Last updated: October 19, 2026
Pathbound is operated by Individual Entrepreneur ALEKSANDR SHAMAEV, trading as Pathbound, of v. Akhalsopeli, Kharagauli region, 4802, Georgia (“Pathbound”, “we”, “us”, “our”). We run the Pathbound platform (app.pathbound.ai), this website (pathbound.ai), the Pathbound Tracker service, the Pathbound MCP server (mcp.pathbound.ai), and related services (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Services.
We act in two capacities: as a data controller for data we collect about our own account holders, website visitors, and contacts who reach us directly; and as a data processor for data our customers route through the Services (contact records, company records, event streams, conversations imported from third-party systems). This policy primarily covers our controller activities. Our Data Processing Agreement governs our processor activities.
When you create a Pathbound account, we collect:
When our customers use the Pathbound platform, they connect data sources (CRMs, email accounts, support tools, databases, the Pathbound Tracker on their websites) and Pathbound ingests contact records, company records, event data, and conversation data from those sources into a unified customer profile. We process this data on behalf of our customers per their instructions. Our customers are the data controllers for this data and are responsible for ensuring they have a lawful basis for its collection and processing.
Our customers may deploy the Pathbound Tracker on their own websites. When deployed, the tracker collects information about visitors to those websites, including:
_ga cookie, where one is presentIP addresses are stored in full with the events they belong to, to support fraud prevention, troubleshooting, and rate limiting, and are kept for as long as those events (Section 6).
Our customers are the data controllers for tracker data collected on their websites. We process this data as a processor on their behalf. Customers are responsible for obtaining any consent required by law (including under GDPR, the ePrivacy Directive, UK PECR, and CCPA/CPRA) before deploying the tracker, and for disclosing the tracker’s data collection—including device fingerprinting—in their own privacy policies.
Pathbound exposes your data through the Pathbound REST API and the Pathbound MCP server (mcp.pathbound.ai). You may authorize clients of your choice—typically AI applications such as Claude.ai, Claude Desktop, ChatGPT, or Cursor, or your own backend code—via OAuth or API key to read and (with appropriate scopes) write data through these surfaces.
Pathbound does not embed or call any AI provider on its own. We do not send Customer Data to Anthropic, OpenAI, Google, Mistral, or any other model provider. When you connect an AI client to Pathbound, the AI client reads data from our API and may then forward that data to an AI provider for inference. That data flow is governed by your relationship with the AI client and the AI provider it uses, under their respective terms—Pathbound is not a party to it.
You can revoke any AI client’s access to Pathbound at any time from your account settings.
Customers can connect their own accounts with data providers (such as Apollo.io and Emailable) to enrich contact and company records. When a customer turns enrichment on, we send identifiers (such as email addresses or company domains) to that provider through the customer’s own connection and store what it returns—for example, job titles, company size, industry, publicly available professional information, or whether an email address can receive mail. We do this as a processor on the customer’s instructions; the provider’s own terms and privacy policy govern the data it holds.
When you purchase a paid plan, payment is processed by Paddle.com Market Ltd acting as our Merchant of Record. Paddle collects your payment details directly, and we never receive or store full card numbers. Paddle passes us limited billing information—such as your name, billing email, country, and the brand and last four digits of your card—so we can manage your subscription, provision access, and keep billing records. Paddle’s own privacy notice governs its processing of your payment data.
On pathbound.ai and app.pathbound.ai we are the controller, and we use:
None of these tools load for a visitor in the European Economic Area, the United Kingdom, or Switzerland, and a signup from there is not reported to Reddit or X. We tell where a visitor is from the country Cloudflare, our network provider, reports for the request, and treat an unknown country the same way. For other visitors the tools load when the page opens. Under California law, the advertising pixels and signup matching may count as “sharing” personal information for cross-context behavioral advertising. To opt out, or to have us delete the data these tools hold about you, email privacy@pathbound.ai. Browser tracking protection and ad blockers also stop them from loading.
If you connect a Gmail account, Pathbound uses Google user data only to provide the Gmail features you turn on, such as sending the email you or your AI client ask it to send. A Gmail mailbox connected since October 6, 2026 goes through Unipile, one of our sub-processors: you sign in on Google’s own page, where Unipile is named as the app asking for access, we ask for two permissions, reading mail and sending mail, and we read only conversations with people who are already contacts in your workspace. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models. Pathbound’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use the information we collect to:
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:
We share personal data with the following categories of third parties:
The third parties that hold or carry Customer Data for us are our sub-processors: Hetzner Online, Cloudflare, and Unipile. What each one handles and where is at pathbound.ai/subprocessors, and our Data Processing Agreement says how we give notice before we add one. Hetzner and Cloudflare host and carry the data about our own account holders and visitors as well.
These providers process data about our own account holders on our behalf:
Reddit, LinkedIn, and X receive the website and signup data described in Section 1.7 as independent controllers. None of them receives Customer Data.
Customers can connect third-party services through the Pathbound platform via OAuth or API key—for example HubSpot, Intercom, Apollo, Emailable, Resend, and tl;dv. The current list of supported integrations is at pathbound.ai/integrations. Customers can also configure their own external Postgres databases and external MCP servers as data sources.
When a customer connects an integration, Pathbound stores the OAuth tokens or API key for that connection (encrypted at the application layer) and pulls data from that service into the customer’s tenant on their instructions. The data flows between Pathbound and the integration provider are governed by the customer’s instructions and the respective provider’s terms. Those integration providers are sub-processors of the customer (not of Pathbound), and their own privacy policies apply to data they hold.
