Privacy and trust
Culturevating OS privacy notice
Version 1.4 · Effective 7 November 2026
The short version
- Bridgit is an AI. It’s a conversational guide, not a person, and it can get things wrong. You can always correct it.
- Your conversations are yours. Your organisation sees patterns across people, never what you personally said.
- It’s not a performance tool. Your organisation has agreed not to use anything from Culturevating to make decisions about your job, pay, promotion or performance.
- Taking part is your choice. You can stop at any time, and there’s no consequence at work for saying no.
- We don’t train AI on your words. Not us, and not Microsoft.
- We delete it. Your conversations are deleted 90 days after your organisation’s pilot ends, or sooner if you ask.
Who we are
Culturevating OS and Bridgit are run by Not Usual Ltd, company number 11182055, registered office 167 to 169 Great Portland Street, London W1W 5PF. We’re registered with the Information Commissioner’s Office. You can reach us about privacy at privacy@notusual.co.
Who’s responsible depends on how you came to us:
- If your organisation invited you to Culturevating, your organisation decides how it’s used and is responsible for your data. We look after it on their behalf. Your organisation should also tell you why it’s offering Culturevating.
- If you visit our website, contact us, take a free Garden Walk, buy from us, or we get in touch with you about Culturevating, Not Usual is responsible.
If you talk to Bridgit at work
What we collect
| What | Examples | Why |
|---|---|---|
| Your account | Name, work email, role, team and job title, from your organisation’s Microsoft account; the name you’d like Bridgit to use, and your country if you choose to give it | So you can sign in and Bridgit knows your context |
| What you share | Your goals, Garden Walk answers, reflections and ideas | To build your Growing Bed and reflect your growth back to you |
| What Bridgit makes of it | Summaries, themes and possible interpretations | To help you see patterns. You can correct or reject any of them |
| Your feedback, if you choose to give it | How a Garden Walk felt, and whether your Growing Bed captures what you want to grow | To make Bridgit better. It never includes what you said in your conversations |
| Technical records | Sign in times, IP address and browser | To keep the service secure |
If you sign in with Google or an emailed code. As well as Microsoft, we’re adding two more ways to sign in. If you sign in with Google, we receive your name, email address and a Google account ID, plus your organisation’s domain if you have one. If you sign in with a one-off code we email to you, we keep only a scrambled copy of the code until it is used or expires after 10 minutes. Either way, we don’t receive your password, and signing in doesn’t give us access to your email, files or calendar.
How the AI works. Bridgit uses a language model from Microsoft (Azure OpenAI) to understand what you say and respond. Bridgit keeps three things separate: what you’ve told it, what you’ve agreed it has understood, and what it is only suggesting. Its suggestions are never treated as fact about you.
Who sees what
- You see your own conversations and Growing Bed.
- Your organisation sees patterns across groups of at least 5 people, never your individual conversations. These can include the themes people are growing, how they line up with your organisation’s direction, and where similar ideas cluster. They never name you.
- Not Usual doesn’t read your conversations, except to fix a problem you or your organisation ask us to look at, or where the law requires it. If you choose to share your Growing Bed with a growing consultant, they read your Bed (not your conversations), as explained below.
What it is not used for. We don’t score, rank or assess you. Your organisation has agreed not to use Culturevating for decisions about recruitment, pay, promotion, performance or discipline. We don’t use your conversations to train AI. We only improve Bridgit from feedback you choose to give. We never sell your data.
Sensitive things. Bridgit won’t ask about your health, beliefs or other sensitive matters, and you don’t need to share them. Some details, such as a medical diagnosis, are stopped before they reach Bridgit and aren’t saved. If you mention anything else sensitive, it isn’t put in your Growing Bed or used to draw conclusions about you. It stays only in your private conversation record and is deleted with it.
If things feel hard. Bridgit isn’t a counsellor. If you’re struggling, Bridgit will point you to support such as Samaritans (116 123) or NHS 111.
Legal basis. Your organisation decides the legal basis for offering Culturevating, usually its legitimate interest in supporting staff development. Where you choose to share your Growing Bed with a growing consultant, we rely on your consent, which you can withdraw at any time.
Sharing your Growing Bed with a person
We do our best to make sure there’s always a human you can talk to. We’re adding a way, after a Garden Walk, to:
- Share your Growing Bed with a Not Usual growing consultant. They read it so they can get in touch and help you grow, and they may tell you about our founding pilot. Growing consultants are Not Usual staff and people who work with us under a written agreement that includes confidentiality. This includes our founder. They use your Bed only for this.
It’s optional and starts unticked. Everything works the same if you say no, and you can stop sharing at any time.
