Privacy Policy

1. Who we are

ScholarPath Ltd (company number 16302943), trading as "ScholarPath", is a company registered in England and Wales with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We operate the ScholarPath research workspace at scholarpath.education and are the data controller for personal data processed through the platform.

Contact us on privacy matters: [email protected]

2. Data we collect

• Account data — name, email address, hashed password.
• Research content — research questions, literature entries, meeting notes, thesis chapters, and all other data you enter into the workspace.
• Billing data — payment is processed by Stripe; we store only a Stripe customer ID and your subscription tier. We never see your card number.
• Usage data — AI feature usage (token counts, feature name, timestamp) to enforce fair-use limits.
• Technical logs — server access logs, error logs, and audit events (login, billing changes). Retained for up to 7 years for security and legal compliance.
• Cookies — a session cookie for authentication and a Cloudflare Turnstile cookie for bot protection. See our Cookie Policy.

3. Legal basis (UK/EU GDPR)

• Contract (Art. 6(1)(b)) — account data and research content are processed to deliver the service you signed up for.
• Legal obligation (Art. 6(1)(c)) — audit logs and billing records are retained to meet regulatory requirements.
• Legitimate interests (Art. 6(1)(f)) — security monitoring and abuse prevention.
• Consent (Art. 6(1)(a)) — marketing communications (where applicable).

4. How we use your data

• Providing, maintaining, and improving the ScholarPath platform.
• Processing payments via Stripe.
• Sending transactional emails (account verification, password reset, billing receipts).
• Enforcing AI usage limits and subscription tiers.
• Detecting and preventing fraud, abuse, and security incidents.
• Complying with legal obligations.

5. Third-party processors

SCCs = Standard Contractual Clauses under UK GDPR / EU GDPR Chapter V.

6. Data retention

• Research content — retained while your account is active. Soft-deleted items are permanently purged after 30 days.
• Backups — deleted when you delete your account or workspace.
• Audit logs — retained for 7 years to meet security and legal obligations.
• Billing records — retained for 7 years for tax and accounting compliance.

7. Your rights (UK/EU GDPR)

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Portability — export your research data at any time from Settings → Data Export (Art. 20).
• Rectification — correct inaccurate personal data.
• Erasure — delete your account and all associated data from Settings → Delete Account.
• Restriction — request that we limit processing of your data in certain circumstances.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing relies on consent, withdraw it at any time.

To exercise any right, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We protect your data with TLS in transit, AES-256 encryption for backups, bcrypt password hashing, TOTP two-factor authentication, and strict tenant isolation so no workspace can access another's data. Access to production systems is restricted and logged.

9. Changes to this policy

We may update this policy from time to time. We will notify you by email and display a notice in the platform at least 14 days before material changes take effect. Continued use after that date constitutes acceptance of the updated policy.

10. Contact

ScholarPath Ltd
Company number: 16302943
Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
[email protected]