Privacy Policy
Effective 6 September 2026 · Version 1.7
Applies to users of Path2Negotiate, with additional rights for users in the European Union, European Economic Area, United Kingdom, and other jurisdictions where applicable.
Privacy at a glance
- Who we are. Path2Negotiate is an online training product for everyday business negotiation — short theory, timed recognition cards, and live drills against a simulated counterpart. It is not a coaching service, an assessment tool, or anything your employer sees.
- What we collect. Account details, training activity (your card answers, your drill responses, scores, progress and streaks), payment-related information, and technical data such as device and usage information.
- What we never keep. Audio. Voice answers are transcribed in transit and the recording is discarded. We also never see or store a card number.
- Analytics. One tool, Amplitude.
- Your rights. Export and delete your data.
- Age. The Service is for adults (18+).
This summary is for convenience only. The full Policy below is what governs.
This Privacy Policy (the "Policy") explains how Path2Negotiate ("Path2Negotiate", "we", "us", or "our") collects, uses, shares and protects personal data about you when you access or use the Path2Negotiate website and related online services (together, the "Service"). For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and equivalent laws, Path2Negotiate is the controller of the personal data described in this Policy.
This Policy should be read together with our Terms of Use. Capitalized terms that are not defined here have the meaning given to them there. This Policy explains how we process personal data; it is not itself a consent mechanism. Where we rely on consent, we ask for it separately.
Contents
- 1. Introduction and scope
- 2. Information we collect
- 3. How we use information
- 4. Cookies and similar technologies
- 5. How we share information
- 6. Analytics and automated processing
- 7. Data retention
- 8. Data security
- 9. International data transfers
- 10. Your privacy rights — EU, EEA and UK
- 11. Additional privacy rights for certain US residents
- 12. Children's privacy
- 13. Third-party links and services
- 14. Changes to this Policy
- 15. How to contact us
1. Introduction and scope
This Policy applies to personal data we process about visitors to our website, registered users and customers of the Service, wherever you access it. It does not apply to the practices of third parties we do not own or control, including payment networks and other websites linked from the Service. Those third parties have their own privacy policies, which we encourage you to review.
The operating entity is Gestoa, established in Spain. Path2Negotiate is a Gestoa product; the two are separate services and this Policy covers Path2Negotiate only. We process personal data under the GDPR and the Spanish Organic Law 3/2018 ("LOPDGDD"), under the UK GDPR and the Data Protection Act 2018 for users in the United Kingdom, and under applicable United States state privacy laws.
Path2Negotiate is a training product, not an assessment or HR tool.
2. Information we collect
2.1 Information you provide to us
- Account and registration data. There are no passwords. You sign in with an email magic link, or with LinkedIn or GitHub, so we store your email address and the identifier from the provider you used. On first sign-in we ask once for your role (founder, team lead, engineering manager, department head, or other) and your company size as a band.
- Profile and preferences. Your time zone, which sets the dates shown to you.
- Payment-related data. If you buy access, card details are collected and processed directly by our payment provider, Stripe, on Stripe's own checkout page. We receive limited information — that the payment succeeded, and a reference for it — together with what you bought and the price. Stripe may also process certain payment data as an independent controller for its own legal, security, fraud-prevention and regulatory obligations, as described in its own privacy policy.
- Support and communications. The content of messages you send us, including anything you choose to include in them.
2.2 Training Activity Data
Using the Service generates information we call "Training Activity Data":
- Card attempts — the option you picked, whether it was contraindicated, whether you ran out of time, when you revealed the options and how long you took to answer.
- Drill turns — the text of what you said or typed, whether the turn was spoken or typed, and how long you spoke for.
- Drill verdicts — whether you used the tactic, which default you fell into, the written correction, and which model and prompt version produced it.
- Progress — your per-tactic review schedule, how often you leak value, how many tactics you have covered, streaks, and your session history.
No audio is ever stored. A spoken answer is streamed for transcription and the recording is discarded; we keep its duration and the resulting text. Training Activity Data reflects your use of practice exercises. It is not a professional evaluation.
2.3 The public demo
The card on our home page can be answered without an account. Two separate things happen when you answer it.
- In our database we record the card, the option chosen, whether it was a leak, the campaign source and the time. That row carries no user id, IP address or cookie id.
- In our analytics, if you have switched analytics on, Amplitude is running on the home page as on every public page. It sets an id for your browser, receives your IP address, and measures what you do on the page — including answering the demo. That record is held by Amplitude against the browser id, for as long as the cookies in our Cookies Policy last.
2.4 Information collected automatically
- Device and connection data — IP address, device type, operating system, browser type and language settings.
