Privacy Policy

1. Introduction

Welcome to VenturePath ("we," "us," "our," or the "Platform"). VenturePath operates the website located at venture-path.ai and related services (collectively, the "Service").

We are committed to protecting your privacy and handling your personal information with transparency and care. This Privacy Policy explains what information we collect, how we use it, how we share it, and your rights regarding your data.

By accessing or using VenturePath, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account, complete your profile, or interact with our Service, we may collect:

Account Information: Email address, display name, and password (managed securely through our authentication provider).
Credit Profile Data: Self-reported credit score range, credit history age, credit utilization, late payment history, collections status, and state of residence.
Your Diagnosis: What we work out from your onboarding answers: your profile type, your main obstacle and how urgent it is, your first task, and your stage. Your dashboard and the AI Coach use it.
Financial Goals: Your selected financial objective (e.g., building credit, buying a home, buying a car, travel rewards, improving score, or establishing business credit).
Your Credit Sprint: Which 30-day Sprint you start, its dates, the tasks you check off, and whether you finish or stop it.
Cards You Track (My Cards): Card name, issuer, card type, credit limit, balance, statement closing and payment due days, annual fee, month opened, which card you mark as primary, and any notes you type — entered by you or imported from a credit report you analyzed. We don't ask for card or account numbers.
Preferences: Preferred language, reward preferences, notification settings, and learning progress.
Communications: Any messages you send to our AI Coach feature, support inquiries, or feedback you submit.

2.2 Information Collected Automatically

When you access our Service, we may automatically collect:

Usage Data: Pages visited, features used, and interaction with educational content.
Device Information: Browser type, operating system, device type, and IP address.
Cookies and Similar Technologies: We use cookies and similar technologies to administer the site. See Section 7 (Cookies) for details.
How You Found Us: If you allowed Analytics and created your account in that browser, we save with your account how you first arrived: the link's source, medium and campaign, whether it came from a Google ad, the kind of site that sent you and the type of the first page you opened (never a site's name; for a link printed in a community organization's materials, only that it was one). See our Cookie Policy.

2.3 Saving Your Route Without an Account

After you use our ITIN and no-SSN card checker, you can save your route without an account or a password: in this browser, in Google Calendar or as a calendar file (.ics). You choose which, if any.

Your answers and your route stay on your device. Saving does not send your checker answers or your route to us, and we do not store them on our servers. Your route is kept in your browser's local storage on the device where you saved it, and every way of saving keeps it there. Anyone who uses that browser can open it. In a private or incognito window, it is gone when you close the window.
How long it stays. Until you remove it with Remove this route from this device on the page of your saved route, or clear this site's data in your browser. 210 days after the route's date, it is removed the next time you open our site in that browser, and your browser may clear it sooner. We cannot remove it for you, because we never receive it. Removing it does not remove calendar events; remove those in your calendar.
The link to your route. Calendar events link to the page of your saved route. The link holds a random code, the date you made the route and a letter for how you saved it; nothing in it comes from your answers. Opened in the browser where you saved the route, it shows the route. Opened anywhere else, it asks the checker's questions again, and the route you rebuild is then kept in that browser too.
Google Calendar and .ics. If you choose Google Calendar, your browser opens Google Calendar with the event name, date and link filled in. Google receives them as soon as its page opens, and keeps the event if you save it, under Google's privacy policy. The .ics file is created on your device and downloaded straight to it. Event names are neutral and never mention ITIN, SSN, Form W-7 or immigration.
Counting. To learn whether saved routes are useful, and how often people reach our checker's result through printed materials from community organizations, we count a few events, each with only the page's language and the day (the checker's result also carries one yes-or-no, described below): that the checker showed a result; that a route was saved, and how; and that a saved route was opened again on a later day — where from (your calendar or our site) and how many days after it was made. That yes-or-no says only whether this browser came to our site through a link printed in materials that a community organization gave out — on this visit, or on its first visit in the last 90 days. We never record which organization it was, or what kind. To tell saved routes apart, these records carry a code that we compute from your link's random code with a secret key; the random code itself never reaches us. The records never include your answers or your route, and we don't add your IP address or device details to them. We delete them after 90 days and keep weekly totals. We count only if you turned on Analytics, and never if your browser sends Global Privacy Control.

