pathhog privacy policy v2.4

This Privacy Policy explains how We Break Desks Pte. Ltd. ("pathhog", "we", "us") collects, uses, discloses and safeguards information about creators and viewers (together, "users") of the pathhog app (iOS and Android) and pathhog.com (together, the "Service"). If you are a creator, this Notice works together with the pathhog Creator Terms. If you are a viewer, it works together with the pathhog User Terms.

1. WHO WE ARE & SCOPE

pathhog is a place-saving and trip-building service that helps users bookmark places, organise them into Boards, and build Trips from them. Every user receives a unique handle and a public profile page at pathhog.com/{handle} (which can be made private in Settings). Creators can additionally share their publicly available recommendations from linked platforms (currently Instagram and TikTok) through pathhog and may optionally connect their own affiliate network accounts to earn commission when users book via their attributed links. This Notice applies to personal data we process when you use the Service, contact us, or interact with our apps and websites.

2. INFORMATION WE COLLECT

We collect information in these categories:

2.1 Information you provide

• Account/profile information (name, email, username/handle, optional photo, bio)
• Creator onboarding information (verification details, affiliate network tracking IDs you provide)
• Communications (support requests, feedback)
• Copyright notices and counter-notices (including name, contact details, and sworn statements as required by law)

2.2 Information collected automatically

• Device and usage data (IP address, approximate location, browser/app type and version, OS, user agent, language, timestamps)
• Event and interaction data (page views, saves to Bookmarks, Boards and Trips, outbound link clicks, search queries, place-detail views, directions and map-app opens, affiliate link taps, and other in-app interactions)
• Cookies and similar technologies that support analytics, security, session management and affiliate attribution

2.3 Information from public sources (creators only)

For creators who have linked one or more Linked Platforms (as defined in the Creator Terms — currently Instagram and TikTok) through our verification flow, we collect publicly available content you control on those platforms, including:

• Profile fields (name, handle, bio, profile photo, profile links)
• Public posts/reels/videos, captions, timestamps
• Public like/comment/view counts
• Public location tags and hashtags
• Promo codes in your bio

Specific fields may vary by platform. We do not collect private or login-protected content, and we do not circumvent any platform's technical controls.

2.4 Information from partners

• Affiliate networks/partners may provide reporting necessary to reconcile commissions (e.g., conversions, clawbacks, fraud flags)
• Analytics, measurement and anti-fraud providers may supply signals or status to operate the service

3. HOW WE USE INFORMATION

• Provide, operate and secure the Service (including creator features, the place-saving / trip-building experience, and your public profile at pathhog.com/{handle})
• Process public creator content from linked platforms (Instagram, TikTok) — transforming captions and bios into structured entries (place names, categories, short tips, crystallised bios, promo codes) using automated systems including large-language models — so users can discover and save creator recommendations inside pathhog
• Display creator content on pathhog-owned channels with attribution, including your public creator profile, shared boards, our pathhog-branded social media accounts, email newsletters, and blog and press materials, in accordance with the Creator Terms (Section 5.3)
• Verify creator account ownership (code-in-bio validation on the relevant linked platform)
• Detect and prevent fraud and invalid activity
• Measure performance, run analytics, and improve features (including analysing search queries and interaction patterns to understand content demand and improve recommendations)
• Provide creator reporting and analytics, and route affiliate links through creator-provided tracking IDs
• Communicate with you (service messages, support, product updates; with your consent, marketing)
• Process copyright complaints and counter-notices, notify affected users, and comply with applicable intellectual property laws
• Comply with law and enforce our terms

We do not sell your raw creator data.

