Last updated: July 15, 2026
Pathbound (“we”, “us”, “our”) runs the Pathbound platform (app.pathbound.ai), this website (pathbound.ai), the Pathbound Tracker service, the Pathbound MCP server (mcp.pathbound.ai), and related services (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Services.
We act in two capacities: as a data controller for data we collect about our own account holders, website visitors, and contacts who reach us directly; and as a data processor for data our customers route through the Services (contact records, company records, event streams, conversations imported from third-party systems). This policy primarily covers our controller activities. A separate Data Processing Agreement will govern processor activities; until that DPA is published, the processor commitments summarized in Section 4.4 apply.
When you create a Pathbound account, we collect:
When our customers use the Pathbound platform, they connect data sources (CRMs, email accounts, support tools, databases, the Pathbound Tracker on their websites) and Pathbound ingests contact records, company records, event data, and conversation data from those sources into a unified customer profile. We process this data on behalf of our customers per their instructions. Our customers are the data controllers for this data and are responsible for ensuring they have a lawful basis for its collection and processing.
Our customers may deploy the Pathbound Tracker on their own websites. When deployed, the tracker collects information about visitors to those websites, including:
IP addresses are stored to support fraud prevention, troubleshooting, and rate limiting. We are evaluating IP truncation/hashing for a future release; until then, full IPs are retained for the durations described in Section 6.
Our customers are the data controllers for tracker data collected on their websites. We process this data as a processor on their behalf. Customers are responsible for obtaining any consent required by law (including under GDPR, the ePrivacy Directive, UK PECR, and CCPA/CPRA) before deploying the tracker, and for disclosing the tracker’s data collection—including device fingerprinting—in their own privacy policies.
Pathbound exposes your data through the Pathbound REST API and the Pathbound MCP server (mcp.pathbound.ai). You may authorize clients of your choice—typically AI applications such as Claude.ai, Claude Desktop, ChatGPT, or Cursor, or your own backend code—via OAuth or API key to read and (with appropriate scopes) write data through these surfaces.
Pathbound does not embed or call any AI provider on its own. We do not send Customer Data to Anthropic, OpenAI, Google, Mistral, or any other model provider. When you connect an AI client to Pathbound, the AI client reads data from our API and may then forward that data to an AI provider for inference. That data flow is governed by your relationship with the AI client and the AI provider it uses, under their respective terms—Pathbound is not a party to it.
You can revoke any AI client’s access to Pathbound at any time from your account settings.
We integrate with third-party data providers (such as Apollo.io) to enrich contact and company records. When enrichment is used, we may send identifiers (such as email addresses or company domains) to these providers and receive additional business information in return—for example, job titles, company size, industry, and publicly available professional information. For this processing we may act as an independent controller alongside the customer; the enrichment provider’s own privacy policy governs their handling of the data they return.
When you purchase a paid plan, payment is processed by Paddle.com Market Ltd acting as our Merchant of Record. Paddle collects your payment details directly, and we never receive or store full card numbers. Paddle passes us limited billing information—such as your name, billing email, country, and the brand and last four digits of your card—so we can manage your subscription, provision access, and keep billing records. Paddle’s own privacy notice governs its processing of your payment data.
We use the information we collect to:
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:
We share personal data with the following categories of third parties:
The following third-party service providers process data on our behalf to deliver the Services. This list is the controller-side disclosure required by GDPR Article 13. A formal processor-side sub-processor list, with notification commitments for material changes, will be published alongside our Data Processing Agreement.
Customers can connect third-party services through the Pathbound platform via OAuth or API key. The current list of supported integrations is: Apollo, Calendly, Gmail, HubSpot, Intercom, Pipedrive, Resend, and tl;dv. Customers can also configure their own external Postgres databases and external MCP servers as data sources.
When a customer connects an integration, Pathbound stores the OAuth tokens (encrypted at the application layer) and pulls data from that service into the customer’s tenant on their instructions. The data flows between Pathbound and the integration provider are governed by the customer’s instructions and the respective provider’s terms. Those integration providers are sub-processors of the customer (not of Pathbound), and their own privacy policies apply to data they hold.
We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Pathbound, our users, or others.
Until a Data Processing Agreement is published and signed, the following processor commitments apply to all Customer Data we process on behalf of customers:
We do not sell personal data. We do not share personal data for cross-context behavioral advertising.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
access_token | Authentication (JWT session) | Session | Essential |
__Host-csrf | CSRF protection | Session | Essential |
pathbound_visitor_id | Visitor identification (Tracker, on customer sites) | 365 days | Functional |
pathbound_session_id | Session tracking (Tracker, on customer sites) | 1 day | Functional |
The Pathbound Tracker uses device fingerprinting (a hashed combination of browser, screen, and device signals) to recognize returning visitors when cookies are unavailable or have been cleared. This technique does not itself use cookies but creates a statistical identifier based on device characteristics. Where required by applicable law, the Pathbound customer operating the website is responsible for obtaining the visitor’s consent before the tracker collects fingerprint data.
The Pathbound Tracker honors a pathbound_dnt=1 cookie. When this cookie is present, the tracker will not collect any data. Customers implementing the tracker can use this mechanism to respect visitor opt-out preferences.
We target the retention periods listed below. Automated enforcement of these windows is in active development; until it is fully in place, data may be retained slightly longer than the target period for operational reasons. You may request immediate deletion at any time by contacting [email protected].
| Category | Target retention |
|---|---|
| Account data | Duration of your account, plus 30 days after deletion |
| Customer platform data (processor role) | Per the customer’s instructions; deleted within 30 days of account termination or written deletion request, except where retention is required by law |
| Tracker event data | 90 days from event date |
| Device fingerprints | 90 days from last activity |
| Session data | 7 days |
If you are in the EEA, UK, or Switzerland, you have the right to:
If you are a California resident, you have the right to:
We do not sell personal information as defined by the CCPA. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.
To exercise any of these rights, contact us at [email protected]. We currently fulfill these requests manually and will respond within 30 days (GDPR) or 45 days (CCPA). Self-service export and deletion are on our product roadmap. If you are an end-user of a Pathbound customer’s website (i.e., your data was collected via the Pathbound Tracker), please direct your request to that customer, who is the data controller for your information; we will assist them in fulfilling your request.
Our application infrastructure operates in the United States. All data submitted to or collected through the Services—including account data, Customer Data ingested from connected sources, and tracker event data—is stored on US-based infrastructure (currently MongoDB Atlas and Redis, hosted on a US cloud region). If you are accessing our Services from the EEA, UK, Switzerland, or other regions with data transfer restrictions, your data is transferred to and processed in the United States.
We are not currently certified under the EU-US Data Privacy Framework. EEA, UK, or Swiss data subjects may contact [email protected] to request information about the transfer mechanism applied to their data.
We implement security measures appropriate to the nature of the data we handle, including:
We have not undergone a SOC 2, ISO 27001, or equivalent third-party audit. SOC 2 Type I readiness is on our roadmap. No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to [email protected].
Our Services are not directed to individuals under 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. For significant changes affecting how we process your data, we will provide additional notice (such as email notification for account holders).
If you have questions about this Privacy Policy or our data practices, contact us at: