Data protection is of the highest priority for PathHub AI. The use of our website (pathhub.ai) is generally possible without providing personal data. If you wish to use special services of our platform (app.pathhub.ai), the processing of personal data may be necessary. Where the processing of personal data is required and there is no legal basis for such processing, we will obtain your consent.
The processing of personal data is always carried out in accordance with the General Data Protection Regulation (GDPR) and the applicable German data protection regulations. This Privacy Policy informs you about the type, scope, and purpose of the personal data we collect, use, and process, as well as your rights.
The data controller for data processing on this website is:
Tobias Bulst, PathHub AI
Am Kirschbaumwäldchen 17, 40547 Düsseldorf, Germany
Email: hello@pathhub.ai
We only use technically necessary cookies and set no tracking, advertising or analytics cookies, so we don't ask for consent:
In addition, the app stores individual settings that you trigger yourself in your browser's local storage, e.g. your cookie choice, view settings or the ID of a plan created without an account, so it can be transferred after you sign up. These entries are required for the function you requested (Section 25(2) No. 2 TDDDG) and are not used for tracking.
We do not use tracking, advertising or analytics cookies. Details are in our cookie policy.
Our web server (Nginx) and the CDN service Cloudflare automatically collect information in server log files that your browser transmits:
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and stable operation of the website). The data is not merged with other data sources. Server log files are automatically deleted after 14 days.
Anonymous visitor statistics: From these server log files we create aggregated statistics on our own server (e.g. number of page views, most visited pages, referring websites). No cookies are set and no information is stored on or read from your device; there is no tracking script and no third-party provider. Visitors are only counted within a single day using a non-reversible hash with a daily changing random value that is not stored; recognising visitors across days and profiling do not take place. Only daily totals without IP addresses are stored. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offering according to demand).
When registering on our platform (app.pathhub.ai), we collect and store:
The legal basis is Art. 6(1)(b) GDPR (contract performance). Your data is stored server-side in a SQLite database on our Hetzner (EU data center, Germany) server in Germany.
Optionally you can sign in with your Google or Microsoft account. We then receive your name, email address and an account identifier from the provider; no password is stored in that case. Providers: Google Ireland Limited and Microsoft Ireland Operations Limited. The legal basis is Art. 6(1)(b) GDPR (performance of contract).
After registration, we send you a confirmation email to the email address you provided. The email is sent via the service Resend (Resend, Inc., USA). Your email address and the verification link are transmitted to Resend. The legal basis is Art. 6(1)(b) GDPR (contract performance). Privacy policy of Resend: resend.com/legal/privacy-policy.
After login, a cryptographically secure session token (64 characters, randomly generated) is set as an httpOnly cookie. The token references a server-side session entry in the database. No localStorage and no sessionStorage is used in the browser for personal data. The legal basis is Art. 6(1)(b) GDPR (contract performance).
When you create a Path (project plan), we store the following data server-side:
This data is only visible to you and to people you grant access: by inviting them to your workspace or via a read-only link (see below). The legal basis is Art. 6(1)(b) GDPR (performance of contract).
If you enter personal data of third parties in Paths (e.g. names of stakeholders or owners), we process it on your behalf. For business customers we provide a data processing agreement (DPA) under Art. 28 GDPR on request.
Optionally, you can provide information about your company/workspace (company name, industry, team size, stakeholders, challenges). This data is stored as JSON files on the server and serves to improve the AI analysis of your projects.
You can upload documents (PDF, Word, Excel, CSV, TXT) to your workspaces. These are stored as files on the server in a protected directory and are only accessible to you and the members of the respective workspace. The files are deleted when the workspace is deleted or upon your request.
Upon upload, the text content of the documents is automatically extracted and stored. For context search the text is split into sections; these sections are transmitted to OpenAI and converted into numerical vectors (embeddings), which we store on our server (see Section 5). With the Business plan, you can activate documents as AI reference. In this case, the extracted text content is transmitted to our AI service providers during AI requests (see Section 5). You decide which documents are used as AI references.
At app.pathhub.ai/try you can create a project plan without creating an account. We process:
The legal basis is Art. 6(1)(b) GDPR (carrying out the plan creation you requested) and, for the IP hash, Art. 6(1)(f) GDPR (legitimate interest in preventing abuse). If you save the plan to an account after signing up, the rules for project data apply. Unsaved plans are deleted automatically after 7 days. Please do not include data about identifiable individuals in the description.
Save a plan by email: Instead of signing up, you can have a link to your plan sent to you. For this we process your email address and send the email via our email provider (see section 8). Only when you click the link do we create a free account with this address (or sign you in to your existing account) and save the plan there; from then on the rules for user accounts and project data apply. Legal basis is Art. 6(1)(b) GDPR. The link is valid for 3 days; unused links are deleted afterwards.
At app.pathhub.ai/spec you can have a requirements or functional specification created without an account. The same rules apply as for a plan without an account: your description is transmitted to our AI service provider, your IP address is only stored as an irreversible hash to limit abuse (at most three documents per day), and results not saved to an account are deleted after 7 days. Legal bases as above.
