Trust Center

Our Commitment

Cultivation is committed to transparency about how we handle your data, your rights as a user, and our obligations under applicable privacy law. This page summarizes our key data practices.

GDPR Compliance

Cultivation fully supports the EU General Data Protection Regulation. We process personal data lawfully, fairly, and transparently.

• Lawful basis for processing: contract performance and legitimate interest
• Data minimization — we only collect what is necessary for the service
• Purpose limitation — data is used solely for organizational diagnostics
• Right to access, rectification, erasure, and data portability fully supported
• Data Processing Agreement (DPA) available for all customers
• Subprocessors: Supabase (database), Vercel (hosting), Stripe (payments), Anthropic/OpenAI (AI analysis)

CCPA Compliance

California residents have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. Cultivation does not sell personal data.

Data Residency

• Primary database: AWS us-east-1 (N. Virginia) via Supabase
• Edge network: Vercel global CDN (static assets only — no PII at edge)
• AI processing: Anthropic (US) and OpenAI (US) — organizational data sent for analysis is not used for model training
• Enterprise: Custom data residency options available on request

Data Retention

• Active accounts: Data retained for the duration of the subscription
• Cancelled accounts: Data retained for 90 days, then permanently deleted
• AI analysis results: Cached for performance; purged when the underlying data changes or the account is deleted
• Audit logs: Retained for 1 year for compliance purposes
• Backups: Daily backups retained for 30 days

Your Rights

You have the following rights with respect to your personal data:

• Right to access: Request a copy of all personal data we hold about you.
• Right to rectification: Correct any inaccurate personal data via your account settings.
• Right to erasure: Request complete deletion of your account and all associated data.
• Right to data portability: Export your data in machine-readable JSON format from your dashboard.

To exercise any of these rights, email info@heycultivation.com. We respond within 30 days.

Legal Documents

• Privacy Policy — How we collect and use data
• Terms of Service — Platform usage terms
• Data Processing Agreement — For enterprise customers