Privacy Policy

Cultiv8Hub is operated by Cultiv8, an individual business registered in the Western Province of Sri Lanka under certificate number WP/COL/DP/2026/00112, owned by Arun Haridharshan, with its registered office at No. 28/1, Pereira Lane, Wellawatte, Colombo 06. In this policy, “we”, “us” and “our” mean Cultiv8. “You” means anyone who uses cultiv8hub.com or any product on it.

We are the data controller for the personal data described in this policy, except where section 7 says otherwise.

For anything about privacy or your data, write to connect@cultiv8hub.com. General support is connect@cultiv8hub.com.

This policy is written to comply with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka.

You should be able to understand this without a lawyer, so here is the whole policy in eight lines. The detail follows, and the detail is what governs.

Information you give us

Account information. Your name, email address, and authentication details. If you sign in with Google, we receive your name, email address and profile identifier from Google. We never receive or store your Google password.

One profile question. At signup we ask whether you are using Cultiv8Hub for personal or organizational purposes. This helps us understand who uses the platform. It does not change what you see or what you pay.

What you create in the products. Course progress and quiz results. Notes, reflections and checklist answers. Entries in your Leadership Journal. Practice logs. Your answers to assessments, evaluations and surveys. Messages you send to the AI Mentor.

Order information. If you place an organizational order: your organization’s name, your name, your email address, the number of users or the population being surveyed, and the quoted price.

Information about other people. If you nominate colleagues, a manager or direct reports for a 360 review, we collect the names and email addresses you give us for them, so we can invite them. See section 6.

Correspondence. If you email us, or apply for a hardship waiver, we keep what you send us.

Information we collect automatically

Technical information. Your IP address, browser type and device type, collected in ordinary server logs by our hosting provider. We use this for security, debugging and abuse prevention.

Usage counts. How many Cultiv8tor messages you have sent, so we can apply fair use limits.

We do not collect location beyond what an IP address implies, we do not build advertising profiles, and we do not track you across other websites.

What we deliberately do not collect

We do not ask for your national identity card number, your date of birth, your salary, your address, or your payment card details. Card details are handled entirely by our card/online payment processor and never reach our systems.

If we ever want to use your data for something not on this list, we will ask you first.

This deserves its own section because it is the part people most want to know about and the part most policies bury.

We use Anthropic’s Claude to generate your reports, plans and Mentor responses. When you ask for a diagnostic report, your answers are sent to Anthropic. When you use the Cultiv8tor, your messages are sent to Anthropic. When the L&D Engine reads a performance evaluation you uploaded, the content of that document is sent to Anthropic.

Anthropic’s servers are in the United States, so this involves a transfer of your data outside Sri Lanka. See section 11.

What we understand about how Anthropic handles it: they process the content to generate a response and do not use it to train their models by default under their commercial terms. We rely on their published policies for this.

What we do to limit exposure:

• A report is generated once and stored, so the same content is not sent repeatedly.
• We never send your name, email address, or account identifier to the AI provider alongside your answers. The content goes; who you are does not.
• For 360 reviews, the AI reads all the written comments together and returns only themes. It never returns anyone's individual words to you.

What AI does not decide. No AI on this platform makes a decision that has a legal or similarly significant effect on you. It generates guidance, suggestions and written analysis. Your employer does not receive AI output about you as an individual. Nothing here is a medical, psychological or clinical assessment, and it must not be used as one.

If you do not want your content sent to an AI provider, you can use the platform without generating reports or using the Mentor, though those parts will not work. Tell us and we will explain what remains available.

These promises are built into how the software works, not just written here.

Individual responses are never shown to anyone. Not to your employer, not to your manager, not to other respondents, and in the case of a 360 review, not to the person being reviewed either.

Results are only produced once enough people have answered. Every organizational survey has a minimum respondent threshold, set to five by default. Below that, no report is generated at all, because a report drawn from three people is not anonymous no matter what we promise.

360 reviews show one blended number. We deliberately do not break results down by rater group. Splitting them would make a single supervisor instantly identifiable and would push every direct report to answer safely. You see how you rated yourself, and one blended figure for how others rated you. The gap is the whole point.

Written comments are never shown to you word for word. The AI reads them all and reports only themes that at least two people raised independently. In a group of six, a turn of phrase identifies someone as surely as a name does.

