Legal

Privacy Policy

Effective Date: February 3, 2026

Last Updated: September 23, 2026

1. Introduction

Lilypath LLC, a Delaware limited liability company (“Lilypath,” “we,” “us,” or “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (lilypath.com) or use our services.

Please read this Privacy Policy carefully. By accessing our website or using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use our services.

2. Information We Collect

We collect information that you provide directly to us, information collected automatically, and information from third-party sources.

2.1 Information You Provide

Account and Order Information:

  • Full name

  • Email address

  • LinkedIn profile URL

  • Current job title and company (optional)

  • Phone number (if provided)

Profile Materials:

  • LinkedIn profile PDF exports

  • Supporting documents you upload (resumes, bios, previous assessments)

  • Any additional materials you choose to share

Intake Form Responses:

  • Target audience descriptions

  • Professional goals and objectives

  • Preferences for recommendations

  • Other context you provide about your professional situation

Communications:

  • Emails and messages you send to us

  • Feedback, testimonials, or reviews you provide

Authority Snapshot Inputs:

When you run an Authority Snapshot, we collect:

  • Full name (required)

  • Email address (required), to which we send the link to your report

  • Nickname or other names (optional)

  • Country, if outside the United States (optional)

  • Whether your business or service depends on local customers (optional), and if it does, your city and state (required in that case)

  • Profession (required)

  • One thing you are known for (required)

  • Current title and company, and any other current roles (optional)

  • Which best describes you, chosen from a short list (optional)

We submit this information, except your email address and which best describes you, to third-party AI engines, and to a provider that retrieves Google’s AI Overviews, as part of a search query. We then send the answers those engines return, with the same information, to an AI model provider, which reviews the answers and writes the list of issues and suggested actions in your report. Which best describes you is not sent to any AI engine or provider. We use it to choose the wording and offers in your report, and to group your scores with those of others who gave the same answer, so that once a group is large enough, AI Pulse reports can show the range in which that group typically scores. A range is calculated from scores alone and never identifies you or anyone in the group. See Sections 4.1 and 4.6.

Subscription and Monitoring Inputs:

If you purchase a subscription or package that includes recurring monitoring — AI Pulse, included with Authority 360 and the Job Seeker Search Pack — we use your name and the professional context you provide to run recurring queries against third-party AI engines, and to retrieve Google’s AI Overviews for the same queries, for the duration of your subscription or package. If you add questions of your own, we submit them word for word. If you subscribe from your own Authority Snapshot, that Snapshot becomes part of your subscription record as the first point of your AI Pulse series. If an organization purchases Authority Graph, we additionally use the reference materials that organization maintains about the people it enrolls. See Section 4.6.

Messages to Our Website Assistant:

  • If you use Lily, the AI assistant on our website, we collect the text of the questions and messages you type, and any information you choose to include in them

  • If you use the assistant's contact form, we collect the name, email address, and message you enter

  • See Section 4.7 for how the assistant works and who provides it

Payment Information:

Payment card information is collected and processed by our payment processor, Stripe. We do not collect or store complete credit card numbers on our servers. We may receive partial card information (such as the last four digits) for order identification purposes.

We do not request, and you should not send us, any sensitive personal information, such as your social security number, drivers licensing number, personal health information or similar information. The Services are not designed to handle or protect this information, and we do not need it to perform the Services.

2.2 Information Collected Automatically

When you access our website, we may automatically collect:

Device and Usage Information:

  • IP address

  • Browser type and version

  • Operating system

  • Pages visited and time spent on pages

  • Referring website or source

  • Date and time of access

  • On pages where our website assistant loads: how far you scroll and whether you are active on the page, together with a random identifier stored in your browser so that a conversation continues as you move between pages. See Sections 4.7 and 8.3.

Cookies and Similar Technologies:

  • We use cookies and similar tracking technologies to enhance your experience. See Section 8 for more details.

Bot and Abuse Prevention:

  • We use Cloudflare Turnstile to distinguish human visitors from automated traffic on our forms. Turnstile receives your IP address and browser signals. It does not use advertising cookies and we do not use it to track you across websites.