4. LEGAL BASES FOR PROCESSING (WHERE APPLICABLE)

• Contract (to provide the services you request, including creator features)
• Consent (e.g., marketing communications; creator validation; image-licence consent for creator content; where required)
• Legitimate interests (service security, fraud prevention, analytics and feature improvement, aggregated reporting) balanced against your rights
• Legal obligations (tax, accounting, compliance)

5. HOW WE SHARE INFORMATION

We do not sell or rent personal data. We share information with:

• Service providers acting on our behalf (hosting/cloud, analytics/measurement, LLM processing, email/support, anti-fraud, content scraping providers used to fetch your public Linked Platform content)
• Affiliate partners/networks to reconcile commissions and combat fraud
• Corporate transactions (merger, acquisition, financing, sale of assets) subject to confidentiality
• Copyright claimants and affected users to facilitate the DMCA notice and counter-notice process (e.g., sharing claimant contact details with affected content uploaders so they can exercise counter-notice rights, and vice versa)
• Public visibility on the Service: your handle, public profile and any boards or content you mark as public are visible to anyone with the URL and to search engines, subject to indexing rules described in Section 12
• Legal and safety (to comply with law, respond to lawful requests, or protect rights, safety and property)

We require service providers to process data only under our instructions and with appropriate safeguards.

6. BOOKING IMPORT VIA EMAIL FORWARDING

When you use Pathhog's email-import feature, each of your trips has its own forwarding address (for example, [email protected]). Anything you forward to a trip's address is added directly to that trip. This section explains what happens to the emails you forward.

What we receive

When you forward a booking confirmation, we receive:

• The full email, including sender, recipient, subject, headers, HTML body, and plain-text body
• Any attached files (e.g., PDF tickets, hotel vouchers, e-ticket receipts)
• The email address you forwarded from

How we use it

We render the email body and any attached PDFs to images (the same way you would see them) and pass those images to an AI vision model to extract structured travel details — such as flight numbers, hotel names, check-in dates, locations, and confirmation codes — which we then add to the trip whose forwarding address you used. Forwarded email content is not used for advertising, sold to third parties, or used to train AI models.

Third-party services that receive your email content

We rely on the following sub-processors to deliver this feature:

• Resend, Inc. (United States) — operates the inbound mail server that receives your forwarded emails. Resend stores a copy of the email and any attachments for up to 30 days, after which it is automatically deleted. See Resend Privacy Policy and DPA.
• Groq, Inc. (United States) — primary AI vision model for extracting structured booking details from the rendered email and attached documents. Email content is sent to Groq for inference only; Groq does not use the content to train models and retains it briefly for abuse monitoring. See Groq Privacy Policy.
• Alibaba Cloud (Qwen VL) — processed via DashScope International (Singapore region). Acts as the vision-extraction fallback when our primary provider is unavailable. Email content is sent for inference only; not used to train models. See DashScope data protection.

This list reflects the AI vision providers currently in use. We may add, replace, or remove AI providers as our technology evolves; current production providers are always reflected in this section.

We may change sub-processors as the service evolves. Material changes will be disclosed here at least 30 days before they take effect.

International transfers

Forwarded email content is processed in the United States (Resend, Groq) and may be processed in Singapore (Alibaba Cloud DashScope International) when the fallback provider is engaged. If you are located in the European Economic Area, United Kingdom, or Switzerland, transfers rely on the Standard Contractual Clauses incorporated into our sub-processors' Data Processing Agreements. Copies are available on request.

How long we keep it

Your controls

• Rotate any trip's forwarding address at any time from that trip's settings. The previous address is invalidated immediately and any future emails to it are dropped.
• Disable the feature entirely. Existing bookings remain in your trips; no new forwards are processed.
• Delete a specific forwarded email from Settings → Booking Import → History. This deletes our copy; the Resend copy is removed on its 30-day cycle.
• Request deletion of all data under GDPR's right to erasure or CCPA's right to delete by emailing [email protected].

Important things to know

• Other people's data, including minors. Booking confirmations often include personal data of other travelers (e.g., a spouse, colleague, or family members including children on the same booking). By forwarding such an email, you confirm you have the authority to share that information with us. We process it under the same terms as your own data and apply the same retention rules in this section.
• Sender verification. If you forward an email from an address we haven't associated with your account before, we may pause the email and ask you to confirm it's you before processing. Unconfirmed emails are deleted after 30 days.
• Spam and unwanted email. We may receive emails sent to your unique address that are not booking confirmations. These are filtered and discarded; we do not import or display them.
• AI processing and sensitive data. Before passing email content to our AI providers, we attempt to strip fields we do not need (e.g., partial card numbers, CVVs, government ID numbers). Stripping is best-effort and not guaranteed; do not forward anything you would not want a third party to process.

7. RETENTION

• Creator Linked Platform content: retained while your creator presence on pathhog is active and up to 30 days after revocation/closure solely to complete reporting and comply with legal/accounting obligations, then deleted or de-identified. Backups are isolated from live systems and used only for those purposes.
• Personal data you provide (e.g., email, contact details): deleted or de-identified within 30 days after revocation/closure, except where we must retain it for legal compliance, fraud prevention or claims handling.
• Handles: handles you have finalised and later changed are permanently retired after a 48-hour owner-only undo window, to preserve URL stability for users who shared your old profile link. The handle string is retained solely for URL-stability purposes (e.g., serving a redirect to your current handle) and is no longer linked to your account after retirement.
• Moderation reports and DMCA notices: retained for 3 years after resolution for legal compliance, dispute resolution and audit purposes, then deleted or de-identified.
• Consent and verification logs: retained as long as reasonably necessary for legal, compliance and audit.
• Derived/aggregated analytics that do not identify you may be retained to improve our services.

8. YOUR CHOICES AND RIGHTS

Depending on your location, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete personal data (subject to legal/operational exceptions)
• Withdraw consent where processing relies on consent (including the image licence in your Creator Terms)
• Object to or restrict certain processing, and data portability (EU/UK)
• Opt out of targeted advertising or sale/share of personal data (US state laws where applicable)
• Make your public profile private (Settings → Public profile)

To exercise rights, contact [email protected]. We may request verification before fulfilling a request. You can manage marketing preferences via unsubscribe links and in-app settings.

9. INTERNATIONAL DATA TRANSFERS

We may process and store data in countries other than where you reside, including the United States and Singapore. Key recipients of international transfers include:

• Google LLC / Firebase (United States) — hosting, database, authentication, analytics
• Cloudflare, Inc. (United States) — CDN, edge computing, security
• Resend, Inc. (United States) — inbound mail server for the email-forwarding booking import feature (receives forwarded emails; stores up to 30 days)
• LLM providers for public creator content processing: OpenAI (United States), Google Gemini (United States), Groq (United States), DeepSeek (China), Alibaba Cloud / Qwen (DashScope International, Singapore). This list is non-exhaustive; we may add, replace or remove providers as our technology evolves.
• LLM providers for the email-forwarding booking import feature: Groq (United States), Alibaba Cloud / Qwen (DashScope International, Singapore). This list is non-exhaustive; we may add, replace or remove providers as our technology evolves. See Section 6 for the providers currently in production.

Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses, contractual protections) to protect your data when transferred internationally.

10. SECURITY

We implement reasonable technical and organisational measures to protect personal data (access controls, encryption in transit, network and application security, backups). No method of transmission or storage is 100% secure.

11. CHILDREN

The services are not directed to children under 13 (or 14 in Korea, or the minimum digital consent age required in your country, which may be as high as 16 in certain EU/EEA member states). We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us to delete it.

12. COOKIES, TRACKING AND PUBLIC PROFILES

We use cookies, SDKs and similar technologies for essential functions, analytics/measurement, security, and affiliate and creator attribution (e.g., correlating saves and bookings with the creator whose recommendation they came from, and reconciling affiliate commissions). You can control cookies via browser settings and, where required, through our consent tools. Disabling cookies may affect functionality. We do not respond to Do Not Track signals.