If you sign in or create an account in this browser, onboarding checks your saved route on this device and may offer to use it to answer the question about your credit score. Nothing is filled in unless you tap Use them, and that answer is then saved with your other onboarding answers when you continue. Your route and its answers are still not sent to us.

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Service: To create and manage your account, deliver personalized credit education content, power the AI Coach feature, generate card recommendations based on your credit profile, and track your learning progress.
Personalization: To tailor educational content to your financial situation and goals.
Communication: To send you account-related notifications, learning reminders, weekly progress reports, and promotional messages about VenturePath features (you may opt out of non-essential communications at any time).
Analytics and Improvement: To understand how users interact with our Platform, identify areas for improvement, and develop new features.
Security and Compliance: To detect and prevent fraud, enforce our Terms of Service, and comply with legal obligations.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We may share your information in the following limited circumstances:

Service Providers (Subprocessors): We share data with the following trusted third-party service providers. Each is contractually required to process your data only to provide services to us.
- Anthropic, PBC — AI language model provider powering the Coach feature and credit report parsing.
- Stripe, Inc. — Only if you once started a VenturePath Pro checkout: Stripe keeps the records of that checkout or subscription. We ask Stripe about that subscription and delete your Stripe customer record when you delete your account. We take no payments.
- Resend, Inc. — Transactional and lifecycle email delivery.
- Google LLC (Google Workspace) — Our support mailbox. It receives the emails you send us, including replies to our emails, and a copy of the support requests you send while signed in: what you wrote, your email address and a link to any screenshot (the link stops working after 7 days).
- beehiiv Inc. — Newsletter delivery, only if you subscribe to our newsletter. It receives your email address and, if you allowed Analytics and the link that brought you to our site carried them, that link's source, medium and campaign tags (never the campaign of a link printed in a community organization's materials); a tag that names ITIN, SSN or immigration is sent as the word "redacted" instead. When you delete your account, we ask beehiiv to delete any newsletter subscription for your account's email address; for this, beehiiv receives that address even if you never subscribed.
- Lovable Cloud / Supabase — Application hosting and database infrastructure.
- Cloudflare, Inc. — Network services in front of our hosting. Every request to our site passes through it, including your IP address, and Cloudflare processes it under its own privacy policy.
- Functional Software, Inc. (Sentry) — Error monitoring for service reliability. When the app encounters a technical error, Sentry receives the error details (error message, stack trace, browser and device type), the address of the page where it happened, the website you arrived from and the app's last steps before the error (pages opened, requests made, elements clicked). These addresses carry no query parameters and do not say which lesson you had open, and Sentry never receives your name, email address, credit data, or AI Coach conversations. From our ITIN checker and its saved-route pages, our ITIN, no-SSN and immigrant guides, our ITIN data study and our ITIN glossary entry, Sentry receives no error reports, and their addresses never reach it. It sets no cookies and is processed under our legitimate interest in keeping the Service working.
Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. AI Coach and Data Processing

VenturePath's AI Coach feature is powered by AI language models. When you interact with the AI Coach:

Your messages and relevant profile context (such as your credit score range and financial goals) are sent to the AI provider's API to generate personalized responses. If you saved a credit report analysis, each message also sends details from the latest one: its score, the date you saved it, its utilization, payment history and number of negative marks. It also sends up to 12 accounts (type, company name, balance, limit, status) and up to 5 negative items (type, company name, amount).
We do not send your email address, password, payment information, or other identifying information to the AI provider.
The AI provider processes this data in accordance with their privacy policy and data processing agreements. They do not use your data to train their AI models when accessed through their API.
Credit Report PDF: If you upload a credit report PDF using the Credit Report Analyzer feature, the file is kept in our file storage until the analysis finishes and is transmitted to Anthropic's API solely for parsing. We delete the file from our storage right after the analysis, and any upload still in our storage is deleted within 24 hours. If you choose to save them, the extracted results (your score, account details and the AI summary) are saved to your account.
AI Coach conversation history is stored in your VenturePath account.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Service. If you delete your account, we will delete or anonymize your personal information within 30 days, except the emails and support requests you sent to our support mailbox, which we keep there, and the records of sign-ins and other account events that our hosting provider keeps for security, and where we are required to retain it for legal, tax, or regulatory purposes.

Usage data and anonymized analytics data may be retained indefinitely for product improvement purposes.

Saved routes: Saved routes are never on our servers. If you tap Use them in onboarding (Section 2.3) and continue, the answer it fills in is kept with your profile like your other onboarding answers (Section 2.1). Counting records (Section 2.3) are deleted after 90 days; weekly totals are kept.

7. Cookies

We use the following types of cookies:

Essential Cookies: Required for the Platform to function properly (e.g., authentication session, security tokens). These cannot be disabled.
Preference Cookies: Remember your settings and preferences (e.g., language).
Analytics (optional): Off until you allow it, and always off when your browser sends Global Privacy Control. With it on, we remember in your browser how you first arrived at our site, count our checker's results, saved routes and later visits to them (Section 2.3) and, when you're signed in, note which lessons you open and which card's "View on issuer's site" button you press (Cookie Policy, Section 3).

We do not use advertising or retargeting cookies.

Do Not Track: Our site does not respond to Do Not Track signals.

If you save a route, it is kept in your browser's local storage (Section 2.3) and is never sent to us. It stays on your device until you remove it; 210 days after its date it is removed the next time you open our site, and your browser may clear it sooner.

Managing Cookies: Most web browsers allow you to control cookies through their settings. You may choose to block or delete cookies, but this may affect the functionality of the Platform. See our Cookie Policy for more details.

8. Data Security

We implement industry-standard security measures to protect your personal information, including:

Encryption of data in transit (TLS/SSL) and at rest.
Row-Level Security (RLS) policies on all database tables to ensure users can only access their own data.
Secure authentication with password hashing and session management.
Rate limiting on API endpoints to prevent abuse.
Security reviews and monitoring.

While we take reasonable measures to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

For All Users:

Access: You may request a copy of the personal information we hold about you.
Correction: You may update or correct your information through your Profile page or by contacting us.
Deletion: You may delete your account at any time using the Delete Account option in your Settings page. This deletes your credit data, conversation history, and profile from our database. You may also contact us at the email below for assistance. A route saved in your browser is deleted with Remove this route from this device on the page of your saved route or by clearing this site's data in your browser; calendar events are removed in your calendar.
Opt-Out of Communications: You may opt out of non-essential emails through your Profile notification settings or by using the unsubscribe link in any email.

For California Residents (CCPA):

You have the right to know what personal information we collect, use, and disclose.
You have the right to request deletion of your personal information.
You have the right to opt out of the sale of your personal information. We do not sell your personal information.
You have the right to non-discrimination for exercising your privacy rights.

For Users in Other Jurisdictions:

If you are located in a jurisdiction with additional privacy rights (such as the European Economic Area under GDPR), please contact us to exercise your rights. We will respond to your request within the timeframe required by applicable law.

10. Children's Privacy

VenturePath is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us immediately.

11. Third-Party Links

Our Service may contain links to third-party websites, including credit card issuer websites and financial institution application pages. We are not responsible for the privacy practices of these third-party sites. We encourage you to review the privacy policy of any website you visit through links on our Platform.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Update the "Last Updated" date at the top of this policy.
Notify you through the Platform (e.g., a banner or notification) or via email for significant changes.

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

VenturePath
Operated by Roze Express Inc · Fort Lauderdale, FL
Email: support@venture-path.ai
Website: venture-path.ai