Privacy Policy
Draft pending legal review. This document is a working draft and does not yet constitute the final, legally-reviewed policy.
Client Path Ltd ("Client Path", "we", "us") provides an agentic CRM available at clientpath.pro (the "Service"). This Privacy Policy explains what personal data we process, why, and the rights you have. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.
We are the controller of personal data about our own users (the people who sign in and use the Service). Where you upload or generate data about your own prospects and contacts using the Service, you are the controller and we act as your processor — that relationship is governed by our Data Processing Addendum, not this policy.
Who we are
- Controller: Client Path Ltd, a company registered in England and Wales (company number [PLACEHOLDER: Companies House number]).
- Registered office: [PLACEHOLDER: registered office address].
- ICO registration: [PLACEHOLDER: ICO registration number].
- Data protection contact: dpo@clientpath.pro.
What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, organisation, role | You, at sign-up |
| Authentication data | Passkey/WebAuthn credentials, magic-link tokens, session records | You / your browser |
| Billing data | Subscription tier, credit balances, invoices, partial card metadata | You and our payment processor (Stripe) |
| Usage data | Pages viewed, features used, research runs initiated, audit logs | Generated as you use the Service |
| Technical data | IP address, browser/device type, approximate location | Your device, automatically |
| Support data | Messages you send us, their contents | You |
We do not intentionally collect special-category data about our users. Please do not send it to us via support channels.
How we use it and our legal bases
- To provide the Service — create your account, authenticate you, run the features you request. Legal basis: performance of a contract.
- To bill you — manage subscriptions, credits, and invoices. Legal basis: performance of a contract.
- To secure and operate the Service — fraud prevention, abuse detection, audit logging, debugging. Legal basis: legitimate interests (keeping the Service secure and reliable).
- To communicate with you — service notices, security alerts, and (where you have not opted out) product updates. Legal basis: legitimate interests / consent for marketing.
- To comply with law — tax, accounting, and responding to lawful requests. Legal basis: legal obligation.
AI processing
The Service uses large language models, accessed through [PLACEHOLDER: name your LLM gateway / sub-processors — e.g. Vercel AI Gateway and the underlying model providers], to generate research, scores, and draft outreach. We do not use your data or your prospects' data to train third-party foundation models, and our LLM provider arrangements are configured for zero data retention where available ([PLACEHOLDER: confirm ZDR status with each provider]).
Sharing and sub-processors
We share personal data only with vendors who process it on our behalf under contract. Our current sub-processors include:
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting & serverless compute | [PLACEHOLDER: region] |
| Neon Inc. | Managed Postgres database | [PLACEHOLDER: region] |
| Stripe, Inc. | Payment processing | US / EU |
| Resend | Transactional email delivery | [PLACEHOLDER: region] |
| Tavily | Web research retrieval | [PLACEHOLDER: region] |
| [PLACEHOLDER: LLM provider(s)] | AI generation | [PLACEHOLDER: region] |
| Sentry | Error monitoring | [PLACEHOLDER: region] |
A current sub-processor list is maintained in our DPA. We will give notice of changes as described there. We do not sell personal data.
International transfers
Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required following a transfer risk assessment. [PLACEHOLDER: confirm the transfer mechanism in place with each sub-processor.]
Retention
We keep personal data only as long as necessary for the purposes above:
- Account data — for the life of your account and [PLACEHOLDER: retention period, e.g. 30 days] after deletion, then erased.
- Billing records — [PLACEHOLDER: e.g. 6 years] to meet UK accounting/tax law.
- Audit and security logs — [PLACEHOLDER: retention period].
When you delete your account, we erase or anonymise your personal data on the schedule above, except where we must retain it to meet a legal obligation.
Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent. You can exercise the core rights yourself in-product:
- Access / portability — export your data from your account settings.
- Erasure — delete your account from your account settings.
For anything else, email privacy@clientpath.pro and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we ask that you contact us first so we can try to resolve your concern.
Cookies
We use a small number of cookies and similar technologies. See our Cookie Policy for details and your controls.
Changes
We may update this policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, notify you by email or in-product.
Contact
Questions about this policy or your data: privacy@clientpath.pro.