Skip to main content

Last updated 30 October 2026

Privacy Policy

This policy explains how ROADPATH LTD (“RoadPath”, “we”, “us”) collects, uses and protects personal data when you visit roadpath.co.uk, use the RoadPath app, or are a learner whose driving instructor uses RoadPath.

1. Who we are

ROADPATH LTD is a company registered in England and Wales (company number 17518473), registered office 2 Bright Ridge, Tunbridge Wells, Kent, TN4 0JL. RoadPath is software for professional driving instructors to manage learners, lessons, bookings, payments and messages. Contact us about privacy at contact (at) roadpath.co.uk.

2. Our role

  • Instructors (our customers): we are the controller of the account, subscription and billing data of instructors who use RoadPath.
  • Learners: each driving instructor decides what learner data to keep and is the controller of it. RoadPath acts as their processor: we store and process learner data only to provide the service to that instructor and on their instructions, under our Data Processing Agreement. Learners should contact their instructor first; we will help instructors respond to requests.

3. What data we collect

Instructors

  • Name, email address, phone number, business or trading name and business address.
  • Account login details (passwords are stored only in hashed form by our authentication provider).
  • Subscription and billing records. Card details are handled by Stripe; we never see or store full card numbers.
  • Settings, prices, diary, lesson notes, income and expense records you enter, and receipts you upload.
  • Questions you ask the RoadPath assistant and its answers.
  • If you connect WhatsApp: your WhatsApp Business account ID, phone number ID and the access details Meta gives us, plus the messages sent and received through RoadPath.

Learners (entered by their instructor)

  • Name, contact details (email, phone), and address or pick-up location.
  • Lesson bookings, attendance, progress, skills assessments, notes, test dates and payment records.
  • Messages sent to the learner (email, notifications, and WhatsApp if the instructor uses it), and replies.
  • Whether the learner has agreed to receive WhatsApp messages, and when.

Website visitors

Basic technical data needed to run the site securely (such as IP address and browser type in server logs). We do not use advertising or tracking cookies.

4. Why we use it and our legal basis

  • To provide RoadPath (contract): running your account, bookings, reminders, payments and messages.
  • Billing (contract and legal obligation): subscriptions, AI credit purchases and accounting records.
  • Security and improvement (legitimate interests): preventing misuse, fixing faults, keeping the service reliable.
  • Service emails (contract): sign-in, receipts and important account notices.
  • For learner data, the instructor is responsible for having a lawful basis (usually contract or legitimate interests) and, for WhatsApp messages, the learner’s consent.

5. WhatsApp messaging

Instructors can connect their own WhatsApp Business number to RoadPath through Meta’s WhatsApp Business Platform (Cloud API). When connected:

  • Messages are sent from the instructor’s own number, for example booking confirmations, lesson reminders, cancellations, payment reminders and receipts.
  • We only send WhatsApp messages to learners who have agreed to receive them. We record when and how that agreement was given.
  • Learners can stop WhatsApp messages at any time by replying STOP or by asking their instructor. We then stop sending them WhatsApp messages from RoadPath.
  • We share with Meta only what is needed to deliver each message: the learner’s phone number and the message content. Learner replies are received by RoadPath so the instructor can see them.
  • Meta processes this data under its own terms as the WhatsApp provider. See the WhatsApp Business Policy and WhatsApp Privacy Policy.
  • Meta charges the instructor directly for WhatsApp messages. RoadPath does not sell WhatsApp messages.
  • WhatsApp messages and delivery records are kept for as long as the instructor keeps the learner’s record, or until the instructor disconnects WhatsApp and deletes them.

6. AI features

  • RoadPath uses OpenAI’s API for the Ask RoadPath assistant, reading receipts, lesson summaries and debriefs, explanations and summaries for learners and their parents or payers, certificate wording, turning your lesson notes into suggested entries, lesson plans, goal suggestions and Teaching Help.
  • Where RoadPath adds a learner’s details to a request itself, the learner’s name is replaced with a stand-in such as “Learner #3” and email addresses are removed before anything is sent to OpenAI. Text you type yourself is sent as you wrote it, apart from the learner’s own name and email address where RoadPath can recognise them, so please don’t type other people’s personal details into free-text notes.
  • When you add a receipt, the photo or file is sent to OpenAI to read the amount, date and supplier.
  • Teaching Help answers come from the approved shared teaching library, including selected GOV.UK pages. Your own uploaded teaching materials are searched only if you choose to for that question, and only for documents you have allowed. Matching passages are sent to OpenAI together with your question.
  • You can choose phone speech, which uses your device’s built-in service and is not sent to OpenAI, or natural voice, which sends the answer text to OpenAI Realtime to generate audio. Before natural voice is used, RoadPath removes learner surnames and email addresses; natural voice uses your AI voice-minute allowance.
  • OpenAI does not use data sent through its API to train its models. Assistant conversations are kept for 90 days and can be cleared sooner by the instructor.
  • The assistant never makes changes on its own: the instructor reviews and confirms every action.

7. Who we share data with

We do not sell personal data. We use these service providers to run RoadPath:

  • Supabase: database, sign-in and file storage (servers in Ireland, EU).
  • DigitalOcean: hosting of the app (servers in London, UK).
  • Cloudflare: protects roadpath.co.uk from attacks and automated sign-ups. Traffic to the site passes through it in transit, it sees visitors’ IP addresses, and it sets one security cookie.
  • Stripe: subscriptions, AI credit purchases, and card payments from learners to instructors. Learner payments go directly to the instructor’s own Stripe account.
  • Resend: sending emails.
  • OpenAI: the assistant, receipt reading, lesson and learner summaries, certificate wording, Teaching Help and spoken answers.
  • Meta (WhatsApp): WhatsApp messages, only for instructors who connect WhatsApp.
  • Browser push services (such as Apple and Google) deliver notifications you turn on.

We may also share data if the law requires it, or with professional advisers under confidentiality.

8. International transfers

Some providers (such as OpenAI, Stripe, Resend and Meta) may process data in the United States or elsewhere outside the UK. Where they do, we rely on UK-approved safeguards such as the UK International Data Transfer Addendum, Standard Contractual Clauses or the UK–US data bridge.

9. How long we keep data

  • Instructor account data: while the account is open, then up to 12 months to handle queries, unless the instructor asks us to delete it sooner.
  • Billing and accounting records: 6 years, as required by UK law.
  • Learner data: for as long as the instructor keeps it. Instructors can archive or delete learners, and learner data is deleted when the instructor asks us to close and delete their account.
  • Assistant conversations: 90 days.
  • Backups: our database provider keeps daily backups for a short period (normally 7 days). Deleted data stays in those backups until they expire, is not used, and is then gone for good.

10. Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Access is limited to the instructor who owns the data and to RoadPath staff who need it to support the service. Secrets such as WhatsApp access details are stored encrypted on the server and are never shown in the app.

11. Your rights

Under UK data protection law you can ask to access, correct, delete or move your data, object to or restrict its use, and withdraw consent (for example to WhatsApp messages) at any time. Instructors can email contact (at) roadpath.co.uk. Learners should contact their instructor first, or email us and we will pass the request to the instructor and help them answer it. We reply within one month.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

How to delete your data

  • Instructors: email contact (at) roadpath.co.uk from the email address on your RoadPath account and ask us to close and delete your account. We confirm we have received it within 5 working days and delete your account, your learners’ records, assistant conversations and any WhatsApp connection details within 30 days. Billing records we must keep by law (6 years) are kept but no longer used.
  • WhatsApp: disconnecting WhatsApp in RoadPath removes the access details Meta gave us. You can also remove RoadPath from your WhatsApp Business account in Meta Business Settings.
  • Learners: ask your instructor to delete your record, or email contact (at) roadpath.co.uk and we will pass your request to your instructor and help them complete it.

12. Cookies and local storage

We only use cookies and browser storage that are strictly necessary: keeping you signed in, remembering settings on your device (such as voice choices), and Cloudflare’s security cookie that tells people apart from bots. We do not use advertising or analytics cookies, so no cookie banner is needed.

13. Children

RoadPath accounts are for adult driving instructors. Learners may be 16 or 17; their data is entered and managed by their instructor, who is responsible for it.

14. Changes

We will update this page if our practices change and show the new date at the top. Important changes are emailed to instructors.

15. Contact

ROADPATH LTD, contact (at) roadpath.co.uk. See also our Terms of Service.