We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Pathbound, our users, or others.
Our Data Processing Agreement sets out our obligations for all Customer Data we process on behalf of customers: instructions, confidentiality, security, sub-processors, international transfers, notice of a security incident, help with data subject requests, and deletion. It forms part of our Terms and needs no signature.
We do not sell personal data, and we never use Customer Data for advertising. The only advertising-related sharing is the website and signup data described in Section 1.7.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
access_token | Authentication (JWT session) | 24 hours | Essential |
refresh_token | Keeps you signed in | 24 hours | Essential |
temp_2fa_token | Two-factor sign-in step | 10 minutes | Essential |
__Host-csrf | CSRF protection | Session | Essential |
__Host-oauth-binding, __Host-oauth-link | Ties a sign-in with Google or GitHub to the browser that started it | 10 minutes | Essential |
webauthn_session | Passkey sign-in step | 1 minute | Essential |
pathbound_visitor_id, _sellably_visitor_id (legacy name) | Visitor identification (Tracker, on customer sites and our own) | 365 days | Functional |
pathbound_session_id | Session tracking (Tracker, on customer sites and our own) | 1 day; a new session starts after 30 minutes of inactivity | Functional |
pathbound_external_contact_id | Links a visitor to a known contact once the site identifies them (Tracker) | 365 days | Functional |
pb_reddit_click_id, pb_x_click_id | Attributes a signup to the Reddit or X ad that was clicked (our sites only) | 30 days | Advertising |
In a mobile app’s webview, where cookies are not kept, the Tracker also keeps pathbound_visitor_id and pathbound_external_contact_id in the page’s local storage, for the same durations.
On our own sites, PostHog and the Reddit, LinkedIn, and X pixels also set their own cookies (see Section 1.7). Their names and durations are set by those providers.
The Pathbound Tracker uses device fingerprinting (a hashed combination of browser, screen, and device signals) to recognize returning visitors when cookies are unavailable or have been cleared. This technique does not itself use cookies but creates a statistical identifier based on device characteristics. Where required by applicable law, the Pathbound customer operating the website is responsible for obtaining the visitor’s consent before the tracker collects fingerprint data.
The Pathbound Tracker honors a pathbound_dnt=1 cookie. When this cookie is present, the tracker will not collect any data. Customers implementing the tracker can use this mechanism to respect visitor opt-out preferences. The tracker does not act on the browser’s Do Not Track or Global Privacy Control signals.
The periods below describe what we do today. Tracker events are part of the customer’s platform data: they are not deleted automatically after a fixed period, so they are kept for as long as the customer’s workspace exists unless the customer asks us to delete them sooner. You may request deletion at any time by contacting privacy@pathbound.ai.
| Category | Retention |
|---|---|
| Account data | Duration of your account, plus 30 days after deletion |
| Customer platform data (processor role) | Per the customer’s instructions; deleted within 30 days of account termination or written deletion request, except where retention is required by law |
| Tracker event data | For the life of the customer’s workspace; deleted within 30 days of account termination or a written deletion request |
| Device fingerprints | 90 days after last use |
| Workspace data exports | The download file is deleted after 7 days |
If you are in the EEA, UK, or Switzerland, you have the right to:
If you are a California resident, you have the right to:
We do not sell personal information as defined by the CCPA. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.
Self-service export. Workspace owners and admins can download their workspace’s data at any time from Settings → Data. The export is a ZIP archive of newline-delimited JSON—one file per record type, covering contacts, companies, deals, segments, form submissions, email conversations, activity history and tracked events—which satisfies the portability right above without needing to contact us. Download links expire after seven days, after which the generated file is deleted from our servers.
For every other request—including erasure, rectification and account deletion—contact us at privacy@pathbound.ai. We fulfill those manually and will respond within 30 days (GDPR) or 45 days (CCPA). If you are an end-user of a Pathbound customer’s website (i.e., your data was collected via the Pathbound Tracker), please direct your request to that customer, who is the data controller for your information; we will assist them in fulfilling your request.
Our application infrastructure operates in the United States. All data submitted to or collected through the Services—including account data, Customer Data ingested from connected sources, and tracker event data—is stored on US-based infrastructure: our self-hosted MongoDB database and Redis cache run on servers operated by Hetzner Online in Hillsboro, Oregon, and encrypted database backups are stored in Cloudflare R2. The one exception is an account a member links through Unipile, which Unipile holds in France. If you are accessing our Services from the EEA, UK, Switzerland, or other regions with data transfer restrictions, your data is transferred to and processed in the United States.
We are not certified under the EU-US Data Privacy Framework. For Customer Data, our Data Processing Agreement incorporates the EU Standard Contractual Clauses, the UK Addendum, and the corresponding Swiss amendments. EEA, UK, or Swiss data subjects may contact privacy@pathbound.ai to request information about the transfer mechanism applied to their data.
The measures that protect the data we hold are listed on our Trust page: encryption in transit and at rest, a second factor for every account, separation between customers, access to production, logging, and backups. We have not undergone a SOC 2, ISO 27001, or equivalent third-party audit. No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@pathbound.ai; our page on reporting a vulnerability says how we handle reports.
Our Services are not directed to individuals under 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. For significant changes affecting how we process your data, we will provide additional notice (such as email notification for account holders).
The controller for the data described in this policy is Individual Entrepreneur ALEKSANDR SHAMAEV, trading as Pathbound, identification number 105656718 in the Registry of Entrepreneurs of Georgia, of v. Akhalsopeli, Kharagauli region, 4802, Georgia. If you have questions about this Privacy Policy or our data practices, contact us at: