Is Culture Amp safe with your data?
Culture Amp
Culture Amp Pty Ltd
Partial disclosure · high confidence
Culture Amp earns a C (50/100) because it discloses its data practices only in part.
#82
of 216 apps ranked
50
score · HR & recruiting avg 48
+2
vs category average
Culture Amp publishes a detailed privacy policy with an AI section, enumerated data categories and an ISO27001 claim, but it says nothing about whether customer inputs train models, names no retention period, and leaves several commitments conditional on contacting a person or on living in the EU.
What Culture Amp's privacy policy and terms of service say about your data
Training data
The policy describes integrating Anthropic and Google models through AWS and GCP, but never states whether customer inputs or survey responses are used to train or improve those models, and offers no opt-out.
Retention
Personal information is kept "for as long as we provide our Services" with no named period; the only concrete number is a 90-day limit on encrypted archived backups.
Rights routing
Employees and survey respondents are told they must contact their employer for access, correction, transfer or deletion, because the employer is the controller and Culture Amp only forwards the request.
Safeguards gated by region
The named transfer safeguard, the EU Standard Contractual Clauses, and the mapping of purposes to legal bases both appear only in sections addressed to European Union users, and the data processing addendum is available on request rather than published.
What the policy is silent or vague on
- Not stated: keeping user inputs out of model training
- Not stated: a way to opt out of training
- Not stated: whether training use differs by plan
- Not stated: shorter retention for AI conversation logs
Culture Amp privacy rating
Details
- Category
- HR & recruiting
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2025-07-02
- Region scored
- Global / US-default
- Last assessed
- 2026-10-13
Documents examined
Other hr & recruiting apps
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.