If you visit our website, contact us or buy from us
| What | Why | Legal basis |
|---|---|---|
| Your name, email, organisation and message when you contact us | To reply to you | Our legitimate interests |
| Your conversation in a free Garden Walk | To give you the walk you asked for | Contract |
| Billing contact and payment references | To manage payments and accounts. Card details are handled by Stripe, never by us | Contract and legal obligations |
| Marketing emails, if you sign up | To tell you about Culturevating. You can unsubscribe at any time | Consent, or our legitimate interests for existing customers |
| Messages we send to people at organisations about Culturevating | To invite you to a free Garden Walk | Our legitimate interests |
| Website visit statistics | To understand how the site is used and improve it. Only if you accept analytics | Consent |
| Your cookie choices | To remember what you chose | Strictly necessary |
Our cookie information explains cookies and similar technology in more detail.
If we get in touch with you about Culturevating
We sometimes contact people at organisations we think Culturevating could help.
What we hold. Your name, job title, organisation and work contact details, why we got in touch (for example a news story about your organisation), and notes of any conversations we have.
Where it comes from. Public sources such as company websites, news and Companies House, LinkedIn if we’re connected, emails we’ve exchanged before, events, or someone who introduced us.
Why. To tell you about Culturevating and invite you to a free Garden Walk. Our legal basis is our legitimate interest in finding organisations to work with, and we only contact people about things relevant to their work.
Sole traders and partnerships. We don’t email sole traders or partnerships about Culturevating unless they’ve agreed. We may get in touch by LinkedIn, phone or post instead.
If you take a free Garden Walk. If you take a Walk after we’ve been in touch, we note that you took one and when. We never note what you said, and nothing from your Walk or your Growing Bed goes into our sales records.
Saying no. Tell us to stop at any time and we will. Reply to us or email privacy@notusual.co. We keep a short note of your name so we don’t contact you again.
How long. If we haven’t heard from you within 12 months, we delete your details.
Who we share it with and where it’s stored
We use a small number of trusted suppliers, each under a contract that protects your data. We never sell it.
| Supplier | What they do | Where |
|---|---|---|
| Microsoft | Stores your data (Dataverse), sign in (Entra ID), runs Bridgit’s AI (Azure OpenAI) and delivers contact messages | Data stored in the UK. AI processing in the EU |
| Microsoft Azure Communication Services | If you sign in with an emailed code, sends the code to your email address on our behalf. If an email to you bounces, Microsoft keeps your address on a block list for between 24 hours and 14 days so it isn’t retried | Data location set to the United Kingdom, but emails may pass through or be processed in other countries on the way to your inbox |
| If you sign in with Google, confirms who you are. We use Google only for this, and don’t give Google access to your Garden Walks, Growing Beds, conversations or anything else in Culturevating | Under Google’s own privacy terms | |
| Vercel | Hosts the website and app, and counts website visits if you accept analytics | The app runs in London. Website pages are delivered from Vercel’s global network |
| Stripe | Takes payments | As set out in Stripe’s privacy policy |
| Cloudflare | Protects our contact form from bots | As set out in Cloudflare’s privacy policy |
| Anthropic | Provides the AI we use to research and draft messages to people at organisations | Data stored in the United States |
Bridgit’s AI runs in Microsoft’s EU Data Zone, within EU member states. The UK recognises the EU as giving equivalent protection, so no extra safeguards are needed for the AI processing there. We’d only share your data with anyone else if the law required it.
How long we keep it
| Data | How long |
|---|---|
| Conversations and Growing Beds from a work pilot | Until 90 days after the pilot ends, then deleted. Backups clear within a further 7 days |
| Free Garden Walk conversations | 90 days after your last visit, then deleted |
| Your feedback on Garden Walks | Deleted with your conversations |
| Contact form messages and emails to us | 2 years from our last exchange, unless you become a customer |
| Details of people we’ve contacted about Culturevating | 12 months after our last contact, unless you become a customer |
| Billing and accounting records | 6 years, as UK tax law requires |
| Security and audit records (no conversation content) | 12 months |
You can ask us to delete your data sooner. If you’re part of a work pilot, we’ll do this with your organisation.
Your rights and how to complain
You have the right to:
- see the data we hold about you, and get a copy;
- correct anything that’s wrong, including anything Bridgit has suggested about you;
- ask us to delete your data;
- ask us to limit how we use it, or object to how we use it;
- object to direct marketing at any time. We’ll always stop;
- take your data elsewhere; and
- withdraw consent, where we rely on it, at any time.
Email privacy@notusual.co. We’ll reply within one month. If you’re part of a work pilot, you can also ask your organisation.
Complaints. If you’re unhappy with how we’ve handled your data, tell us first at the same address. We’ll acknowledge your complaint within 30 days, look into it properly and let you know the outcome. You can also complain to the Information Commissioner’s Office at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We’ll update this notice when how we use data changes, for example before Bridgit tracks how people demonstrate competencies. We’ll tell you about any important change before it takes effect.