This Privacy Policy for Luther Labs LLC (doing business as "Aurel Path," and referred to here as "we," "us," or "our") describes how and why we may access, collect, store, use, and/or share ("process") your personal information when you use our services (the "Services"), including when you:
Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at support@aurelpath.com.
What personal information do we process? We process the information you provide to us (such as your name, email, location, and the academic, career, and application content and files you choose to upload) and certain technical information collected automatically. Learn more below.
Do we process sensitive personal information? We generally do not collect sensitive personal information such as race or ethnic origin, religious beliefs, health data, or precise geolocation. You may share other information with us at your discretion.
Do we collect information from third parties? We do not collect information from third parties, other than the basic profile information you authorize when you sign in with Google or Apple.
How do we process your information? To provide, improve, and administer the Services, to power our AI features, to communicate with you, for security and fraud prevention, and to comply with law.
How do we keep your information safe? We use reasonable organizational and technical measures. However, no system can be guaranteed 100% secure.
What are your rights? Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information. Learn more below.
In short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide when you register for the Services, use features of the Services, or contact us. The personal information we collect may include:
You sign in using Google or Apple; we do not create or store a separate password for your account. All personal information you provide must be true, complete, and accurate, and you should notify us of any changes.
If you make a purchase, we may collect information necessary to process your payment. All payment card data is handled and stored by our payment processors, Stripe and, for in-app purchases on iOS, Apple. You can review their privacy notices at https://stripe.com/privacy and https://www.apple.com/legal/privacy/.
If you use our application, we may collect the following if you choose to grant access or permission:
In short: Some information — such as your IP address and device characteristics — is collected automatically when you use our Services.
We automatically collect certain information when you visit or use the Services, such as your IP address, device and browser characteristics, operating system, language preferences, referring URLs, general location (such as country), and information about how and when you use the Services. This is used mainly to maintain security and operation and for internal analytics. We also collect information through cookies and similar technologies; see our Cookie Policy.
Google API. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In short: We process your information to provide, improve, and administer our Services, power our AI features, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for the following reasons:
In short: We share information only with the service providers that help us operate the Services, and in a few specific legal situations. We do not sell your personal information.
We share your data with third-party vendors and service providers who perform services for us and need access to do that work. We have contracts in place designed to safeguard your personal information; they may only use it to perform services for us and may not share it with others. The categories of service providers we use are:
| Purpose | Provider(s) |
|---|---|
| AI features | Lovable AI Gateway; Google (Gemini) |
| Cloud computing & database | Supabase; Cloudflare |
| Website hosting | Vercel |
| Account registration & authentication | Google Sign-In; Apple; Supabase |
| Payments & billing | Stripe; Apple |
| Error & performance monitoring | Sentry |
| Policy management | Termly |
We may also share personal information in connection with a business transfer — such as a merger, sale of company assets, financing, or acquisition of all or a portion of our business — and where required to comply with applicable law or valid legal process.
In short: We use only essential and functional cookies and similar technologies to run the Services. We do not use them for advertising.
We use cookies and similar technologies (such as local storage and secure tokens) to keep you signed in, remember your preferences, process payments securely, prevent fraud, and keep the Services stable and secure. We do not use cookies or similar technologies for advertising or targeted advertising, we do not allow third parties to serve ads on the Services, and we do not sell or share your personal information for cross-context behavioral advertising. For more detail, see our Cookie Policy.
In short: Yes — our Services include features powered by artificial intelligence.
As part of our Services, we offer features powered by artificial intelligence and machine learning ("AI Features"), including personalized roadmaps, application and admissions guidance, career matching, resume and essay feedback, practice-interview feedback, and opportunity suggestions.
We provide these AI Features through a third-party AI service provider — currently Google (Gemini), accessed through the Lovable AI Gateway — and may use other AI service providers as our Services evolve. When you use an AI Feature, your input and the resulting output (which may include personal information you provide) are shared with and processed by that provider to generate your results. You must not use the AI Features in any way that violates the terms or policies of an AI service provider. AI-generated output is provided for informational and coaching purposes and is not a guarantee; see our Terms of Service and Disclaimer.
In short: If you sign in with Google or Apple, we receive certain profile information from them.
Our Services let you register and sign in using your Google or Apple account. When you do, we receive certain profile information from that provider, which typically includes your name, email address, and profile picture. We use this information only for the purposes described in this Privacy Policy. We do not control, and are not responsible for, other uses of your information by Google or Apple; we recommend you review their privacy notices.
