information under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Controller: Decentre Studio Limited · jessejr@decentre.io
Processing purposes and lawful basis
| Purpose | Data categories | Lawful basis |
|---|---|---|
| Account authentication | Google UID, email, display name | Contract (Art. 6(1)(b)) |
| Application plan delivery | Shortlist, preferences, status | Contract (Art. 6(1)(b)) |
| AI chat lane | Chat messages, conversation context | Contract (Art. 6(1)(b)) |
| Draft support | Draft content you create | Contract (Art. 6(1)(b)) |
| Deadline tracking | Dates, tasks | Contract (Art. 6(1)(b)) |
| Parent / advisor view | Role-scoped projection | Consent (Art. 6(1)(a)) |
| Pilot communications | Email, channel references | Consent or Contract |
| Security and audit | Session metadata, action IDs | Legitimate interests (Art. 6(1)(f)) |
| Policy acceptance | UID, timestamp, version | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Relevant records | Legal obligation (Art. 6(1)(c)) |
Young people, 16+ access, and under-16 access
Pathfinder is written for students as well as adults. We aim to explain what data is collected, why it is used, who can see it, and how to ask for help in clear language. If anything in this notice is unclear, contact jessejr@decentre.io.
The current controlled live phase is limited to users aged 16 or over. Under-16 access is not enabled. If you are under 16, do not create an account or submit personal information. Parent or guardian permission does not override this limit unless a later under-16 launch gate is approved and published.
Parent, guardian, and advisor visibility
Where Pathfinder provides a parent, guardian, advisor, or operator view, that view is a role-scoped projection. It is intended to show only the information needed for that role, such as plan status, dates, support actions, account actions, or consent-filtered summaries. It is not a general right to read the student's full account, private chat, or unrelated personal information.
The lawful basis and visibility rule for those views is recorded separately from ordinary student access. Pathfinder should check the current Pea-owned consent and visibility state before showing shared information.
Retention schedule
| Data category | Retention |
|---|---|
| Account identity | Account duration + 12 months |
| Plan and application data | Account duration + 12 months |
| Chat history | Rolling 6-month window |
| Draft content | Until deleted or account closure + 12 months |
| Policy acceptance records | 3 years |
| Session / audit logs | 12 months |
| Billing records | 7 years |
Processors and international transfers
| Processor | Role | Transfer basis |
|---|---|---|
| Google / Firebase | Auth, hosting, Firestore | UK adequacy / SCCs |
| Google Cloud Platform | Infrastructure, Cloud SQL | UK adequacy / SCCs |
| AI provider (OpenRouter) | Chat processing | SCCs |
| Stripe | Billing | SCCs |
Your rights under UK GDPR
- Right to be informed — this declaration fulfils that obligation.
- Right of access — request a copy of your personal data. We respond within one calendar month.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — ask us to delete your data. We act within one month; some data is retained where required by law.
- Right to restriction — ask us to limit processing while a concern is resolved.
- Right to portability — receive your data in a structured, machine-readable format (where processing is by contract or consent).
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — withdraw at any time; does not affect prior processing.
- Rights regarding automated decisions — Pathfinder AI generates suggestions, not binding decisions. You can request human review of any AI recommendation.
Children’s rights
If you are under 18, you have the same rights as adults. Parents and guardians with parental responsibility may also exercise rights on your behalf where appropriate. Under-16 use is disabled during this controlled live phase.
How to exercise your rights
Email: jessejr@decentre.io — state which right you wish to exercise. We will acknowledge within 5 working days, verify your identity, and respond within one calendar month. Requests are free of charge.
Right to complain to the ICO
If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO).
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We encourage you to contact us first so we can try to resolve your concern.