Privacy Policy

Depending on the facts and applicable law, for personal information that Customers and their Users submit to the Service or direct us to receive from integrations ("Customer Data"), CultureNest generally acts as a service provider or processor on Customer's behalf, and Customer generally acts as the business or controller responsible for that information, including notices, lawful bases, and required consents. Questions about an organization's use of your information should go to that organization.

CultureNest may act independently as a business or controller for information it processes for its own operations, including website administration, account administration, security, fraud prevention, billing, support, legal compliance, and business contacts. A Signed Agreement and applicable law control the parties' roles in a particular context.

• Account and profile: name, work email address, password (stored by our authentication provider in hashed form), sign-in method (such as email/password or Google sign-in), and account timestamps.
• Organization membership: the practices and offices you belong to, your role (such as user, admin, or superadmin), and group memberships.
• Schedule and event content: calendar events, titles, times, locations, categories, on-call assignments, notes, and similar content entered, imported from CSV, ICS, or PDF files, or synced from calendar feed URLs a Customer provides.
• Communications: email templates, daily digests, urgent messages, test sends, recipient lists and groups (which may include email addresses of people without Pulse accounts), delivery status, sent history, and unsubscribe or suppression records.
• Integration data: where a Customer enables the BlueJay integration, a limited set of work-related employee fields: BlueJay identifiers, employee number, legal and preferred names, sort name, work email, job title, department, location, legal entity and manager identifiers, employment type and status, work mode, hire and termination dates, and record update and archive dates. Pulse does not request or store compensation, personal contact details, home address, emergency contacts, date of birth, or HR notes from BlueJay. We also keep sync and connection history for these integrations.
• Audit and log data: records of administrative actions, integration link changes, sync runs, digest sends, and server and error logs that may include IP address, browser type, and timestamps.
• Device and browser storage: information stored in your browser to keep you signed in and remember preferences, described in our Cookie Policy.
• Support communications: information you send when you contact us.

We do not currently use third-party advertising or analytics trackers in the Service.

We use information to provide, operate, maintain, secure, support, and troubleshoot the Service; authenticate users and enforce access permissions; import, display, and schedule events in each practice's time zone; assemble and send digests and messages as configured by Customer; run integrations Customer enables; prevent fraud, abuse, and security incidents; comply with law; and enforce our agreements. Product analytics or improvement beyond those purposes uses aggregate or de-identified information unless Customer expressly authorizes broader use.

Automated processing: when a user imports a PDF, its text or page images are sent to a third-party AI model provider to extract event information, which is shown to the user for review before saving. We do not use the Service to make decisions producing legal or similarly significant effects on individuals.

CultureNest makes no representation that Pulse complies with HIPAA or that CultureNest is or is not a business associate. Contract language alone does not determine business-associate status under applicable law. Customer must determine whether its intended use involves protected health information (PHI), whether a business associate agreement (BAA) is required, and whether Pulse and Customer's safeguards are appropriate for that use. Unless a required BAA is in effect, Customer must not submit PHI to Pulse.

Customer administrators can see and manage information within their practice, including users and roles, events, groups and recipients, templates, digests, sent history, and integration status and imported employee records. CultureNest superadmins can access information across practices to operate and support the Service.

• Service providers and subprocessors that host, store, secure, support, or transmit data for us, including cloud hosting and database providers, authentication providers, email delivery providers, and AI model providers used for document import. Our agreements and applicable law restrict their processing to providing contracted services and related lawful purposes.
• Integrations and customer-directed disclosures: we exchange data with third-party services that Customer enables or directs, such as BlueJay, Google sign-in, or calendar feed sources. Those third parties may process information under their own terms and privacy policies when the User or Customer directs the interaction.
• Within the Customer organization: information is visible to authorized users of the practice according to their roles, and digests and messages are sent to recipients the Customer selects.
• Legal and safety: when we believe disclosure is required by law, subpoena, or legal process, or necessary to protect the rights, property, or safety of CultureNest, our customers, users, or others, or to investigate security incidents or misuse.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to customary confidentiality protections.
• With consent or at your direction.

We do not sell personal information and do not share it for cross-context behavioral (targeted) advertising.

We retain Customer Data for as long as the Customer's account is active, as needed to provide the Service, or as the Customer directs, and afterward as needed to comply with legal obligations, resolve disputes, maintain security and audit records, and enforce agreements. Some history is intentionally preserved; for example, disconnecting an integration marks it disconnected rather than deleting its sync and audit history. Backups and logs may persist for a period after deletion. Retention and deletion terms in a Signed Agreement control.

We use administrative, technical, and organizational measures designed to protect information, described on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Email recipients can unsubscribe from digest emails using the link in each message; your organization may still send required workplace communications through other means.

Depending on where you live, including under U.S. state privacy laws, you may have rights to request access to, correction of, deletion of, or a copy of your personal information, to opt out of certain processing, and to not be discriminated against for exercising rights. Where we process your information on behalf of a Customer, please direct your request to that organization; we will assist the Customer as required by our agreement and law, and may forward requests we receive to the relevant Customer.

For information we control, email hello@culturenest.io. We will verify your request as required by law and respond within applicable timeframes. You may use an authorized agent where the law allows, and you may appeal a decision by replying to our response.

Pulse is a business-to-business workforce service, not a consumer service directed to children. A Customer that authorizes a minor worker to use Pulse or includes a minor worker's information is responsible for determining that the use is lawful and for providing notices, obtaining consents, and applying safeguards required by applicable law. Contact hello@culturenest.io with concerns about a minor's information.

CultureNest is based in the United States, and our service providers may process information in the United States and other countries. Those countries may have data protection laws different from yours. Where required, we rely on appropriate safeguards provided by our agreements.

We may update this Policy. The effective date shows when it last changed. For material changes, we will provide notice through the Service or by email and may ask you to acknowledge the updated Policy.

Questions: CultureNest LLC, Arizona, USA — hello@culturenest.io.