In short: We keep your information only as long as necessary, and generally no longer than one (1) month after your account is closed.
We keep your personal information only for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax or accounting requirements). In general, no purpose in this policy will require us to keep your personal information for longer than thirty (30) days after your account is terminated. When we no longer have a legitimate need to process your information, we will delete or anonymize it, or, if that is not possible (for example, because it is stored in backups), securely store and isolate it until deletion is possible.
In short: We use reasonable technical and organizational measures to protect your information.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that unauthorized third parties will never defeat our security. Transmission of personal information to and from our Services is at your own risk.
In short: You may review, change, or terminate your account at any time, depending on where you live.
Withdrawing your consent. If we are relying on your consent to process your personal information, you may withdraw it at any time by contacting us using the details in the "How can you contact us" section. This will not affect the lawfulness of processing before its withdrawal.
Account information. You may review or change the information in your account, or terminate your account, at any time by logging in to your account settings or by contacting us. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. We may retain some information to prevent fraud, troubleshoot problems, assist investigations, enforce our legal terms, or comply with applicable legal requirements.
Cookies. You can set your browser to remove or reject cookies; see our Cookie Policy. If you have questions about your privacy rights, email us at support@aurelpath.com.
Most web browsers and some mobile systems include a Do-Not-Track ("DNT") feature. Because no uniform technology standard for recognizing DNT signals has been finalized, we do not currently respond to DNT signals. Regardless, we do not track you across third-party websites for advertising. If a standard is adopted that we must follow, we will update this policy.
In short: If you live in certain US states, you may have rights to access, correct, delete, or obtain a copy of your personal information.
If you are a resident of a US state with a comprehensive privacy law (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia), you may have certain rights regarding your personal information. These rights may be limited in some circumstances by applicable law.
The table below shows the categories of personal information (as defined by California law) that we collect. Examples are illustrative and do not necessarily reflect every item we collect.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Real name, alias, online identifier, IP address, email address, and account name | YES |
| B. Personal information (California Customer Records) | Name, contact information, education, and payment information | YES |
| C. Protected classification characteristics | Gender, race and ethnicity, national origin, marital status, and other demographic data | NO |
| D. Commercial information | Subscription, transaction, and payment information | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other network activity | Usage data and interactions with our Services | YES |
| G. Geolocation data | Approximate location (city, state, ZIP code) | YES |
| H. Audio, electronic, visual, or similar information | Photos and images you upload | YES |
| I. Professional or employment-related information | Resume, work history, and career details you provide | YES |
| J. Education information | Academic content, coursework, and application details you provide | YES |
| K. Inferences drawn from collected personal information | Profiles and summaries generated to provide recommendations and roadmaps | YES |
| L. Sensitive personal information | Precise geolocation; account log-in credentials | NO |
We do not collect or process sensitive personal information for the purpose of inferring characteristics about you. We will retain each category of collected personal information for as long as you maintain an account, and no longer than thirty (30) days after the account is terminated.
We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising, as those terms are defined under US state privacy laws. We have not sold or shared personal information in the preceding twelve (12) months. We disclose personal information to our service providers only so they can perform services for us, pursuant to written contracts; this is not a "sale." We do not use your personal information for profiling that produces legal or similarly significant effects.
Depending on your state, you may have the right to:
How to exercise your rights. To exercise these rights, email us at support@aurelpath.com or visit https://aurelpath.com/contact. We will verify your identity before responding. If we decline your request, you may appeal by emailing support@aurelpath.com; if your appeal is denied, you may contact your state attorney general.
California "Shine the Light." California residents may request, once a year and free of charge, information about categories of personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information for third-party direct marketing.
In short: Yes — we will update this policy as necessary to stay compliant with relevant laws.
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we may notify you by posting a notice or by sending you a notification. We encourage you to review this policy periodically.
If you have questions or comments about this policy, email us at support@aurelpath.com or write to us at:
Luther Labs LLC
2200 San Antonio St, Unit 2405
Austin, TX 78705
United States
Depending on the laws of your country or US state, you may have the right to request access to the personal information we collect from you, details about how we process it, and to correct or delete it, or to withdraw your consent. To make a request, email us at support@aurelpath.com or visit https://aurelpath.com/contact.