Navengage Privacy Policy

This policy applies to the Navengage application. It does not apply to the Pathify Campus Experience Platform, which has its own privacy policy at pathify.com/cxp-privacy-policy.

Version 2026-09-09: Current version published at pathify.com/navengage-privacy-policy

Path Education Inc. d/b/a Pathify (“Pathify,” “we,” “us” or “our”) publishes this Privacy Policy for the Navengage application. To exercise any right described here, contact your institution, or write to us at [email protected] and we will route the request. Education records are governed by your institution, and rights in those records are exercised through your institution, as described below.

1. About Navengage and your institution

1.1. Navengage is a student engagement application that lets you set goals, find opportunities and events, and connect with others on your campus. Your institution makes it available to you under an agreement with Pathify, and it may appear under a name your institution has chosen.

1.2. Your institution decides what the application collects and how it is used. Your institution is the controller of the personal information processed through Navengage and provides the rights described in this policy. Pathify processes that information on your institution’s behalf and supports it in responding to your requests.

1.3. Navengage does not include artificial intelligence features. It does not include the Pathify AI Agent, and nothing in the application generates responses using an artificial intelligence model.

2. What we collect

  • Information you provide. Your name, institutional email address, phone number, educational information such as program and class year, a photo if you choose to add one, and anything else you enter into your profile or submit through the application.
  • Content you share. Posts, messages, comments and other content you submit through interactive features. Anything you post using a public sharing feature is visible to others and is not private.
  • Device and usage information. IP address, device and browser information, user settings, unique identifiers, approximate location derived from IP address, and information about how you use the application, including which features you use and how often.
  • Information from your institution. Enrollment, affiliation and account-provisioning information your institution provides so it can give you access.
  • Information from services you connect. Where you sign in through a third-party service your institution has enabled, we receive the information that service makes available.

We do not collect payment information from you. Your institution pays for the application.

3. What we use it for

3.1. We use the information described above to:

  • operate, secure, maintain and improve the application;
  • authenticate you and give you the access your institution has provisioned;
  • deliver the features you use, including events, opportunities and communications from your institution;
  • detect, prevent and address technical issues, fraud and misuse;
  • produce aggregated and de-identified analytics for your institution about how the application is used; and
  • comply with applicable law and respond to lawful requests.

3.2. We do not use your information for our own purposes. We do not sell or share it as those terms are defined under the California Consumer Privacy Act, we do not use it for advertising, and we do not use it to train artificial intelligence models.

3.3. Navengage does not serve advertising. We do not use advertising or targeting technologies in the application and we do not deliver ads to you through it.

3.4. Where you provide sensitive personal information, we do not use it to infer characteristics about you.

4. Who we share it with

  • Your institution. Institutional administrators can see information in the application in accordance with your institution’s own policies and role assignments.
  • Other users. Where you choose to share content or interact with others through the application, they can see what you have shared.
  • Service providers. Vendors that host, secure, support and analyze the application on our behalf, under contracts that require them to protect the information and use it only to provide those services. Our analytics providers are Google Analytics, DataDog and Amplitude.
  • Where required by law. Where we have a good faith belief that disclosure is necessary to comply with law or legal process, to protect against harm, illegal activity or financial loss, to detect or investigate security or fraud issues, or to cooperate with a lawful request from law enforcement or a government authority.
  • Corporate transactions. If Pathify is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.
  • At your direction. Anywhere you ask us to send it.

We do not engage in joint marketing, co-branding, or sharing with business partners.

5. Education records and FERPA

5.1. Some information in Navengage may be an education record under the Family Educational Rights and Privacy Act (“FERPA”). Where it is, your institution controls it, and your rights in it are exercised through your institution.

5.2. Pathify handles education records on your institution’s behalf, under its direct control, only for the purposes for which they were shared with us, and we do not disclose them onward except as your institution directs or as the law requires.

6. Cookies and similar technologies

6.1. We use cookies and similar technologies to keep you signed in, remember your preferences, keep the application secure, and understand how it is used. We do not use them for advertising or targeting.

6.2. Most browsers and mobile devices let you refuse or delete cookies and reset device identifiers. Blocking them may prevent parts of the application from working.

7. How long we keep it

7.1. We keep personal information for as long as your institution’s agreement with us is in effect and you have an active account, and afterwards only where retention is required for legal, accounting or reporting purposes, or where your institution instructs us to retain it.

7.2. On termination or expiry of your institution’s agreement, we return or delete institutional content in accordance with that agreement.

8. Security

8.1. We implement technical, administrative and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration or destruction. These include access controls, encryption in transit and at rest where applicable, secure authentication, and regular security assessments.

8.2. No method of electronic transmission or storage is completely secure. If you have reason to believe your account or personal information has been compromised, contact us at [email protected].

9. Your rights

9.1. Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your personal information, to withdraw consent where processing rests on consent, and not to be treated differently for exercising those rights. Your institution provides these rights as the controller, and Pathify supports it in responding.

9.2. To exercise any of these rights, contact your institution, or write to us at [email protected] and we will route the request to your institution where it is the party that must decide.

9.3. If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights of access, rectification, erasure, restriction, objection and portability, and the right to lodge a complaint with a supervisory authority. Personal data is processed on servers in the United States, and transfers are made under appropriate safeguards.

9.4. Verifying your request. So that we do not disclose your information to someone else, we or your institution may need to verify who you are before responding. Where the request concerns information your institution holds, verification is usually done through your institutional account. You may use an authorized agent to make a request on your behalf, and we may ask that agent for proof of authority.

9.5. Timing and appeal. We or your institution will respond within the period applicable law allows, and will tell you if more time is needed. If a request is declined, you may appeal. Because your institution is the controller, the appeal is decided by your institution, which will tell you in writing what action it has taken and why, within the period applicable law requires. If your appeal is denied, you may contact your state Attorney General.

10. Do Not Track and Global Privacy Control

10.1. The application does not currently respond to Do Not Track browser signals.

10.2. Where required by applicable law, a Global Privacy Control signal is treated as a valid request to opt out of the sale or sharing of personal information and of targeted advertising. As described above, Navengage does not sell or share personal information and does not serve advertising, so there is currently no such processing for the signal to stop.

11. If there is a security incident

If we confirm a security incident affecting personal information processed through Navengage, we notify your institution without undue delay, and your institution provides notice to affected individuals and to regulators where applicable law requires it. Our procedures include investigation and containment, assessment of the scope of information affected, notification to your institution, and remediation.

12. Accessibility

If you need information from this Privacy Policy in an accessible format, contact your institution or write to us at [email protected]. We will work to provide the requested information in a timely and accessible manner.

13. Children

13.1. Navengage is designed for enrolled students, applicants and institutional staff. It is not directed to children under 13, and Pathify does not knowingly collect personal information from them.

13.2. Your institution determines who may access its deployment and is responsible for any consent required for a user under the age of majority in your jurisdiction. If you believe we have collected information from a child under 13, contact us at [email protected] and we will delete it.

14. Other websites

The application may contain links to websites we do not operate or control. Those sites have their own privacy policies, and we are not responsible for their content, privacy practices or security.

15. Changes to this policy

We may update this Privacy Policy. When we do, we will update the version date and publish the updated version at the address above.

16. Contact

Questions about this Privacy Policy should be directed to [email protected] or to Path Education Inc., 5910 S University Blvd, C-18 #224, Greenwood Village, CO 80121.