Privacy Policy

Effective: 21 September 2026 · Written against UAE PDPL (Federal Decree-Law No. 45 of 2021). It says what the software does today, plainly.

Pave is built for K–12 students. We treat children's data with care that exceeds legal minimums. This policy explains, in plain language, what we collect, why, who can see it, and your rights.

1. Who we are

Pave is operated by Pave LLC, licensed in Sharjah Media City (Shams), Sharjah, UAE.

For school deployments, the school generally acts as Data Controller and Pave acts as Data Processor, processing personal data on the school's documented instructions. The school is responsible for establishing the appropriate lawful basis and obtaining any required parental or guardian consents. In practice this means a parent's first point of contact is the school office.

Privacy enquiries can be directed to rahul@pavetheway.ai.

2. What we collect

From students:

• Inventory responses (RIASEC, VIA Character Strengths, custom interest inventories)
• Reflections, journal entries, and free-form responses written within sessions
• Drawing/canvas inputs (primary grades)
• Session completion data (which sessions, when, time spent)
• Sealed letters — a student writes to their future self. The platform keeps these hidden from everyone, including staff and parents, until the unlock date the student chose.

From schools / teachers:

• Class roster and grade information
• Teacher engagement signals (low/mid/high per session)
• Aggregate, non-identifying analytics

From parents:

• Contact information for parental consent and notifications
• Preferred language
• Consent records (granular, time-stamped, revocable)

What we do NOT collect:

• Biometric data
• Health records (beyond what students voluntarily reflect on)
• Browser fingerprints, IP-based tracking, or third-party advertising data
• Any data from children under 13 without verified parental consent

3. Where data lives

Each school runs its own isolated instance of Pave — no school's data shares a database with another school's.

For UAE schools, student data is hosted in the United Arab Emirates. Each school's agreement names the exact infrastructure — the provider and the region — so a school can point to where its students' data sits rather than being told "the cloud". On the public demonstration site, nothing is collected at all: demo work stays in the browser it was typed in.

Pave never moves a school's data to different infrastructure without telling the school first, in writing, before it happens.

4. Who can see what

Pave operates on a strict student-first visibility model. The student decides what each other party sees:

• The student — sees everything in their own portfolio.
• The teacher — sees the portfolios of the students they teach, including reflections written in the sessions they run. A teacher has to read a student's answer to respond to it, and a disclosure has to reach an adult. Teachers cannot read students outside their own caseload.
• The parent — sees aggregate progress and only those reflections the student has marked "share with parent." Sealed letters remain private.
• School leadership — sees cohort-level data and individual portfolios, but never a student's reflections, and cannot change anything in a student's portfolio. This is enforced on the server, not only in the interface, so it holds for anyone using leadership credentials by any route.
• KHDA inspectors — see only the data the school chooses to expose, anonymised, with explicit student consent for any sample journeys.
• Pave staff — access individual data only for security or support purposes, with audit logging. Pave does not read student reflections for product improvement.

These visibility rules are subject to safeguarding requirements, applicable law, security investigations and other circumstances where disclosure is legally required or necessary to protect a student.

5. AI use

The Pave platform uses AI (large language models) for specific, narrowly-scoped purposes:

• Summarising the student's own inventory responses into a plain-language profile
• Generating Socratic prompts during reflection sessions
• Producing pre-session briefs for teachers

Within the FutuReady platform, AI is not currently used to write students' personal statements, to generate career recommendations independently of a student's own input, or to persist anything a student has marked private. AI prompts are logged for safety auditing and are not used to train external models.

For students under 13, all AI use is mediated by the teacher. Direct student–AI interaction begins at Grade 6 with structured, app-controlled flows.

6. Your rights (UAE PDPL)

Under UAE Personal Data Protection Law, you (or your child's parent/guardian) have the right to:

• Access all data we hold about your child — in human-readable format, exportable on request
• Correct any inaccurate data
• Delete data — subject to school's data retention obligations
• Object to specific processing activities
• Withdraw consent at any time, without affecting the lawfulness of past processing
• Restrict processing while a query is being investigated
• Lodge a complaint with the UAE Data Office

To exercise any right, email rahul@pavetheway.ai. We aim to answer within 30 days.

7. Parental consent

As a matter of Pave's policy for school deployments, where parental or guardian consent is required, the school is responsible for obtaining and recording that consent before the relevant processing begins — the school holds the relationship with the family. A parent wishing to withdraw consent should contact the school, which can instruct deletion of the student's record.

8. Data retention

Student data is retained in accordance with the school's documented retention instructions and applicable legal requirements. Unless otherwise agreed with the school, Pave's default retention period is the duration of the student's enrolment plus two years, after which data is deleted unless the student or family requests early deletion or extended retention. Sealed letters are retained until their natural unlock date.

Aggregate, anonymised data may be retained longer for research and product improvement.

9. Children under 13

For students aged 5–12, additional protections apply. Parental consent is required before any data collection. Data minimisation is strict — we only collect what's necessary for the curriculum. AI interaction is mediated by the teacher.

10. Security

Pave maintains technical and organisational safeguards appropriate to the nature of the personal data processed. Traffic is served over TLS, access codes are stored hashed rather than in plain text, and role-based access is enforced on the server and covered by automated tests that run before every change.

Current security documentation and implementation details are provided to schools as part of their security and due-diligence review. Where personal data breaches occur, Pave notifies the controller in accordance with its obligations under the UAE PDPL.

11. Changes to this policy

If we change this policy, we will notify schools and parents at least 30 days before changes take effect. The effective date at the top of this page is updated on every change.

12. Contact

Privacy contact: rahul@pavetheway.ai · WhatsApp +971 56 892 4365.

This policy is written against UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law). It is updated as the service grows, and the version a school signs against is the version that binds.