- Usage and log data — pages and screens viewed, features used, dates and times of access, session duration, and diagnostic data.
- Approximate location — a general, non-precise location such as country, inferred from your IP address. We do not collect precise location.
- Cookies and similar technologies — as described in §4.
2.5 Information we receive from third parties
- Sign-in providers. If you sign in with LinkedIn or GitHub we receive your email address and an account identifier from them, depending on the provider and your settings. The handshake is performed by Supabase; we never see your password for those accounts.
- Payment processor. Payment status and a transaction reference from Stripe, as described above.
- Analytics provider. Measurement information from Amplitude, used as described in §6.
2.6 Special category and sensitive data
We do not intentionally collect special categories of personal data under the GDPR, such as health data, biometric data, political opinions, religious beliefs or trade-union membership.
One part of the Service needs particular care. A drill asks you to talk about a real workplace situation, so what you say may incidentally contain details about colleagues, salaries or conflicts. Please avoid naming people, and do not include information about others.
2.7 Our record of your cookie choice
When you accept, reject or save cookie preferences we keep one line recording the choice, whether it withdrew something previously granted, whether you answered the banner or reopened it from the footer, whether your browser sent Global Privacy Control, which version of the Cookies Policy you were shown, which round of the consent question you were answering, and the time. We are required to be able to demonstrate that consent was given and that a withdrawal was acted on, and that line is how we do it.
It carries no account id, cookie id, browser fingerprint or user agent. The consent-round marker is a fixed label, identical for every visitor. The only element relating to you is your IP address put through a one-way keyed hash, which cannot be reversed without a secret held separately on our servers, so the record cannot be joined to your account or to your demo answer. See the Cookies Policy §5.1.
3. How we use information
We use personal data for the following purposes:
- to create and manage your account and provide the Service;
- to run the training loop — serve cards and drills, score them, schedule your reviews and show your progress;
- to generate the counterpart's reply in a drill and grade your answer against a reviewed rubric;
- to process payments and grant the access you bought or redeemed, and to maintain transaction records;
- to communicate with you about the Service, including service messages and support responses;
- to keep the Service secure and available, to detect and prevent abuse, and to enforce per-user spend ceilings so that one account cannot exhaust the Service for everyone;
- to understand whether the product works — which cards are hard, whether value held improves — and which campaigns bring qualified users;
- to comply with legal obligations and to establish, exercise or defend legal claims.
We do not use your Training Activity Data or your drill text for advertising, and we do not build a marketing profile from it. There is no advertising on the Service at all.
3.1 Legal bases for processing (EU/EEA/UK)
| Processing activity | Personal data involved | Legal basis |
|---|---|---|
| Create and manage your account, and sign you in | Email address, sign-in provider identifier, profile settings | Performance of a contract — Art. 6(1)(b) |
| Serve cards and drills, score them, schedule reviews, show progress | Training Activity Data, profile preferences | Performance of a contract — Art. 6(1)(b) |
| Generate the counterpart's reply and grade the drill against its rubric | Drill response text and the drill brief | Performance of a contract — Art. 6(1)(b) |
| Process payments and grant the access you bought; keep proof of a sale | Payment reference and status from Stripe, entitlements, access code redeemed | Performance of a contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Security, abuse detection, service availability, per-user spend ceilings, and logging staff actions on an account | Device and log data, IP address, cost records, admin action log | Legitimate interests — Art. 6(1)(f) |
| Understand whether the product works, and which campaigns bring qualified users | Training Activity Data in aggregate, purchase-intent records, campaign source | Legitimate interests — Art. 6(1)(f) |
| Support and service communications | Contact details, support messages, account information | Performance of a contract — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Product analytics using non-essential cookies and similar technologies | Cookie ids, device data, usage events | Consent — Art. 6(1)(a) and applicable ePrivacy rules |
| Keep a record that you gave or withdrew cookie consent | Hashed IP address, the choice made, browser opt-out signal, policy version, timestamp | Legal obligation — Art. 6(1)(c), read with Art. 7(1) |
| Comply with legal obligations and defend legal claims | Relevant account, transaction, support and log data | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
Where we rely on consent you may withdraw it at any time, without affecting processing carried out before you did.
3.2 When providing data is required
An email address is required to have an account at all, and payment details are required to buy access. Your role, company size and time zone are optional; the Service works without them, and they exist so that we can tell who the product is reaching and show you dates in your own zone.