You can create a read-only link for a project. Anyone who knows the link can view the plan's current state without signing in (phases, tasks incl. owners, milestones, risks, stakeholders; the budget only if you explicitly enable it). Chats, notes, comments and documents are not included. Shared pages are blocked for search engines (noindex). You can stop sharing at any time; the link then stops working immediately. We only count the number of views. As the person sharing, you are responsible for the content you share via a link, in particular names of individuals. The legal basis is Art. 6(1)(b) GDPR (performance of contract).
When you activate an integration, you connect your account with the provider to PathHub AI via OAuth. We store the required access tokens encrypted. For Google Drive and SharePoint/OneDrive only the files you select are retrieved, their text extracted and stored as AI context (see "Document uploads"). For Slack we post reports you trigger to the channel you choose. You can disconnect any integration at any time; stored tokens are then deleted. Providers: Google Ireland Limited, Microsoft Ireland Operations Limited, Slack Technologies Limited (Ireland). The legal basis is Art. 6(1)(b) GDPR (performance of contract).
You can connect AI assistants such as ChatGPT or Claude via sign-in (OAuth) or your own API key to your workspace. The assistant then retrieves or changes data in PathHub on your behalf, within the permissions you grant it. How the assistant's provider processes this data is governed by your own contract with that provider. We log every call (key, workspace, function called, result, time) to calculate the quota and detect abuse. We limit failed sign-in attempts by IP address; it is only held briefly in memory for this purpose and not stored permanently. If you set up a webhook, we send data about the affected project to the address you specify when the selected events occur. Legal basis is Art. 6(1)(b) GDPR (performance of contract).
To calculate the AI point quota of your plan and to control the costs of our AI services, we store an entry on our own servers for every AI action that is carried out.
To understand where setup becomes difficult (e.g. creating a first project), we record individual usage steps within your account, for example whether you saw the onboarding screen, loaded a sample project, or opened the project-creation page. This analysis runs exclusively on our own servers; we do not use any third-party analytics software (e.g. Google Analytics) and no additional cookie is set; attribution happens via your existing, technically necessary session.
A core component of PathHub AI is AI-powered project planning. Project data is transmitted to external AI services to generate project plans, recommendations, and chat responses. The AI providers we use are based in the USA. We base the transfer on the EU-U.S. Data Privacy Framework (DPF) where the provider is certified under it, and in addition on Standard Contractual Clauses (SCCs).
Important: Please only include information about individuals in project descriptions, tasks and documents that is genuinely needed for planning, and no special categories of personal data (e.g. health data).
When you contact us by email, your information (name, email address, message content) is stored to process your inquiry. The data is deleted once storage is no longer necessary. The legal basis is Art. 6(1)(f) GDPR (legitimate interest).
If you cancel using the form at pathhub.ai/en/cancel-contract.html, we store your name, email address, contract, type and date of the cancellation, any reason or note, and the time of receipt, and send you a confirmation of receipt by email (sent via Resend, see Section 8). To limit abuse we count submissions per IP address; the IP address is only held briefly in memory for this purpose. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 312k German Civil Code and Art. 6(1)(b) GDPR. We keep the information until the regular limitation period expires (three years from the end of the year of cancellation).
For payment processing, we use Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland).
Stripe may set its own cookies on the Stripe domain during the payment process. Details can be found in Stripe's privacy policy.
For sending emails related to your account, we use the service Resend (Resend, Inc., USA).
If you explicitly opted in during registration, we occasionally email you about new features and product updates, give tips for the next steps with your plan and sometimes ask for feedback. This is voluntary and independent of your account usage.
All other emails (verification, password reset, account and security notices) are transactional emails necessary for the operation of your account and are sent regardless of consent to product updates.
Our platform is operated on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The server is located in the data center in Falkenstein/Vogtland, Germany. All user data (database, files, uploads) is stored exclusively on this server in Germany.
Our domain uses Cloudflare, Inc. (USA) as a DNS and CDN provider. Cloudflare may process technical access data (IP address, browser information) to optimize traffic and protect against attacks.
Website and app use the "Inter" typeface, which we serve from our own server. Loading our pages does not connect to Google or any other font provider.
When using our platform, personal or project-related data may in certain cases be transferred to recipients in third countries (outside the EU/EEA):
The AI features of PathHub AI generate suggestions for project plans, budgets, risks, and recommendations. These suggestions are not automated individual decisions within the meaning of Art. 22 GDPR. They serve solely as support and recommendations. You decide whether and how to incorporate the AI suggestions into your project. All AI-generated content can be edited and deleted by you at any time.
Personal data is deleted once the purpose of its storage no longer applies:
Statutory retention periods (in particular commercial and tax law) remain unaffected.
You have the following rights under the GDPR:
If you have any questions about data protection or wish to exercise your rights, you can reach us at:
hello@pathhub.ai
We reserve the right to update this privacy policy to ensure it always complies with current legal requirements and reflects our actual data processing practices. The current version can always be found on this page.
Last updated: November 2, 2026