Data and Compliance

1. Your rights

Depending on where you live, you have some or all of these rights over your personal information:

• Access: ask for a copy of the data we hold about you.
• Correct: ask us to fix information that is wrong or incomplete.
• Delete: ask us to delete your account and data.
• Export: ask for your data in a portable format.
• Object or restrict: ask us to stop or limit certain processing.
• Withdraw consent: where we rely on consent, you can withdraw it at any time.

2. How to exercise your rights

Email us at admin@energy-path.org from the address on your account, or use the account-deletion option in the app. We will respond within a reasonable time, and within any period required by the law that applies to you. We may need to verify your identity first.

3. Account and data deletion

When your account is deleted, we remove your profile and your saved studies. Certificate verification records may be kept so issued certificates remain verifiable and to protect against fraud. Limited security and activity logs may be kept for a short time. Some information may also be retained where the law requires it.

4. Data retention

We keep account information while your account is active, and delete or anonymize it after deletion, except where we must keep it longer for legal, security, or certificate-verification reasons.

5. How we protect your data

We protect your information with measures including:

• Secure sign-in through Google Firebase Authentication.
• A backend protected by sign-in tokens and request rate limits.
• Encryption of data in transit (HTTPS).
• Access limited to what is needed to run the service.

6. Service providers and international transfers

We use Google as our main provider: Firebase Authentication, Firestore, and Hosting, and Google Cloud Run for our backend. These run on Google global infrastructure, so data may be processed outside your country with appropriate safeguards. We do not sell your personal data.

7. Data breaches

If a breach affects your personal information, we will act to contain it and will notify you and the relevant authorities where the law requires us to.

8. Regional notes

If you are in the European Economic Area or the United Kingdom, you have the rights above under the GDPR, and Energy Path acts as the controller of your information; you may also complain to your local data-protection authority. If you are in California, we do not sell personal information, and you have the right to know, access, and delete your information, and not to be treated differently for using these rights.

9. Contact

For any data request or question, contact us at admin@energy-path.org.