4. Cookies and similar technologies
We use cookies, local storage and similar technologies to keep you signed in, remember your preferences, and — with your consent — measure how the public site is used. We group them into two categories:
- Strictly necessary — authentication and security, plus the local-storage entries that remember your cookie choice and your light/dark preference. These cannot be switched off, and are exempt from consent under the ePrivacy rules.
- Analytics — off unless you switch them on.
There is no advertising category, because there is no advertising.
We ask for consent before setting any non-essential technology. Every optional signal is set to denied before the tag container is allowed to load, our banner offers refusing as plainly as accepting, uses no pre-ticked boxes, and lets you change your mind at any time from the footer of any page. If your browser sends a recognised opt-out signal such as Global Privacy Control, we honour it automatically and nothing optional runs at all, unless you tell us otherwise in the banner for this site.
| Technology | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| Session / authentication cookie | Supabase, on our behalf | Keeps you signed in and secures your session | Strictly necessary | Until you sign out or it expires |
| Consent and theme preference (local storage) | Path2Negotiate | Remembers your cookie choice and light/dark setting | Strictly necessary | Until you clear site data |
| Product analytics cookies | Amplitude | Identifies this browser and its session so a return visit is not counted as a new person; remembers the campaign you arrived from | Analytics — consent required | Up to 12 months |
| Tag container | Google Tag Manager | Loads the analytics tag according to your consent | Strictly necessary to deliver the above | No cookie |
Full detail, cookie by cookie, is in our Cookies Policy.
5. How we share information
We do not sell personal data, and we do not share your Training Activity Data or your drill text with advertisers for any purpose. We share personal data only as described below.
Service providers and processors — vendors that process data on our behalf, under our instructions, and under a data-processing agreement as required by GDPR Art. 28:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database, authentication and sign-in email | Account and Training Activity Data, held in the EU (eu-west-1, Ireland) |
| Vercel | Hosting and server functions | Request and technical data; functions run in Dublin (dub1) |
| Anthropic | Plays the drill counterpart and grades against the rubric | Your drill response text and the drill brief |
| Deepgram | Speech-to-text for spoken drill answers | Drill audio, in transit only — converted to text and not retained |
| Stripe | Payments and checkout | Your card details, entered on Stripe's own checkout page. We receive the result, never the card |
| Amplitude | Product analytics | Usage and device data, only with your consent; EU ingestion endpoint |
| Tag management only — no Google Analytics | The request that fetches the tag container: IP address, browser and page address |
Beyond those providers, we disclose personal data only:
- for legal, safety and compliance reasons — where we believe in good faith that disclosure is necessary to comply with law, regulation or legal process, to enforce our Terms of Use, or to protect the rights, property or safety of Path2Negotiate, our users or others;
- in a business transfer — in connection with a merger, acquisition, financing, reorganisation or sale of assets, in which case personal data may transfer as a business asset, subject to this Policy. We will tell you if that happens;
- with your consent or at your direction, for any other purpose disclosed to you at the time; and
- as aggregated or de-identified data that no longer reasonably identifies you.
6. Analytics and automated processing
6.1 Analytics
We use one analytics tool, Amplitude, to understand which steps people complete and where they give up. It runs on the public pages and, once you are signed in, inside the product as well — only ever with your consent. Amplitude sends our data to its EU endpoint. It is loaded through Google Tag Manager, which is a tag loader and nothing more: it decides when Amplitude may run and collects no analytics of its own.
6.2 Automated processing and AI
A drill is scored automatically. A large language model plays the counterpart and grades your answer against a reviewed, per-drill rubric written in advance by us. Recognition cards involve no model — they are scored in our own database against an authored answer key.
Scoring produces training feedback and a per-tactic standing. It does not produce legal or similarly significant effects about you within the meaning of Article 22 GDPR, it is not shared with your employer, and it is not used in any decision about your employment, credit or eligibility. If you think a score is wrong, write to us and a person will look at it.
7. Data retention
We keep personal data for as long as necessary for the purposes described in this Policy, then delete or anonymise it.
| Data category | Retention |
|---|---|
| Drill audio | Never stored. Transcribed in transit, then discarded. |
| Account and profile data | For the life of your account. Deleted when you delete your account. |
| Training Activity Data — attempts, drill turns, verdicts, progress, streaks | For the life of your account, then deleted with it. |
| Entitlements and access-code redemptions | For the life of your account. |
| Transaction and tax records | For the period required by applicable tax and accounting law, which in Spain is generally up to 6 years. These survive account deletion because the law requires it. |
| Purchase-intent records | For the life of your account, then retained in aggregate. |
| Support communications | Up to 3 years after the last exchange, unless needed for a dispute or a legal claim. |
| Anonymous demo answers | Kept indefinitely as aggregate product data. They identify nobody, so there is nothing to delete. |
| Analytics data | Per Amplitude's retention settings — see the Cookies Policy. |
| Cookie-consent records | Up to 3 years from the choice, which is the period we could be asked to evidence it for. They carry no account id, so they are not removed by deleting your account — there is nothing in them to connect to it. |
Deleting your account removes the account row and everything keyed to it — every attempt, drill turn, verdict and progress record. We may retain data longer only where the law requires it, or to resolve a dispute or enforce our agreements.
