Your context is yours.

1. Who is responsible

Bergen.icu (“Bergen”, “Path”, “we”, or “us”) operates Path at path.bergen.icu. Questions and privacy requests can be sent to [email protected].

2. Information we process

Account and security data

Your name, email address, password hash, language preference, sessions, onboarding state, security events, and settings. Passwords are not stored in readable form.

Content you create

Projects, project briefs, phases, tasks, subtasks, notes, shopping lists, orders, shipments, conversations, proposals, approvals, activity history, and attachments or links you choose to add.

AI and integration data

Prompts, generated responses, proposed changes, integration connection details, permission settings, and audit events. Provider credentials and OAuth tokens are encrypted at rest. Path does not provide a shared OpenAI key; each user supplies and controls their own AI credentials.

Operational data

IP-derived security information, timestamps, request metadata, error details, rate-limit events, and service logs needed to secure, diagnose, and operate Path.

3. Connected email accounts

If you connect Gmail or Outlook, Path requests your account email and read-only mail access. Path uses that access only when a mailbox sync runs, to find recent messages that may contain order, shipment, delivery, or tracking information.

• On the first sync, Path searches up to 40 potentially relevant messages from the previous 90 days. Later syncs use Gmail history or Microsoft Graph delta markers and process at most 40 changed messages per run.
• Message subject, sender, date, and message content are processed to identify merchant, order number, price, status, carrier, links, and tracking details. Outlook message content is used when available rather than relying only on its shortened preview.
• Path stores the connected account address, encrypted access and refresh tokens, provider message identifier, sender, subject, confidence/evidence, a minimised extracted summary for messages awaiting review, and the derived order or shipment record.
• Path does not retain the complete original Gmail or Outlook message or mailbox as a separate copy. Review and rejected candidates are deleted after 30 days; processed import provenance is deleted after 180 days.
• Email data is not used for advertising, sold, shared with data brokers, used to build advertising profiles, or used to train general-purpose AI models.

4. Why we use information

• Provide the workspace, roadmaps, tasks, conversations, orders, and connected features you request.
• Authenticate users, protect accounts, enforce limits, and prevent misuse.
• Generate AI-assisted responses and proposals when you initiate them.
• Import and update order and shipment records when you initiate a mailbox sync.
• Maintain revision history, audit changes, diagnose errors, and improve reliability.
• Meet legal obligations and enforce our Terms of Service.

5. Legal bases

Where the GDPR applies, we process data to perform our contract with you, based on your consent for optional integrations, for our legitimate interests in operating and securing Path, and where needed to comply with law. You may withdraw integration consent by disconnecting the relevant provider.

6. Sharing and processors

We disclose information only to infrastructure, database, email, security, and AI providers needed to deliver features you choose, under appropriate confidentiality and data-protection obligations; when required by law; or during a business transfer with appropriate safeguards. AI content is sent only to the provider connected by you when you invoke that feature. We do not sell personal information.

7. Retention and deletion

Account and workspace data is kept while your account remains active or as needed to provide Path. Security and operational logs are retained only as reasonably necessary for security, troubleshooting, and legal obligations. Disconnecting Gmail or Outlook deletes the stored connection and OAuth tokens. You can choose whether Path also deletes orders and shipments created from that exact connected account; manual records are preserved.

You can delete individual content in Path and can request account closure or deletion at [email protected]. Account deletion removes the account and associated workspace data from active systems, subject to short-lived backups and legal retention requirements. You may also revoke Path directly from your provider account permissions.

8. Security and international transfers

Path uses encryption in transit, encrypted storage for provider credentials and OAuth tokens, access controls, rate limits, audit logging, and scoped integration permissions. No system can be guaranteed completely secure. Where service providers process data outside the EEA, we use legally recognised transfer mechanisms where required.

9. Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; or complain to a supervisory authority. Swedish users may contact Integritetsskyddsmyndigheten. We may need to verify your identity before fulfilling a request.

10. Children and changes

Path is not intended for children under 13, or under the minimum age required in their country without valid parental consent. Material policy changes will be communicated in Path or by email, and the date above will be updated.