Privacy Policy

1. Introduction

Your privacy matters to us. This policy explains what information we collect when you use Cultivate HQ, why we collect it, and how we protect it. We believe in being transparent about our data practices, so here's everything you need to know.

2. Information We Collect

We collect information in a few different ways: information you give us directly, data from services you connect to us, and some basic information about how you use our platform.

2.1 Personal Information

This includes your account details (name, email), the contacts you add to your network, records of your interactions and communications, and any voice memos you record.

2.2 Third-Party Data

When you connect external services like email, calendar, or social media accounts, we collect relevant data from those platforms to help build your relationship intelligence.

2.3 Usage Information

We collect basic technical information like your device type and browser, how you use our features, and system logs to help us improve the service and fix any issues.

3. How We Use Your Information

We use your information to make Cultivate HQ work for you. This means providing relationship insights, analyzing your data with AI to generate helpful suggestions, managing your account and payments, providing customer support, and continuously improving our service. Everything we do with your data is focused on making the platform more useful for managing your relationships.

4. Legal Basis for Processing

We process your personal data based on several legal grounds:

Contract: We need to process your data to provide the Service you've subscribed to.

Legitimate Interests: We process data to improve our Service, ensure security, and prevent fraud.

Consent: For certain processing activities, like marketing communications, we'll ask for your explicit consent.

Legal Obligations: Sometimes we need to process data to comply with laws or legal orders.

5. AI Processing and Machine Learning

Our AI analyzes your communications and interactions to provide helpful insights about your relationships. This includes understanding the content of your messages and notes, recognizing patterns in how you interact with people, automatically organizing your contacts and activities, and suggesting when you might want to reach out to someone.

We work with trusted AI service providers who are required to protect your data and only use it to provide services to us - never for their own purposes.

6. Automated Decision Making

Our AI makes automated suggestions about your relationships, but you're always in control. We don't make any fully automated decisions that would significantly affect you without human involvement. All AI suggestions are just that - suggestions for you to review and act on as you see fit.

7. Information Sharing and Disclosure

We don't sell your personal information. Period. We only share your data in very specific circumstances to provide our service or comply with the law:

5.1 Service Providers

We work with trusted companies that help us run Cultivate HQ, like our AI providers, cloud hosting services, payment processors, and security services. These partners are required to protect your data and can only use it to help us provide our service to you.

5.2 Legal Requirements

If we're legally required to share your information (like by court order) or if we need to protect the safety of our users, we may disclose your data. We'll only do this when absolutely necessary.

8. Third-Party Integrations

When you connect external services like Gmail or LinkedIn to Cultivate HQ, you're giving us permission to access relevant data from those services to provide our relationship intelligence features. Remember that these external services have their own privacy policies that also apply to your data.

9. Data Security

We take protecting your data seriously. We encrypt your information when it's stored and when it's being transmitted, use strong access controls to limit who can see your data, regularly monitor our systems for security issues, and follow industry best practices for data protection.

10. Data Retention

We keep your data according to these timeframes:

Active account data: As long as you have an active subscription plus 30 days.

After cancellation: We retain your data for 90 days in case you want to reactivate.

Legal and tax records: Up to 7 years as required by law.

You can request immediate deletion of your data anytime, except for information we must keep for legal reasons.

11. Your Rights and Choices

You have control over your personal information. You can access and review what data we have about you, correct any mistakes, delete your account and data, export your information to take elsewhere, and object to certain ways we process your data. Just contact us if you want to exercise any of these rights.

12. International Data Transfers

Your data might be processed in different countries as we use global cloud services. We ensure appropriate protection through:

Standard Contractual Clauses: We use EU-approved contracts when transferring data outside the European Economic Area.

Data Privacy Framework: We work with providers that participate in approved data transfer frameworks.

Technical Safeguards: All data is encrypted in transit and at rest, regardless of location.

13. Cookies and Tracking Technologies

We use different types of cookies and similar technologies:

Essential Cookies: These are necessary for the Service to work properly, like keeping you logged in.

Analytics Cookies: These help us understand how you use Cultivate HQ so we can improve it.

Preference Cookies: These remember your settings and preferences.

You can control cookies through your browser settings, but disabling essential cookies might prevent you from using certain features. We respect "Do Not Track" signals from your browser.

14. Children's Privacy

Cultivate HQ is designed for adults and we don't knowingly collect information from children under 13. If you think we've accidentally collected a child's information, please let us know right away so we can delete it.

15. Changes to This Privacy Policy

We may update this privacy policy occasionally. When we make significant changes, we'll let you know by updating this page and changing the "last updated" date at the top. For major changes, we'll give you additional notice.

16. Marketing Communications

We'll only send you marketing emails if you opt in. You can unsubscribe anytime by clicking the link in our emails or contacting us. Even if you opt out of marketing, we'll still send you important service updates about your account.

17. Data Breach Notification

If a data breach occurs that's likely to result in a risk to your rights and freedoms, we'll notify you without undue delay. We'll tell you what happened, what data was affected, and what steps we're taking to address it.

18. Jurisdiction-Specific Rights

California Residents: You have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your information, and the right to opt-out of any "sales" of personal information (though we don't sell your data).

European Users: Under GDPR, you have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority.

Other Jurisdictions: You may have additional rights under your local laws. Contact us to learn more about exercising your rights.

19. Data Minimization

We believe in collecting only what we need. We don't collect personal information that isn't necessary for providing our Service, and we regularly review our data collection practices to ensure we're not keeping more than we need.

20. Third-Party Service Providers

Here are the main types of service providers we work with:

Infrastructure: Cloud hosting providers (AWS, Google Cloud) for secure data storage and processing.

AI Services: Anthropic and other AI providers for natural language processing and insights generation.

Authentication: Auth0 or similar services for secure login.

Payment Processing: Stripe or similar PCI-compliant payment processors.

All our service providers are contractually required to protect your data and use it only as we direct them.

21. Contact Information

Have questions about this privacy policy or how we handle your data? We're here to help! You can reach us at:

Email: privacy@cultivatehq.com

For data protection inquiries, you can also contact our Data Protection Officer at: dpo@cultivatehq.com