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

  • Payment Processor: Transaction status, partial payment details

  • Email Provider

  • Quality Assurance Tracker

  • Document Storage Provider

3. How We Use Your Information

We use the information we collect for the following purposes:

To Provide Our Services:

  • Create and deliver your Comprehensive Blueprint

  • Personalize recommendations based on your goals and target audience

  • Run the recurring Progress Checks and AI Pulse reads included with your subscription or package

  • Limit the free Authority Snapshot to one per person, by checking a new request against the email addresses and names associated with earlier Snapshots

  • Provide Authority Graph monitoring and reporting for enterprise and agency clients

  • Respond to your inquiries and provide customer support, including through the AI assistant on our website

  • Process payments and send order confirmations

To Improve Our Services:

  • Analyze usage patterns to improve our website and offerings

  • Develop new features and services

  • Refine our methodologies and assessment frameworks using aggregated, de-identified usage data (never your uploaded content)

  • Conduct internal research and analysis

To Communicate With You:

  • Send order confirmations and delivery notifications

  • Respond to your questions and requests

  • Provide service-related announcements

  • Send marketing communications (with your consent, where required)

To Protect Our Services:

  • Detect and prevent fraud, abuse, or security incidents

  • Enforce our Terms of Service

  • Comply with legal obligations

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

Provider Data Shared
Payment processing Payment information, order details
Quality Assurance Order number, name
Email delivery Email address, message content
File storage Uploaded documents, deliverables
Application platform and order processing Order details, uploaded content, email address
Generative AI Report Generation, QC, Analysis (via API) Uploaded content
Generative AI engines used by Authority Snapshot (OpenAI, Google, Anthropic, Perplexity) Your name and any optional context you provide, submitted as a search query
Generative AI engines used by AI Pulse (OpenAI, Google, Anthropic, Perplexity) Your name and any optional context you provide, submitted as recurring search queries, together with any questions of your own that you add, word for word
Google AI Overviews retrieval, used by Authority Snapshot and AI Pulse (DataForSEO) The same queries, including your name and any optional context you provide (and, for AI Pulse, any questions of your own), submitted to Google Search so that we can retrieve the AI Overview Google shows for them
AI review of Authority Snapshot and AI Pulse answers (Anthropic) The answers the engines returned and the sources they cited, together with your name and the context you provide (and, for AI Pulse, the answers to any questions of your own and the names you watch), so that the answers can be checked and the list of issues and suggested actions in your report can be written. Your email address is not sent
Generative AI engines used by Authority Graph (OpenAI, Anthropic, Google, Perplexity) The name and professional context of each person enrolled, submitted as recurring queries
Bot and abuse prevention (Cloudflare) IP address, browser signals
Website analytics and tag management (Google) Usage data, device information, cookie identifiers
Referral and affiliate attribution (Rewardful) Referral identifier, order confirmation
Website AI assistant (Navu) Pages viewed on our website, scroll and activity signals, a random browser identifier, the messages you type to the assistant, and anything you submit through its contact form. Navu generates answers using OpenAI, Google, and Anthropic models. See Section 4.7.
Customer relationship management (HubSpot) Name, email address, and message when you use the website assistant's contact form, together with the pages you viewed and your conversation with the assistant, so that we can follow up
Internal team notifications (Slack) Website assistant conversations and contact-form submissions, relayed to our team so that a person can respond

These providers are contractually obligated to protect your information and use it only for the purposes for which it was shared.

4.2 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

4.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to:

  • Comply with applicable laws or legal obligations

  • Protect our rights, privacy, safety, or property

  • Protect the rights, privacy, safety, or property of our users or others

  • Detect, prevent, or address fraud, security, or technical issues

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, sale of assets or other business transaction, your information may be transferred as part of or in advance of that transaction.

4.5 Aggregated or De-identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you for research, marketing, analytics, or other purposes.

