Privacy Policy

This notice describes information handled through the MyCulture.ai website and assessment platform. It covers people who visit the website, manage an organization account, contact us, or take an assessment.

If an employer, recruiter or another organization invites you, that organization chooses the assessment, its purpose and how it uses your results. Contact it about the opportunity, its assessment requirements and decisions affecting you. MyCulture provides the platform and handles service operation, account administration, support and related processing. The respective legal roles and instructions must be set out in the arrangements that apply to that service.

MyCulture.ai is operated by DHA Siamwalla Limited. For privacy questions, contact [email protected]. Our postal address is 202 Surawong Road, Bang Rak, Bangkok 10500, Thailand.

The information depends on the features used and may be supplied by you or the organization arranging the assessment.

• Account and contact information: name, email address, company, role, language, authentication/account details, and messages you send to us.
• Assessment information: invitations, selections, rankings, ratings, written answers, scenario responses, completion status and timing, task or AI conversations, calculated scores and generated reports. Supported features may also process files you provide, such as job descriptions or task material.
• Organization information: company values and definitions, role context, culture preferences, expected behavior ratings, assessment configuration, team membership and sharing settings.
• Technical and activity information: IP address, browser/device details, referring pages, page or session activity, errors and request logs. Assessment activity metrics can include active/inactive time, focus or visibility changes, and counts/timing of typing and paste events. Text you submit as an answer or message may itself include pasted text.
• Billing and support information: purchases, subscription/credit records, payment references, support correspondence and relevant delivery or security records.

We use information to provide account access; configure and deliver assessments; save progress; calculate and explain results; make reports available according to the relevant settings; send service communications; process payments; respond to support requests; and diagnose, secure and maintain the service. Website and product events are also used for usage analysis and advertising attribution where those integrations are enabled.

The organization arranging an assessment is responsible for explaining its own purpose and basis for using your information. Processing grounds for MyCulture’s separate account, operational, marketing and legal purposes depend on the activity and applicable law. Accepting the platform terms does not constitute consent to every processing purpose.

The platform automatically processes responses to produce scores, comparisons, profiles and explanations. Some features use AI to match company values to assessment cards, generate scenarios, conduct task conversations or draft analysis. Relevant context, responses and derived information can be sent to Google Gemini or OpenAI, depending on the feature and configured model. AI request logs can include account identifiers, technical metadata and limited prompt or output extracts.

Generated text and assessment signals can be incomplete or inaccurate. Results are intended to support interpretation and discussion. The organization arranging the assessment decides how it uses those signals in hiring or development; ask it about its review process and any additional automated decisions.

Provider processing and any use for model training depend on the provider, service configuration and applicable agreements. Contact us about the provider terms and settings relevant to a feature before supplying information subject to specific restrictions.

Assessment information is made available to the organization arranging the assessment and to account or team users with access through the platform’s ownership and sharing settings. Organizations can use report links and export features. If automatic result sharing is enabled, a result link is emailed to the address entered for that participant after completion.

A participant report can contain personal scores or profiles together with the organization’s benchmark values, culture comparisons and expected behavior ratings. It is not necessarily a report containing only personal information. A person receiving a link or export may share it further outside the platform’s controls; the organization should consider recipients and confidentiality before sharing.

Removing a report from a dashboard, closing an account, or disabling an email setting does not necessarily remove copies already delivered to other people. This privacy notice does not create a customer data-processing agreement or replace the organization’s own participant notice.

The services below support the relevant workflows. The providers and information involved depend on the feature, configuration and interaction; not every provider receives every category of information. The table distinguishes provider functions rather than describing all of them as having the same contractual role.

Information may also be disclosed when required by applicable law or to address legal claims, fraud or security incidents. Contractual processor terms, transfer documents and any additional customer restrictions need to be addressed separately from this notice.

The current core production assessment infrastructure is in the United States: the Firestore database uses the nam5 US multi-region, and Realtime Database, the primary upload bucket and the observed assessment-processing functions use us-central1. The identified production backup bucket is also in the United States. These are infrastructure settings checked on 28 October 2026, not a promise that every copy or processing step is restricted to one region.

Website delivery, AI, email, analytics and other providers may process information in additional countries. A regional AI endpoint or an edge-network location does not by itself change where the main assessment database is stored. Do not assume that data remains in your own country or that using this platform alone satisfies a localization requirement.

For the transfer arrangements and provider terms applicable to your use, contact [email protected] before providing information subject to specific location or contractual restrictions. A particular transfer safeguard or customer agreement should not be assumed from this notice alone.

Different records have different lifecycles. Account closure and assessment removal controls can mark records as deleted or remove them from view without erasing all associated information. Deleting an individual participant record also does not establish that every log, backup, export or provider-held copy has been removed.

Current AI operational logs are configured with a 90-day expiry and an active background expiry policy. The identified backup bucket has a rule to delete objects after 30 days; deleted backup and primary upload objects can remain recoverable for a further seven days under the storage soft-delete configuration. These settings do not establish a 30-day or 90-day retention period for assessment responses generally, and background deletion is not instantaneous.

There is no general automatic assessment-data expiry established by these settings. To request erasure or discuss a retention requirement, contact the inviting organization and [email protected]. Requests need to identify the relevant account or assessment and may require identity checks and coordination with the organization. Billing, support, security, backup and provider-held information need separate consideration; an account-closure action is not a guarantee of complete erasure.

Cookies and browser storage support sign-in, saved sessions, assessment progress and other service functions. Measurement integrations can also collect page, event, device and attribution information. These include Google Analytics/Tag Manager and Meta; optional product analytics and diagnostics depend on configuration.

You can restrict cookies or storage through your browser, although doing so can affect sign-in or progress recovery. You can contact us about measurement or marketing preferences. Turning off marketing does not necessarily stop service messages needed for an account or requested assessment.

Core database and storage services use Google Cloud infrastructure, and service connections use HTTPS. The platform has account access, monitoring and operational controls, but those measures do not make every transfer, report link or customer use risk-free. Detailed supplier terms, access controls and any customer-specific security requirements need separate review.

No website or storage system can be guaranteed completely secure. This notice is not a certification, audit report, service-level agreement or assurance of compliance with every privacy or employment law.

Depending on the law that applies, you may have rights to access, correct, erase or receive a copy of personal information; restrict or object to processing; withdraw consent where processing relies on consent; or complain to a relevant data-protection authority. The rights and any exceptions depend on the purpose and applicable law.

For an assessment arranged by an organization, contact that organization about its assessment records and decisions. You can also write to [email protected] with “Privacy request” in the subject and enough information to locate the account or assessment. Avoid sending unnecessary sensitive documents. We may need to verify the request and coordinate responsibilities. We handle requests subject to the applicable legal requirements and any relevant exceptions.

For privacy, provider, location or retention questions, email [email protected]. You can also write to DHA Siamwalla Limited, 202 Surawong Road, Bang Rak, Bangkok 10500, Thailand. This inbox is our current privacy-request contact.

This notice was updated on 28 October 2026. We will publish material changes on this page with an updated date. This notice does not amend the Terms and Conditions or their governing-law provisions.