Privacy Policy
Last updated: 15 October 2026
This Privacy Policy explains how The Path collects, uses, shares, and protects your personal data when you access or use our platform at www.thepath.ooo and any related applications, services, and features (collectively, the “Services”).
We are committed to protecting your privacy and to processing your personal data lawfully, fairly, and transparently in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable Romanian data protection law.
1. Who we are and how to contact us
The Services are operated by the path (“The Path”, “we”, “us”, “our”).
For the purposes of the GDPR, The Path is the data controller of the personal data described in this Policy.
For any privacy question, or to exercise your rights, contact us at privacy@thepath.ooo. If we have appointed a Data Protection Officer, their contact details will be published here.
2. The personal data we collect
2.1 Data you provide to us
Account and identity data — your name, email address, and the role(s) you select at onboarding (practitioner, facilitator, space representative or manager, event organiser).
Profile data — your photo, cover image, bio, area of practice, city, and any other information you choose to add to your profile.
Facilitator and business data — where you operate as a creator, the details of your legal entities, spaces, classes, courses, events, schedules, pricing, availability, and contact details. Where you onboard for payouts, our payment provider collects identity and verification information directly from you (see Section 4).
Bookings and transaction data — records of the sessions and events you book or host, seat counts, booking and waitlist status, and the metadata of each transaction (amounts, currency, fees, dates).
Payment data — we do not store your full card number or card security details. Card payments are processed by our payment provider on their own systems; we retain only a token reference and the transaction metadata described above.
Content you create — messages you send through the in-app chat, reviews you write, listings you publish, and any other content you submit.
Communications and support data — the content of your correspondence with us, including support requests, reports, and feedback.
2.2 Data we collect automatically
Device and connection data — IP address, browser type, operating system, device identifiers, and similar technical information.
Usage and log data — pages and features you interact with, actions you take, access times, and error logs.
Cookies and similar technologies — see Section 8.
Approximate location — derived from your IP address. We do not collect your precise location: if you sort a list by distance, your browser may ask to share your location, and it is used on your device to order the list without being sent to us.
Time zone — your device’s time zone, saved with your profile so that emails show times in your own zone.
2.3 Data we receive from third parties
We receive limited data from our payment and identity verification provider (for example, payout-account and verification status), from our authentication provider, and — where you arrive through a referral link — referral attribution data.
3. How and why we use your personal data
We use your personal data only where we have a lawful basis to do so under Article 6 of the GDPR. The table below sets out each purpose and its legal basis.
To provide the Services and perform our contract with you — creating and managing your account, enabling discovery, booking, scheduling, messaging, and hosting. Legal basis: performance of a contract (Art. 6(1)(b)).
To process bookings, payments, payouts, and refunds — including calculating fees, routing payouts, and handling cancellations and waitlists. Legal basis: performance of a contract (Art. 6(1)(b)); and, for invoicing, accounting, and tax records, compliance with a legal obligation (Art. 6(1)(c)).
To keep the platform safe and secure — authentication, fraud prevention, abuse detection, enforcing our Terms, and protecting users. Legal basis: our legitimate interests in operating a safe and trustworthy platform (Art. 6(1)(f)).
To communicate with you — sending transactional and service messages (booking confirmations, waitlist offers, security notices). Marketing communications are sent only with your consent, which you may withdraw at any time. Legal basis: performance of a contract (Art. 6(1)(b)) for service messages; consent (Art. 6(1)(a)) for marketing.
To improve and develop the Services — understanding how the Services are used, diagnosing problems, and developing new features. Legal basis: our legitimate interests in improving our Services (Art. 6(1)(f)).
To comply with our legal obligations — including tax, accounting, electronic invoicing, and responding to lawful requests from public authorities. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
To establish, exercise, or defend legal claims — handling disputes and protecting our rights. Legal basis: our legitimate interests (Art. 6(1)(f)).
4. How we share your personal data
4.1 With other users
The Path is a marketplace. By design, some of your data is shared with other users so that bookings can happen: a facilitator can see the booking and attendance information for their own sessions; a participant can see a facilitator’s public profile and listings.
We apply a participant-protective default: the booking venue owns the transaction, the facilitator sees aggregate attendance and can message you through the platform, and you control what you choose to share beyond that. We do not give facilitators a contact-detail export of participants.
