Privacy Policy

1. Overview

Pathayo (“we”, “us”, “our”) operates the platform at pathayo.com and the associated CloseLoop AI agent. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Pathayo, you agree to the practices described here.

2. Information We Collect

Account information

When you sign up we collect your name, email address, and a password (stored as a salted hash). We also store workspace names and member assignments you create.

Meeting content

When you invite the CloseLoop agent to a meeting, we receive the meeting URL, transcript, and metadata from Recall.ai. The transcript is processed by an LLM to extract decisions, tasks, owners, and risks. The transcript and derived items are stored in your workspace and may be retained for the lifetime of your account unless you delete them.

Integration data

If you connect GitHub, Slack, Jira, Linear, or Google Calendar, we receive OAuth tokens and the activity data those services expose (commits, PRs, messages, tickets, events). Tokens are encrypted at rest and scoped to the minimum permissions required.

Usage and technical data

We collect server logs, IP addresses, browser type, and product usage events needed to operate, secure, and improve the service.

3. How We Use Information

• To provide the meeting capture, extraction, and tracking features.
• To send nudges, escalation alerts, reports, and account emails.
• To synchronize your workspace data with connected integrations.
• To maintain a per-workspace knowledge graph memory used by the AI agent.
• To detect abuse, secure the platform, and comply with legal obligations.
• To analyze aggregate usage and improve product quality.

4. AI Processing

Transcripts and workspace context are processed by third-party LLM providers (such as Google Gemini, OpenAI, and Cerebras) to extract structured information and generate reports. These providers may retain transient request data according to their own policies. We do not sell your data to any third party, including AI providers.

5. Data Storage and Security

Data is stored in encrypted PostgreSQL databases (Neon), with caching in Redis (Upstash) and graph data in FalkorDB. All connections use TLS. Integration credentials are encrypted at rest with a dedicated encryption key. Access to production infrastructure is restricted to authorized personnel and audited.

Each workspace is isolated: knowledge graph memory, integration tokens, and meeting data are scoped to your workspace and are not shared across workspaces.

6. Data Retention

We retain your data for as long as your account is active. You can delete individual meetings, tasks, or your entire workspace at any time from the product. When you delete a workspace, we remove the associated meeting content, extracted items, integration tokens, and knowledge graph memory within 30 days. Server logs are retained for up to 90 days for security and debugging.

7. Your Rights

You can access, export, correct, or delete your personal data from within the product or by emailing support@mail.pathayo.com. Depending on your jurisdiction (GDPR, CCPA, DPDP Act 2023, etc.) you may have additional rights including the right to object to processing, restrict processing, and lodge a complaint with a supervisory authority.

8. Cookies and Local Storage

Pathayo uses a first-party authentication cookie and local storage to keep you signed in and remember your selected workspace. We do not use third-party advertising cookies.

9. Sharing and Subprocessors

We share data only with subprocessors that help us run the platform: Google Cloud Platform (hosting), Neon (PostgreSQL), Upstash (Redis), Recall.ai (meeting capture), Google Gemini / OpenAI / Cerebras (LLM inference), Clerk (authentication), and Razorpay (payments). Each subprocessor is bound by data processing agreements. We never sell your personal data.

10. Children's Privacy

Pathayo is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has signed up, contact us and we will remove the account.

11. International Transfers

Your data may be processed in the United States, the European Union, and India depending on the subprocessor. We rely on Standard Contractual Clauses and equivalent safeguards for cross-border transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-product banner at least 7 days before they take effect. The “Last updated” date above always reflects the current version.

13. Contact

Questions about this policy or your data can be sent to support@mail.pathayo.com.