Privacy policy

We collect only what we need to run the service:

• Account details — your name, email address, and the name of your workspace.
• Workspace content — campaign briefs, uploaded documents, research results, notes, strategies, reports, experiment results and assistant conversations you or your team create.
• Pilot requests — the name, email, company, team size and message you send through the pilot form.
• Usage and technical data — events such as “research run started” or “report exported”, plus standard server logs (for example IP address, browser type and timestamps) used for security and reliability.

We do not intentionally collect sensitive personal data, and we ask you not to put it in briefs or uploads.

• To provide the product: running research, generating interpretations and reports, and keeping your work available to your team.
• To secure the service: authentication, rate limiting, abuse prevention and investigating problems.
• To understand how the core workflow is used so we can improve it. Analytics events avoid recording the content of your briefs.
• To reply to pilot requests and support questions.

Some features send workspace content — for example a brief and the research records stored for it — to a large language model provider to generate interpretations, strategies and assistant replies. We send only the content needed for the task you requested.

We do not use your workspace content to train our own models. Model providers process data under their own terms for API customers; we choose providers whose API terms do not permit training on submitted data by default, and we will name them in a subprocessor list before general availability.

We don’t sell personal information. We share data only with service providers that help us run CultureCrash, such as:

• Database, authentication and file storage hosting.
• Cultural data providers (currently Qloo), which receive research queries such as audience descriptors, markets and entity names — not your account details.
• Language model providers, as described above.
• Application hosting and error monitoring.

Reports are shared outside your workspace only when someone in your workspace creates a share link. Links can be revoked and can be set to expire. We may disclose information if required by law.

Workspace content is kept while your workspace is active. You can delete projects and their contents from within the product. Owners can set an automatic retention period for working data (raw provider responses, copilot conversations, activity history) and can delete an entire workspace from its settings; deletion from active systems is immediate, with backups expiring on their normal cycle.

Pilot requests are kept for up to 12 months unless you ask us to delete them sooner.

We use access controls at the application and database level so that one workspace — and one agency client — cannot see another’s data. Secrets are kept server-side, connections are encrypted in transit, and expensive operations are rate limited.

No system is perfectly secure. CultureCrash is in a pilot stage and has not completed an independent security audit or certification. Please avoid uploading highly confidential material during the pilot unless agreed in writing.

You can access and update your account details in settings, export reports, and delete your content. Depending on where you live, you may have further rights — such as to request a copy of your data, to correct or delete it, or to object to certain processing. Contact us through help & feedback and we will respond within a reasonable time.

We use cookies that are necessary to keep you signed in and to protect forms. We do not use advertising cookies. Your browser may store small preferences locally, such as interface settings.

We will update this policy as the product and our legal review progress, and change the date at the top when we do. Material changes will be communicated to workspace owners. For questions, use help & feedback. See also our terms of service.