Search-engine indexing of public profiles. Your public profile at pathhog.com/{handle} is reachable by anyone with the URL by default. We apply technical controls intended to limit search-engine indexing of profiles that are not those of verified creators with published public boards (for example, by serving a "noindex" directive). Search engines independently determine whether to index a page, and we cannot guarantee that they will honour these signals. You can opt out of public visibility entirely in Settings, in which case visitors to your profile URL will receive a "not found" response.

13. CHANGES TO THIS NOTICE

We may update this Notice. If changes are material, we will provide at least 30 days' notice via the Service and by email to the address associated with your account. Changes apply prospectively from the stated effective date. Your continued use after the effective date constitutes acceptance.

14. CONTACT US

We Break Desks Pte. Ltd.
466A Clementi Ave 1, Singapore 121466
Email (general): [email protected]
Data Protection Officer (DPO): [email protected]

15. REGION-SPECIFIC DISCLOSURES (SUMMARY)

EU/UK: pathhog is the controller for personal data described here. Legal bases are listed in Section 4. Data subject rights in Section 8 apply. Transfers outside the EEA/UK rely on appropriate safeguards.

US States (e.g., CA, CO, CT, VA, UT): We do not sell personal data in the traditional sense. We may engage in processing that could be considered "sharing" or "targeted advertising" under state laws; you may have opt-out rights. Contact us at [email protected].

Singapore: We process personal data in accordance with the PDPA. You may request access and correction as described in Section 8.

Malaysia: We process personal data in accordance with Malaysia's Personal Data Protection Act 2010 (as amended in 2024). You may exercise your rights to access and correct your personal data as described in Section 8. For Malaysia-specific requests, contact [email protected].

Thailand: We process personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019). Where we rely on consent, you may withdraw it at any time (Section 8); withdrawal does not affect the lawfulness of processing before withdrawal. For Thailand-specific requests, contact [email protected].

Japan: We process personal data in accordance with the Act on the Protection of Personal Information (APPI). Your personal data may be transferred to the United States and other countries for processing by the service providers listed in Section 9, including Google LLC / Firebase (hosting, database, analytics), Cloudflare, Inc. (CDN, security), and various LLM providers (processing of public creator content). These transfers are made under contractual safeguards. You may exercise rights described in Section 8. For Japan-specific requests, contact [email protected].

Korea: We process personal data in accordance with Korea's Personal Information Protection Act (PIPA). We transfer personal data to the United States for processing by the service providers listed in Section 9. We do not send marketing communications without your prior opt-in consent, and you may withdraw consent at any time. We share personal data with the third parties listed in Sections 5 and 9, solely for the purposes described therein. Retention periods are set out in Section 7. For Korea-specific requests, contact our Data Protection Officer at [email protected].

Taiwan: We process personal data in accordance with Taiwan's Personal Data Protection Act (PDPA). Your personal data may be transferred outside Taiwan for processing as described in Section 9. You may exercise your rights to access, correct, request cessation of use, and delete your personal data as described in Section 8. For Taiwan-specific requests, contact [email protected].

Hong Kong: We process personal data in accordance with Hong Kong's Personal Data (Privacy) Ordinance (PDPO). Personal data is collected and used solely for the purposes described in Section 3. You may exercise rights described in Section 8. For Hong Kong-specific requests, contact our Data User representative at [email protected].

Indonesia: We process personal data in accordance with Indonesia's Personal Data Protection Law (UU PDP, Law No. 27 of 2022). You may withdraw consent at any time as described in Section 8. In the event of a personal data breach that affects your rights, we will notify you and the relevant authorities as required by law. For Indonesia-specific requests, contact [email protected].

Vietnam: We process personal data in accordance with Vietnam's Personal Data Protection Decree (Decree 13/2023). Where we rely on consent, you may withdraw it at any time (Section 8). Your personal data may be transferred outside Vietnam as described in Section 9. For Vietnam-specific requests, contact [email protected].

Australia: We process personal data in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You may exercise rights described in Section 8. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. For Australia-specific requests, contact [email protected].