4.2 With our service providers (processors)
We use carefully selected third parties to run the Services. They process personal data only on our instructions and under contract. They fall into the following categories:
Payment processing — Stripe — to take card payments, subscriptions and add-ons, and to verify the payout accounts of creators. You enter card details on Stripe’s own pages; they never reach our servers. Stripe also processes some of this data under its own privacy policy (stripe.com/privacy), for example to verify identities and prevent fraud.
Hosting, file storage, database and sign-in — Vercel and Neon — Vercel hosts the Services and stores uploaded photos; Neon stores our database and runs sign-in. Both keep this data in Frankfurt, Germany.
Transactional email — Resend — to send the service messages described in Section 3.
Maps and address search — Google Maps Platform — when you search for an address or pick a place on the map, what you type is sent to Google to find it.
Invoicing providers — SmartBill or Oblio — where a creator connects one, to issue the invoices required by law.
Error logs — kept by our hosting provider for a short time to keep the Services reliable.
4.3 For legal and safety reasons
We may disclose personal data where we believe in good faith it is necessary to comply with the law, respond to a lawful request, enforce our Terms, or protect the rights, property, or safety of The Path, our users, or the public.
4.4 In a business transfer
If The Path is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to the protections of this Policy.
4.5 We do not sell your personal data
We do not sell your personal data, and we do not share it for third-party advertising.
5. International data transfers
We aim to keep personal data within the European Economic Area (“EEA”): our servers, database and file storage are in Frankfurt, Germany. Some of our providers (for example Stripe, Resend and Google) are based in the United States. Where a service provider processes data outside the EEA, we ensure an appropriate safeguard is in place — an adequacy decision of the European Commission, or Standard Contractual Clauses approved by the European Commission, together with any additional measures required. You may contact us for more information about these safeguards.
6. How long we keep your data
We keep personal data only for as long as necessary for the purposes set out in this Policy.
Account and profile data — for as long as your account is open, and for a limited period after closure to handle any outstanding matters.
Transaction, invoicing, and accounting records — for the period required by Romanian accounting and tax law, which is longer than other retention periods.
Messages and content — for as long as the relevant conversation or listing exists, subject to your deletion rights.
Technical logs — for a short period sufficient for security and troubleshooting.
When you close your account, we delete or anonymise your personal data, except where we are required to retain it to comply with a legal obligation or to establish, exercise, or defend legal claims.
7. Your rights under the GDPR
Subject to the conditions and exceptions in the GDPR, you have the right to:
Access — obtain a copy of the personal data we hold about you.
Rectification — have inaccurate or incomplete data corrected.
Erasure — have your data deleted where there is no overriding reason for us to keep it. You can also delete your account directly from the account settings.
Restriction — ask us to limit how we use your data in certain circumstances.
Portability — receive the data you provided to us in a structured, commonly used, machine-readable format.
Objection — object to processing based on our legitimate interests, and object at any time to processing for direct marketing.
Withdraw consent — where we rely on your consent, withdraw it at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, contact us at privacy@thepath.ooo. We will respond within the time limits set by the GDPR.
You also have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the supervisory authority in your country of residence.
8. Cookies and similar technologies
We use cookies and similar technologies to operate and improve the Services. These fall into two groups: strictly necessary (for example, keeping you signed in and securing your session — these cannot be switched off) and functional (remembering your preferences, and the referral or offer link you arrived through). We do not use analytics or advertising cookies.
You can control non-essential cookies through your browser settings and, where provided, through our in-product cookie controls. Disabling some cookies may affect how the Services work.
9. How we protect your data
We use technical and organisational measures designed to protect personal data, including encryption of data in transit, encryption of message content at rest, access controls, and the use of a PCI-DSS-compliant payment provider so that card data never sits on our own servers.
No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential.
10. Children
The Services are intended for users aged 18 and over. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Third-party links
The Services may contain links to third-party websites and services that we do not operate or control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy policies.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Where the changes are material, we will give you reasonable advance notice by email and/or by a prominent notice within the Services before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.
13. Contact us
If you have any questions about this Privacy Policy or how we handle your personal data, contact us at:
Email: privacy@thepath.ooo
Website: www.thepath.ooo