4.6 Authority Snapshot, AI Pulse, Authority Graph, and Third-Party AI Engines

Authority Snapshot works by asking third-party AI engines — currently OpenAI’s ChatGPT, Google’s Gemini, Anthropic’s Claude, and Perplexity — a fixed set of questions about you, with web search enabled, and showing you the answers those engines return. It also retrieves the AI Overview that Google Search shows for the same questions, through our provider DataForSEO, and shows it in a separate section of your report.

To do this, we transmit the name and any optional context you provide to those engines, and to DataForSEO for submission to Google Search, as part of a search query. We then send the answers, with the same details, to Anthropic, whose model reviews them and writes the list of issues and suggested actions in your report; AI Pulse does the same each time it runs. Each engine and provider processes what we send under its own terms and privacy policy, which we do not control. We do not send your email address to the AI engines, to DataForSEO, or to Anthropic for this review.

AI Pulse — included with Authority 360 and the Job Seeker Search Pack — re-runs queries of this kind about you on a recurring schedule for the duration of your subscription or package, using the same engines and Google’s AI Overviews, so you can see when the answers about you change. If you add questions of your own, we send them to each engine and to DataForSEO word for word, so do not include anything in them you would not want those services to receive. Each engine and provider processes those queries under its own terms and privacy policy, which we do not control.

If you subscribe to AI Pulse from your own Authority Snapshot, we link that Snapshot to your subscription as the first point of your AI Pulse series, so that later readings can be compared with it. We link a Snapshot only when it was about you and the name on it matches the name your AI Pulse tracks.

Authority Graph, our enterprise and agency platform, runs recurring queries about the people an organization enrolls across additional engines — currently OpenAI’s ChatGPT, Anthropic’s Claude, Google’s Gemini, and Perplexity — and compares the answers against reference materials the organization maintains. Each engine processes those queries under its own terms and privacy policy, which we do not control.

The answers returned by any of these services come from third-party systems and public web sources. They may be inaccurate, outdated, or about a different person with the same or a similar name. Nothing in them is verified fact about you, and nothing in them is a rating, ranking, or score assigned by any AI platform.

To have an Authority Snapshot report and its associated email address deleted, email hello@lilypath.com with the subject line “Delete my snapshot.”

4.7 Lily, Our Website Assistant

Lily, the assistant that appears on lilypath.com and on the public pages of app.lilypath.com, is an automated AI assistant, not a person. It is provided by Navu (Navu Inc.), which operates it on our behalf. It answers from the published pages of our website, and its answers can be incomplete, out of date, or wrong; the prices and terms shown at checkout, and these documents, control over anything the assistant says.

When the assistant loads, Navu receives your IP address and browser information in the course of serving it, as any web service does. We have configured Navu not to store your IP address or other identifying information about you unless you provide it in a conversation. Navu records which of our pages you view and how you interact with them, under a random identifier stored in your browser, so that a conversation can follow you from page to page. When you type a question, the text of your message is sent to Navu, which generates an answer using third-party AI models — currently from OpenAI, Google, and Anthropic. Navu states that those providers are not permitted to train their models on this data. Your messages, and anything you submit through the assistant's contact form, are stored by Navu and are visible to Lilypath staff so that we can improve the assistant's answers and follow up when you ask us to. Conversations and contact-form submissions are also relayed to our team through Slack, and if you give us your contact details they are added to our customer relationship management system, HubSpot, so that we can reply and keep a record of the conversation. See Section 4.1.

Please do not enter passwords, payment details, or other sensitive personal information into the assistant. To have your conversations with the assistant deleted, email hello@lilypath.com with the subject line “Delete my chat.”

