Legal
Privacy Policy
Last updated: February 2026
Who We Are
The CultureHub Simulation Platform ("the Platform") is operated by Culture Hub Limited, a company registered in England and Wales with company number 16520584, whose registered office is at 29 Coppice Farm Road, Ripley, England, DE5 3NZ.
For the purposes of UK and EU data protection law, Culture Hub Limited is the Data Controller for personal data collected through this Platform.
If you have any questions about how we handle your data, please contact us at: mark.holson@culture-hub.com
What This Platform Does
The CultureHub Simulation Platform is a professional development tool that allows participants to practise real-world business conversations with AI voice agents, receive AI-generated performance feedback, and track their improvement over time.
To deliver this service, your voice conversation is processed by an AI agent, and a transcript of your responses is analysed by an AI scoring system. This Privacy Policy explains exactly how that works and what happens to your data.
What Data We Collect
Data you provide directly
- Your name and email address (provided by your organisation when you are enrolled)
- Your password (stored securely, never visible to us)
Data generated when you use the Platform
- Voice conversation data — your spoken responses during a simulation call, processed in real time by Retell AI
- Transcript data — a text transcript of your spoken responses, used solely to generate your performance scores
- Performance scores — numerical scores (0–100) across the competency dimensions relevant to your simulation, generated by AI analysis of your transcript
- Observations and recommendations — written feedback generated by AI based on your transcript
- Call metadata — the date, time, duration, and simulation type of each call you complete
- Attempt history — a record of how many times you have completed each simulation, enabling trend analysis over time
Data we do not collect
- We do not collect biometric data or voice prints
- We do not record or retain audio files of your calls beyond the duration of the live conversation
- We do not collect payment information (billing is handled at the organisational level)
How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Delivering the simulation experience | Performance of a contract |
| Generating AI performance scores and feedback | Performance of a contract |
| Showing you your own results and progress over time | Performance of a contract |
| Enabling your manager to view your performance (where applicable) | Legitimate interests |
| Enabling your organisation's administrators to view team performance | Legitimate interests |
| Improving the quality and accuracy of our scoring system | Legitimate interests |
| Complying with legal obligations | Legal obligation |
We will never use your data for advertising, sell it to third parties, or use it for any purpose unrelated to your professional development.
AI Processing — How It Works
This section explains exactly how your data is handled by AI systems, because we believe you deserve to understand it fully.
Voice conversation (Retell AI)
When you start a simulation call, your voice is processed in real time by Retell AI. Retell AI acts as a data processor on our behalf under a data processing agreement. Your voice data is used solely to power the live conversation. Retell AI automatically deletes call recordings and transcripts from their systems after each call ends — no audio or transcript data is retained by Retell AI beyond the duration of the call. You can read Retell AI's privacy policy at retellai.com/privacy-policy.
Transcript and scoring (Groq)
After your call ends, a transcript of your spoken responses (your words only, not the AI agent's) is sent to Groq for AI analysis. Groq uses the Llama large language model to score your performance across the relevant competency dimensions and generate written observations and recommendations. Groq acts as a data processor on our behalf. Your transcript is used solely for this scoring purpose and is permanently deleted from our systems immediately after scoring is complete — typically within 60 seconds of your call ending. Your scores, observations, and recommendations are retained as described below. You can read Groq's privacy policy at groq.com/privacy.
What is retained after scoring
Once your transcript is deleted, we retain only:
- Your numerical scores per dimension
- The written observations and recommendations
- The date, duration, and simulation type of the call
No transcript or voice recording is kept beyond the scoring process.
Data Retention
| Data Type | Retention Period |
|---|---|
| Voice conversation (Retell AI) | Automatically deleted by Retell AI after each call ends |
| Call transcript | Deleted immediately after scoring (typically within 60 seconds) |
| Performance scores, observations, recommendations | Duration of your organisation's contract with CultureHub, plus 12 months |
| Profile data (name, email, role) | Duration of your organisation's contract with CultureHub, plus 12 months |
| Audit logs | 7 years (legal requirement) |
When your organisation's contract with CultureHub ends, your personal data will be anonymised or deleted within 90 days, unless we are required to retain it for legal reasons.
Who Can See Your Data
Your own data
You can always see your own scores, feedback, and call history.
Your manager
If your organisation has assigned a manager to your account, they can view your performance scores and feedback. They cannot see your transcript (which is deleted) and cannot see raw scores below the threshold required for anonymity.
Your organisation's administrators
Client administrators can view aggregated team performance data and individual results for people within their organisation. They cannot access data belonging to other organisations.
Benchmark comparisons
Your scores may contribute to anonymised benchmark comparisons shown to participants and administrators. Individual identities are never revealed in benchmark data.
CultureHub staff
Our team can access performance data for support and quality assurance purposes. Access is logged and audited.
Third-party processors
We share data with the following processors, all of whom operate under data processing agreements and handle data only as instructed by us:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Ireland) |
| Retell AI | Voice AI conversation | USA (with EU adequacy safeguards) |
| Groq | AI scoring and feedback generation | USA (with EU adequacy safeguards) |
| Postmark | Transactional email delivery | USA (with EU adequacy safeguards) |
| Vercel | Application hosting | EU and USA |
We do not share your data with any other third parties.
Data Security
We take the security of your data seriously. Our security measures include:
- All data stored in Supabase (EU region, Ireland) with encryption at rest and in transit
- Row Level Security enforced at the database level — no user can access another organisation's data
- All API communications encrypted using TLS
- Access controls ensuring each user role can only see data they are authorised to view
- Immutable audit logs of all significant system actions
- Regular security reviews
Your Rights Under UK GDPR and EU GDPR
You have the following rights in relation to your personal data:
Right of access — You can request a copy of the personal data we hold about you.
Right to rectification — You can ask us to correct inaccurate personal data.
Right to erasure — You can ask us to delete your personal data. Where we can do so without affecting our legal obligations, we will action this within 30 days. Note that anonymised benchmark data (which cannot identify you) may be retained.
Right to restriction — You can ask us to restrict processing of your data in certain circumstances.
Right to data portability — You can request your performance data in a structured, machine-readable format.
Right to object — You can object to processing based on legitimate interests.
Rights related to automated decision-making — Your performance scores are generated by AI. You have the right to request human review of AI-generated scores that significantly affect you. To exercise this right, contact your organisation's administrator or email us directly.
To exercise any of these rights, please contact us at mark.holson@culture-hub.com. We will respond within 30 days.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Cookies
The Platform uses the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Authentication session | Keeps you logged in | Session / 7 days |
| Preference cookies | Remembers your settings | 30 days |
We do not use advertising cookies or third-party tracking cookies.
Event Mode (Large Group Sessions)
When the Platform is used in Event Mode (e.g. a training day or conference event), the following applies:
- Participants may register using a team name and table number rather than individual credentials
- No individual login or personal identification is required in Event Mode
- Performance data from Event Mode is associated with the team, not identifiable individuals
- Event facilitators and client administrators can view team scores and rankings
- Event Mode data is retained for the duration of the event and 12 months thereafter
Children
This Platform is intended for use by professionals in a workplace context. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has used this Platform, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify users via email and display a notice on the Platform. The date at the top of this page shows when it was last updated.
Contact Us
Ripley
England
DE5 3NZ
Email mark.holson@culture-hub.com
Website www.culture-hub.com
Company number: 16520584