8. Data security
We maintain technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse and alteration.
No method of transmission or storage is completely secure and we cannot guarantee absolute security. Tell us promptly at info@gestoa.com if you suspect unauthorised use of your account. Where the law requires it we will notify you and the relevant authority of a personal-data breach.
9. International data transfers
Our database, our server functions and our analytics data are all in the EU: Supabase in Ireland, Vercel functions in Dublin, Amplitude on its EU endpoint.
Some providers process personal data outside the EEA, including in the United States — Anthropic, Deepgram, Stripe and Google — and Amplitude, although it stores our data in the EU, is a US company whose staff may access it in support.
10. Your privacy rights — EU, EEA and UK
If you are in the European Union, the European Economic Area or the United Kingdom you have the following rights, subject to the conditions and exceptions in the GDPR and UK GDPR:
- Access — confirmation of whether we process your data, and a copy of it;
- Rectification — correction of inaccurate or incomplete data;
- Erasure — deletion in certain circumstances;
- Restriction — to restrict our processing in certain circumstances;
- Portability — to receive certain data in a structured, commonly used, machine-readable format;
- Objection — to object to processing based on our legitimate interests; and
- Withdraw consent — where we rely on consent, at any time, without affecting prior processing.
Write to info@gestoa.com and we will respond within one month of receiving your request, unless the GDPR permits an extension because of complexity or volume. We will not discriminate against you for exercising your rights.
Automated decision-making and profiling. We do not use your activity to make decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR. See §6.2.
Right to complain. You may lodge a complaint with a supervisory authority — in Spain the Agencia Española de Protección de Datos (aepd.es), in the UK the Information Commissioner's Office (ico.org.uk), or the authority where you live or work. We would appreciate the chance to address your concerns first.
11. Additional privacy rights for certain US residents
This section applies only where Path2Negotiate is subject to the relevant US state privacy law. Depending on your state, you may have rights under laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and comparable laws in states including Virginia, Colorado, Connecticut and Utah:
- Right to know or access the categories and specific pieces of personal data we have collected, the sources, the purposes and the categories of recipients;
- Right to delete personal data we collected from you;
- Right to correct inaccurate personal data;
- Right to opt out of the "sale" or "sharing" of personal data and of targeted advertising;
- Right to limit the use and disclosure of sensitive personal data, where applicable; and
- Right to non-discrimination for exercising your rights.
We do not sell personal data, we run no advertising, and we do not engage in targeted or cross-context behavioural advertising. Our use of analytics cookies could be treated as "sharing" under some state laws if you switch analytics on. You can opt out in the cookie banner from the footer of any page, or by enabling Global Privacy Control, which we honour for every visitor automatically and without you having to answer anything, unless you switch analytics on for this site yourself.
Categories collected and disclosed. In the preceding twelve months we collected the categories described in §2 — identifiers, account and commercial information, internet and usage activity, approximate location, and Training Activity Data — and disclosed them to the types of recipients in §5 for the purposes in §3. To exercise a right, write to info@gestoa.com. We verify requests using the information associated with your account and respond within the time the law allows.
12. Children's privacy
The Service is intended only for adults who are at least 18 years old. It is not directed to children and we do not knowingly collect personal data from them. If you are a parent or guardian and believe a child has given us personal data, write to info@gestoa.com and we will delete it. We do not knowingly sell or share the personal data of minors.
13. Third-party links and services
The Service links to third-party websites and services we do not own or control, including Stripe's checkout page and the sign-in providers. This Policy does not apply to them and we are not responsible for their privacy practices. We encourage you to review the privacy policy of every third party you interact with.
14. Changes to this Policy
We may update this Policy from time to time. If we make material changes we will post the updated Policy here with a new effective date and, where required by law or where the change materially affects your rights, give additional notice by email or in the app. Changes take effect when posted, unless stated otherwise or unless a later date is required by law. Where the law requires consent for a new processing activity, we will ask for it before starting.
15. How to contact us
Questions, requests and complaints about this Policy or our handling of personal data: info@gestoa.com.