5. Data Retention

We retain your information for as long as necessary to fulfill the purposes for which it was collected, including:

Order and Deliverable Data:

  • Retained for the duration of our business relationship plus a reasonable period to allow for follow-up services, disputes, or legal compliance

  • Typically retained for 3 years after last service delivery

Uploaded Profile Materials:

  • Files you upload to us — LinkedIn profile PDF exports, resumes, bios, previous assessments, and other supporting documents — are retained for 60 days after your Blueprint is delivered, and are then deleted

  • The Blueprint produced from those materials is retained under “Order and Deliverable Data” above

Payment Records:

  • Retained as required for tax, accounting, and legal compliance purposes

  • Typically retained for 7 years

Communications:

  • Retained as needed for customer service and legal compliance

Authority Snapshot Reports:

  • Snapshot reports remain available at the link generated for them, and are retained — together with the email address associated with them — until you ask us to delete them

  • You may request deletion at any time by emailing hello@lilypath.com with the subject line “Delete my snapshot”

  • Answers retrieved from the AI engines may be reused for a subsequent run for the same name and location rather than re-queried

  • A Snapshot that becomes the first point of your AI Pulse series keeps this retention: it stays available until you ask us to delete it, and if you do, it is removed from your series

Subscription Monitoring Data (AI Pulse and Authority Graph):

  • Query results, scores, and score history are retained for the duration of your subscription or package, and then in accordance with “Order and Deliverable Data” above

Website Assistant Conversations:

  • Your messages to the website assistant, its contact-form submissions, and the associated page-visit record are held by Navu for as long as we use its service, and Navu deletes all of our data within 30 days after the service ends

  • You may ask us to delete your conversations at any time (see Section 4.7)

Automatically Collected Data:

  • Website analytics data is typically retained for 26 months

You may request deletion of your personal information at any time, subject to our legal retention obligations. See Section 7 for details.

6. Data Security

We implement appropriate technical and organizational measures designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • Secure transmission of data using SSL/TLS encryption

  • Access controls limiting who can view personal information

  • Regular security assessments

  • Use of reputable third-party service providers with strong security practices

However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its security.

7. Marketing Communications

You may opt out of receiving marketing communications from us at any time by:

  • Clicking the “unsubscribe” link in any marketing email

  • Contacting us at hello@lilypath.com

Please note that even if you opt out of marketing communications, we may still send you service-related messages (such as order confirmations and delivery notifications).

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly and provide information to website owners.

8.2 How We Use Cookies

We use cookies and similar technologies to:

  • Enable essential website functionality

  • Remember your preferences

  • Analyze website traffic and usage patterns

  • Improve our website and services

8.3 Types of Cookies We Use

Type Purpose
Essential Cookies Required for basic website functionality — form submission, payment processing, security, and abuse prevention (Cloudflare Turnstile). Always active.
Analytics Cookies Google Analytics 4, deployed through Google Tag Manager. Helps us understand how visitors find and use our website.
Attribution Cookies Rewardful. Records the referral or affiliate source of a visit so that partner referrals can be credited correctly.
Preference Cookies Remember your settings and choices, including your cookie consent choice.
Website Assistant Three items that Navu, the provider of our website assistant, stores in your browser: your consent state, the assistant's layout settings, and a random identifier for this browser so that a conversation continues as you move between our pages. Navu does not use it to track you across other websites.
Functional — Snapshot Link A cookie named snapshot_ref, set on .lilypath.com for 30 days, only when you press a buy button on your own Authority Snapshot and you have allowed functional cookies. It holds a random reference to that Snapshot — not your name, your email address, or the Snapshot’s own link — so that if you subscribe to AI Pulse, your Snapshot can become the first point of your series. The same reference is also added to the address of the lilypath.com page the button opens and carried to our checkout.
Sign-In State A single cookie recording only that someone is signed in to your Lilypath account on this browser, so lilypath.com can show "My Account" instead of asking you to sign in again. It contains no name, email, account identifier, or other personal information, and it is cleared when you sign out.

8.4 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically:

  • View what cookies are stored on your device

  • Delete some or all cookies

  • Block some or all cookies

  • Set preferences for certain websites

Please note that blocking or deleting cookies may affect your ability to use certain features of our website.

8.5 Your Consent

Where required by applicable law, we ask for your consent before setting analytics or attribution cookies. Essential cookies are always active, because the website cannot function without them. You can change or withdraw your choice at any time using the cookie settings link in our website footer.

