Culture Amp

The Privacy Policy describes AI use but lacks explicit clarity on whether user data trains models. Section 8(c) states Culture Amp integrates LLMs like Claude and Gemini through AWS/GCP, but does not explicitly state whether customer data is used for training. Section 5.4 of ToS permits de-identified data for 'Service Improvement' including 'algorithm improvements,' which suggests potential training use, but this is vague and applies only to de-identified data.

“[ToS 5.4] 'You grant Culture Amp a worldwide, royalty free licence to use, reproduce, distribute, modify, adapt, create derivative works, archive, or otherwise use de-identified Customer Data for (i) creating de-identified aggregated data ("Data Sets"); and (ii) the purposes of Service Improvement.'”

The ToS explicitly limits the license granted to Culture Amp. Section 5.2 states the company retains all IP rights to Customer Data, and Culture Amp claims no ownership. Section 5.3 grants Culture Amp only a license 'for the sole purpose of providing the Services.' Section 5.4 limits de-identified data use to Service Improvement. The license is clearly bounded and does not permit sublicensing for other purposes.

“[ToS 5.2] 'You retain all ownership and Intellectual Property Rights to Customer Data. Culture Amp does not claim ownership over any Customer Data. This Agreement does not grant us any licences or rights to Customer Data except for the licences granted in clauses 5.3 and 5.4 below.'”

The ToS and Privacy Policy permit sharing with service providers and sub-processors under confidentiality obligations, but the scope is somewhat vague. Section 5.9 of ToS states sub-processors have access 'as reasonably necessary' and must comply with confidentiality standards 'substantially consistent' with the agreement. Privacy Policy Section 7(a) mentions sharing with 'service providers' for various purposes but does not provide a published sub-processor list. No explicit prohibition on advertising or analytics sharing of user content is stated.

“[ToS 5.9] 'Any sub-processors utilized by Culture Amp will only be given access to your account and Customer Data as is reasonably necessary to provide the Services and will be subject to: (i) confidentiality obligations which are substantially consistent with the standards described in this Agreement.'”

The ToS and Privacy Policy provide some retention guidance but with gaps. Section 3.3 of ToS states backup copies are retained 'for a period of up to 90 days from the time that each backup copy is generated.' Privacy Policy Section 10(a) states data is retained 'for as long as we provide our Services to the Customer and until the Customer requests us to delete' but does not specify a hard deletion timeline. The 90-day backup retention is clear, but overall retention periods for production data are vague.

“[ToS 3.3] 'Culture Amp will retain these backups for a period of up to 90 days from the time that each backup copy is generated. Thereafter, Customer agrees and acknowledges that Customer Data will be irretrievably deleted from backups.'”

The ToS explicitly confirms that the customer retains all IP ownership of outputs. Section 5.2 states 'You retain all ownership and Intellectual Property Rights to Customer Data. Culture Amp does not claim ownership over any Customer Data.' Section 5.3 grants Culture Amp only a limited license to use data 'for the sole purpose of providing the Services.' Reports generated are licensed back to the customer for internal use only (Section 5.3(b)).

“[ToS 5.2] 'You retain all ownership and Intellectual Property Rights to Customer Data. Culture Amp does not claim ownership over any Customer Data.'”

The Privacy Policy explicitly states Culture Amp is ISO 27001 certified (Section 5(a)). The ToS references GDPR compliance and Standard Contractual Clauses (Section 3.1). The Privacy Policy also mentions SOC 2 compliance implicitly through security standards language and references to EU data protection compliance. These certifications meet enterprise security standards.

“[Privacy Policy 5(a)] 'Culture Amp is ISO27001 certified.' [ToS 3.1] 'If requested, we will execute the European Union Standard Contractual Clauses to facilitate the transfer of personal information to countries outside the European Union in accordance with GDPR.'”