Privacy
Privacy Policy
Culture Hub Limited · Effective 23 June 2025 · Last reviewed 6 August 2026
1. Introduction
Culture Hub Limited ("we", "us", "our") is committed to safeguarding the privacy of everyone who uses the CultureHub platform. This policy explains how we collect, use, store and share personal data across our products: DISC personality profiles, the Development Compass (180°/360° feedback) and AI conversation simulations (including Event Mode).
For people invited to the platform by their employer or another organisation, that organisation is the data controller and CultureHub acts as a processor on its behalf under a data-processing agreement. For visitors to our marketing website and for our own client contacts, Culture Hub Limited is the controller.
2. Information we collect
- Account & identity, your name, work email, organisation, role and (optionally) region, team/cohort and line manager.
- DISC & Development Compass, your assessment responses, computed scores, AI-generated narratives, and any free-text feedback you give or receive.
- AI simulations, your spoken audio and its transcript during a live practice call (both handled transiently, see §8), and the resulting scores, observations and recommendations.
- Event Mode, a display name and optional team you enter yourself (no account required).
- Usage & technical data, sign-in activity, and standard technical data such as IP address, browser type and device information needed to run and secure the service.
We do not intentionally collect special-category data, and we ask you not to include it in free-text responses.
3. How we use your information
- Service delivery, to generate your DISC profile, feedback reports and simulation scores, and to show them to you and the people in your organisation authorised to see them (e.g. your administrator, or your line manager where you have chosen to share).
- Communication, to send sign-in codes, assessment invitations and notifications (for example when your report is released).
- Security & compliance, to protect the service, keep an audit trail, and meet our legal obligations.
We do not sell your personal data and we do not use it for advertising or to train third-party AI models. Any product or service updates we send to client contacts include an easy way to opt out.
4. Legal bases for processing
- Contract, to provide the services your organisation has engaged us for.
- Consent, where we ask for it, for example the consent you give before starting a DISC assessment. You can withdraw consent at any time.
- Legitimate interests, to run, secure and improve the platform, where this does not override your rights.
- Legal obligation, where processing is required to comply with the law.
5. Sharing & sub-processors
We share data with a small number of trusted providers who process it only on our instructions, under a data-processing agreement, and only as needed to run the platform:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Primary database & file storage (your account, assessments, scores, reports) | European Union |
| Vercel | Application hosting & delivery | USA / global edge |
| LiveKit (& its speech sub-processors, incl. ElevenLabs) | Real-time voice, speech-to-text and text-to-speech during simulation calls | EU region / USA |
| Groq | AI language model that runs the simulation conversation and generates scores & summaries | USA |
| Anthropic (Claude) | AI language model that generates DISC & Development Compass report narratives | USA |
| Postmark | Transactional email (sign-in codes, invitations, notifications) | USA |
| Stripe | Payment processing for credit purchases (card details are handled by Stripe; we never store them) | USA / global |
We may also disclose data to legal authorities where required by law, or as part of a merger, sale or transfer of business assets. AI providers process your inputs only to return a result to us and do not use them to train their models.
6. International data transfers
Your core personal data is stored at rest in the European Union. Some of our processors (for example AI, email, payment and hosting providers) operate in the United States or other countries, so limited data may be transferred there. Where it is, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / EU Standard Contractual Clauses.
7. Data security
We apply industry-standard measures to protect your data, including encryption in transit, row-level access controls that keep each organisation's data separate, passwordless one-time-code sign-in, and an insert-only audit log. Access is restricted to what is necessary to operate the service.
8. Retention
- Simulation audio is streamed live for the conversation and is not recorded or stored by us.
- Simulation transcripts are deleted immediately after your call is scored, only the derived scores and feedback are kept.
- Assessment scores & reports are retained so you and your organisation can review them over time.
- Inactive personal details are automatically pseudonymised after 12 months.
We otherwise keep personal data only as long as needed for the purposes above or as required by law.
9. Your rights
You have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. If you have an account, use the My data page in your dashboard to export or request deletion of your data, or contact your organisation's administrator. You can also contact us at info@culture-hub.com. You have the right to complain to the UK Information Commissioner's Office (ICO).
10. Cookies
CultureHub uses a single essential, secure, HTTP-only cookie to keep you signed in. We do not use advertising or third-party tracking cookies on the platform.
11. Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with an updated review date.
12. Contact us
Questions or concerns? Contact us at info@culture-hub.com. Organisations can request our full data-processing agreement from the same address.