8.6 Measurement Across Our Domains

Our website and our product surfaces run on separate subdomains, including app.lilypath.com, snapshot.lilypath.com, ag.lilypath.com, and hotwire.lilypath.com. We configure our analytics so that a visit moving between these domains is recognised as one session rather than several unrelated ones.

This measurement is limited to domains we operate. We do not combine it with data from websites we do not control, and we do not use it for cross-site advertising.

9. Third-Party Links

Our website may contain links to third-party websites, including LinkedIn. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party websites you visit.

We are not responsible for the privacy practices or content of third-party websites.

10. Children’s Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information.

If you believe we have collected information from a child under 18, please contact us at hello@lilypath.com.

11. International Data Transfers

Lilypath is based in the United States. If you access our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

By using our services, you consent to the transfer of your information to the United States and the processing of your information in accordance with this Privacy Policy.

12. State Privacy Rights

You may have certain rights regarding the information we collect from or about you pursuant to state law, including the California Consumer Privacy Act (“CCPA”), Virginia Consumer Data Protection Act (“VCDPA”), Colorado Privacy Act (“CPA”), Connecticut Data Privacy Act (“CTDPA”) the Utah Consumer Privacy Act (“UCPA”), the Maryland Online Data Privacy Act (“MODPA”), or under federal law, depending on how you interact with us. The applicable law and rights you may have may depend on the state in which you reside.

If the information collected through the website or services is within the scope of state consumer privacy laws, you may have the following rights:

  • Right to confirm. You have the right to confirm whether we are processing your personal information.

  • Right to access. You have the right to request that we provide you with the information we have collected about you through the website or services in the last 12 months in a portable, machine-readable format, to the extent technically feasible.

  • Right to know. You have the right to request that we disclose information to you about our collection and use of your personal information collected through the Website over the past 12 months. Specifically, you have the right to know: The categories of personal information we collected about you

  • The categories of sources for the personal information we collected about you

  • Our business or commercial purpose for collecting or selling that personal information

  • The categories of third parties with whom we disclose the information for a business purpose

  • The specific pieces of personal information we collected about you

  • If information collected through the website or services was sold, shared, or disclosed for a business purpose, the categories of third parties it was sold to, shared with, or disclosed to and the categories of personal information that were sold, shared, or disclosed

  • Right to delete. You have the right to have the information collected through the website or services deleted, subject to applicable exceptions.

  • Right to correct or update. You have the right to request that we update your personal information, or that we correct your personal information that is inaccurate.

  • Right to limit certain uses and disclosures of your “sensitive personal information.” You have the right to request that we limit certain uses and disclosures of sensitive personal information, to the extent we collect it or use it in ways that reasonable consumers would not expect. We currently do not collect any sensitive personal information, but you may contact us if you are interested in learning more about this right or if you wish to confirm.

  • Right to opt-out of the “sale,” or “sharing” of personal information, or “behavioral targeted advertising.” You have the right to opt-out of the sale or sharing of your personal information, or to opt-out of targeted advertising, as those terms are defined in applicable law.

  • Right to an authorized agent. You may have the right to have an authorized agent make a request on your behalf. Please note that if you elect to have an authorized agent exercise your rights on your behalf, we will take steps to ensure that they have your authority, consistent with the applicable law and regulations.

  • Right to appeal. If we notify you that we are unable to process your request, you may have the right to appeal our decision not to fulfill your request.

  • Right to non-discrimination. You have the right to non-discrimination for exercising your applicable privacy rights.

To exercise these rights, please contact us at hello@lilypath.com. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

We may need to verify your identity before processing certain requests.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make changes, we will update the “Last Updated” date at the top of this policy.

For material changes, we will provide notice through our website or by email (if we have your email address).

Your continued use of our services after any changes indicates your acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Lilypath LLC Email: hello@lilypath.com Website: lilypath.com

15. Non-Affiliation Disclaimer

Lilypath is not affiliated with, endorsed by, or sponsored by LinkedIn Corporation. Any references to LinkedIn or other third-party services in this Privacy Policy are for descriptive purposes only. Please refer to LinkedIn’s privacy policy for information about how LinkedIn handles your data.