Privacy Policy — ReqPath

1. Who this policy covers

This policy applies to everyone who uses ReqPath: school administrators and staff who set up and manage a school, students who plan their courses, and visitors browsing our marketing site. When a school signs up, the school is the data controller for its students' information — ReqPath acts as a data processor on the school's behalf.

2. Information we collect

Information you provide

Account details — name, email address, and a hashed password.
School information — school name, domain, join codes, and roster data added by school staff.
Course planning data — class selections, prerequisite trees, schedules, and plans created within the platform.
Feedback — anything you send us through the feedback form or by email, including the page you submitted from.

Information collected automatically

Usage data — basic logs such as pages visited, actions taken, and timestamps, used to keep the service running and secure.
Device data — browser type, operating system, and IP address, used for security and troubleshooting.

3. How we use information

We use the information we collect to:

Provide the core service — catalogs, tree building, scheduling, the AI advisor, and student planning.
Authenticate users and keep accounts and school data secure.
Respond to support requests and feedback.
Improve the platform by understanding which features are used and where people get stuck.
Send essential service communications (for example, account or deadline notifications a school enables).

We do not sell your data, and we do not use student data to train AI models. The AI advisor only references your school's own catalog and the student's stated goals to generate suggestions.

4. How we share information

We share information only in these limited cases:

Within your school — staff with appropriate permissions can see student plans and progress according to their role.
Service providers — we rely on trusted infrastructure partners (such as database hosting and payment processing) who are bound to protect your data and use it only to provide their service to us.
Legal requirements — when required by law, regulation, or valid legal process.

We never share student feedback or planning data outside the ReqPath team and your school.

5. How we protect information

Data is stored in encrypted database infrastructure. Passwords are hashed with bcrypt and never stored in plain text. Access to production data is limited to the people who need it to operate the service. While no system can guarantee perfect security, we take reasonable measures to protect your information from unauthorized access, loss, or misuse.

6. Data retention

We retain school and student data for as long as a school maintains an active account. Schools can export their data — classes, students, teachers, schedules, and selections — to CSV at any time. When a school closes its account, we delete or anonymize its data within a reasonable period, except where we're required to retain it for legal or accounting reasons.

7. Student privacy

ReqPath is designed for use in schools, and we take student privacy seriously. We collect only the information needed to provide course planning. Schools control what student data is added and who can access it. If you're a parent or student with questions about data held by your school, please contact your school administrator first, or reach us at [email protected].

8. Your choices and rights

Access and correction — you can view and update your account details at any time; school staff can correct roster data.
Export — schools can export their full dataset to CSV whenever they like.
Deletion — you can request deletion of your account by contacting us. School-managed student records are handled through the school.

9. Cookies

We use a small number of cookies and similar technologies to keep you signed in and to remember basic preferences. We don't use advertising or cross-site tracking cookies.

10. Changes to this policy

We may update this policy as the platform evolves. When we make material changes, we'll update the date at the top of this page and, where appropriate, notify schools directly. Continued use of ReqPath after changes take effect means you accept the revised policy.

11. Contact us

Questions about privacy or your data? Reach out and a real person will respond.