Privacy Policy

What personal information BuddyPath collects, why, who it goes to, and what you can do about it.

Version v1-2026-08

1. Who is responsible

BuddyPath, LLC, a Florida limited liability company, is responsible for the personal information described here. Privacy questions and requests go to support@buddypath.com.

2. What we collect

Things you give us

Account: email address, password (stored hashed, never in readable form), display name, username.
Profile: demographic details you enter at onboarding, the Life Paths and topics you pick, your headline and written sections, your rate if you are a mentor, and your profile picture and video bio if you upload them.
Your intake interview: BuddyPath’s onboarding interview is conducted by an AI interviewer. We process the audio you speak and the resulting transcript, and we use them to draft the summaries that appear on your profile. You review and can edit that text before it is published.
Personality quiz answers and result, including from people who take the public quiz without an account.
Messages and chat, including conversations with the AI buddy assistant, and any goals or notes you record.
Reviews you write and receive.
Support requests and anything you send us in them.
Mentors only — your Form W-9. If you mentor on BuddyPath we ask you for the IRS form we need in order to report what we pay you: your legal name, any business name, your tax classification, your address, and your taxpayer identification number (a Social Security number or an EIN), with your signed certification. We ask for this because BuddyPath pays you directly, so the obligation to report is ours. Stripe collects its own identity details separately and gives us only the last four digits, which is not enough to report with.
Your taxpayer identification number is encrypted in our database, is never shown back to you or anyone else once entered, and is never written to our logs. Only the last four digits are visible to us, and nobody at BuddyPath can look up the full number through the app. Mentees never give us one at all.

Things that come from using the service

Sessions: who met whom, when, for how long, and what it cost. Live calls are carried over LiveKit. Call transcription is a feature we can enable per environment and is off by default; if it is ever turned on for calls you take part in, you will be told in the call itself before it starts.
Payments: wallet balance, top-ups, holds, charges, payouts. Card details are handled by Stripe — they reach us only as a token and the last four digits, never a full card number.
Technical logs: IP address, browser and device information, and request logs, kept for security and debugging.
Page views inside the app, recorded only where we have deliberately enabled that first-party measurement. There is no third-party advertising or analytics tracker in the BuddyPath app.

Mentor background checks

If you are a mentor and choose to get the verification badge, your details are passed to a consumer reporting agency which performs the check and returns a report. That is a consumer report under the Fair Credit Reporting Act, and the separate notices, authorisations and dispute rights you are given in that flow — not this policy — govern it. We store the outcome, the dates, and the identifiers needed to look the report up. Background checks are optional; if you never start one, we hold none of this.

3. Why we use it

to run your account and let you sign in;
to match mentees with mentors — your interview, profile, and chosen topics are what the matching engine reads;
to run sessions, take payment, and pay mentors;
to keep people safe: screening intake interviews, reviewing reports, enforcing the Acceptable Use rules;
to support you and answer what you ask us;
to show public profiles, and to show listed mentors on our own marketing site (see section 6);
to meet legal, tax and accounting obligations.

4. AI processing

Several parts of BuddyPath are built on AI models run by other companies. What that means concretely:

Google (Gemini) processes interview and chat text, drafts profile summaries, and powers screening and matching support.
ElevenLabs both transcribes and speaks. The audio you speak in an interview or a transcribed call is streamed to ElevenLabs, which returns the text of what you said; it also turns the interviewer’s replies back into speech. Your recorded voice reaches them, not just the words we send to be read out.
Simli renders the interviewer’s animated video.
LiveKit carries the live audio and video for interviews and sessions.

We do not use your conversations to train our own models, and we do not sell them.

AI output can be wrong. Anything a model writes about you on your profile is yours to correct before it is published, and anything it tells you is not professional advice.

5. Who else sees it

We do not sell personal information. We share it with service providers who process it on our behalf, under contract, for the purposes above:

Amazon Web Services — hosting, databases, and file storage;
Stripe — payments, wallet top-ups and mentor payouts;
LiveKit, Google, ElevenLabs, Simli — as described in section 4;
Resend — transactional email such as verification and password resets;
backgroundchecks.com — mentor background checks, where you ask for one;
LeadConnector — the support form embedded in the app;
Notion — only if you personally connect your Notion account to the buddy assistant, and only for what you ask it to do.

We also disclose information where the law requires it, to protect someone’s safety, or as part of a merger or sale of the business (in which case this policy follows the data).

6. What is public

Some of this is public by design, and it is worth being exact about which parts:

Your profile page is readable by anyone on the internet while your profile is public.
Listed mentors appear on our marketing website — name, photo, headline, tags, rate, average rating and completed-session count. Turning on the private setting under Security → Privacy removes you from both surfaces; the marketing site caches its list, so allow up to 15 minutes.
Profile pictures and video bios are stored at unguessable web addresses that do not themselves require a login. The address is not published anywhere except on your profile, but anyone who has the link can open the file. Please do not upload anything you would not want seen if the link were shared.
Video testimonials are governed by the separate, versioned consent you sign at the time, which names exactly what is published and lets you withdraw it.
Reviews appear on a mentor’s public profile without the reviewer’s name.

7. How long we keep it

Account and profile data for as long as your account exists.
Mentor Form W-9 for as long as your account exists, and after that for as long as tax law requires us to keep records of what we paid you. Replacing your W-9 replaces the stored one; we do not keep the superseded copy.
Interview audio and transcripts: the audio you speak is processed as it is spoken and is not stored — we keep no recording of an interview or a call. The transcript we keep for as long as your account exists, so your profile can be regenerated and so a screening decision can be reviewed. That is the setting on every BuddyPath environment today. We intend to stop retaining them by default once the product leaves early access; if that changes, it changes in a new version of this policy and not quietly.
Quiz results taken without an account are deleted after 30 days unless you claim them onto an account.
Testimonial recordings that are never published, or never finished, are deleted within 30 days, as the consent says.
Payment and payout records for as long as tax and accounting rules require.
Security logs for a limited period for investigation.

When you delete your account we delete or anonymise your personal information, except what we must keep for legal, tax, or dispute reasons. Published testimonials are taken down.

8. Security

Traffic is encrypted in transit. Passwords are hashed. Access to production data is restricted to the people who need it. Public media objects are addressed by unguessable keys as described above. No system is perfectly secure; if a breach affects you we will tell you as required.

9. Your choices

Edit or correct anything on your profile at any time, including text an AI drafted.
Go private under Security → Privacy, which removes you from public and marketing surfaces.
Pause new connections without hiding your profile.
Withdraw a testimonial at any time.
Get a copy of your data, or ask us to delete it, by writing to support@buddypath.com. We will verify it is you before acting.

10. Children

BuddyPath is for adults aged 18 or over. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to support@buddypath.com and we will delete it.

11. Where we operate

BuddyPath is operated from the United States and information is stored there. We have not assessed this service against the GDPR or UK data protection law and it is not offered on that basis.

12. Cookies

The app sets only the cookies it needs to work: a session cookie that keeps you signed in, a short-lived cookie that carries a quiz result to a new account, and — while the site is in early access — a cookie that remembers you have passed the access gate. There are no advertising cookies in the app.

13. Changes

We version this policy rather than editing it in place. A change that affects you is published as a new version with a new effective date, and we will tell you before it applies.