If you nominate someone as a rater, we email them an invitation identifying you as the person who nominated them, with a link to respond. We use their email address for that survey and for reminders about it. We do not add them to any mailing list and we do not use their address for anything else. If they ask us to delete their details, we will.

If someone nominated you, you can decline by ignoring the invitation, and you can ask us to remove your details at connect@cultiv8hub.com.

This is a genuinely different situation and it needs saying clearly.

For learning access bought on your behalf. The person who bought your access can see that it was redeemed, and whether you have completed a product or a module. They cannot see your assessment scores, your 360 gap, your Cultiv8tor conversations, your journal, your notes, or any report about you. This is enforced in the software, not just promised here. Mentoring only works if it is honest, and it stops being honest the moment someone thinks their employer is reading it.

For organizational audits and surveys. Where your employer commissions a survey of its staff, your employer decides who is surveyed and why. In that situation your employer is the data controller and we act as their processor, handling the data on their instructions. Your employer should have told you about the survey and why they are running it. If you have questions about why your organization is surveying you, ask your organization. If you have questions about how we handle the data technically, ask us.

We require every organizational customer to confirm that they have the right to give us the personal data they give us, and that they have told their people what they are required to tell them.

Most of what we set is strictly necessary, and one thing is not, that one is your choice.

Until 1 September 2026 this page said there were no advertising cookies and no social-media tracking pixels here. That stopped being true on the day we started running Instagram ads, so the sentence is gone rather than quietly left standing. There is now one: the Meta Pixel, which exists so we can tell whether an ad we paid for actually reached anyone. It and Google Analytics are the two non-essential things we ask about, and both are genuinely optional: the site works exactly the same whether you accept them or not, and neither loads at all until you do. We also count how many people visit which pages using Vercel Web Analytics, which sets no cookie, stores nothing on your device, does not use your IP address to identify you, and never builds a profile of you or follows you to other sites, that one runs regardless, because there is nothing on your device to consent to or withdraw. Fonts are served from our own servers, so loading a page on cultiv8hub.com does not tell any third party that you did.

The cookie banner you see on your first visit reflects this directly: “Necessary only” keeps you signed in and nothing else; “Accept” additionally lets GA4 and the Meta Pixel run. One choice governs both, so there is no way to end up having accepted one without knowing it. You can change your mind at any time from Cookie Preferences in the footer of any page, which reopens the same choice. If we ever add anything else that is not strictly necessary, we will ask for real, specific consent before setting it, and update this section and that banner in the same change.

Browser storage. We also store some things in your browser’s local storage, which is not a cookie and is never sent to any third party:

• Your display preferences: theme, text size, language, read-aloud.
• Chart and print settings for your growth plan.
• If you take a free assessment before creating an account, we temporarily store your answers in your browser so that the result is not lost when you sign up. We store the answers rather than the score deliberately, so that a result cannot be faked. They are cleared once your account claims them.
• Your progress in a product, which is also saved to your account when you are signed in.

You can clear all of this at any time in your browser settings. Doing so will reset your preferences and lose any unclaimed free assessment result.

We do not sell your personal data. We do not share it for anyone else’s marketing.

We use the following service providers, each of which processes data on our instructions:

We may also disclose personal data where we are required to by law, by a court or by a competent authority, or where it is necessary to establish, exercise or defend a legal claim.

If our business is ever sold or merged, personal data may transfer to the buyer. We would tell you before that happened and you would keep every right in section 13.

Some of the data we hold is about people who never signed up: nominated 360 raters, and employees answering an employer’s survey.

We collect only their name and email address, and only to invite them. We use it for that survey and nothing else. We do not market to them. Where we hold this on behalf of an organization, that organization is responsible for having had the right to give it to us.

Anyone in this position can contact connect@cultiv8hub.com to ask what we hold and to have it deleted.

Some of our providers are outside Sri Lanka.

Where we transfer personal data outside Sri Lanka, we do so on the basis of your consent, given when you choose to use a feature that requires it (an AI report, the Mentor, or the L&D Engine reading an uploaded document), together with the contractual safeguards in our agreements with each provider. We choose providers with published security and privacy commitments and we contract with them on their standard data processing terms.

If you would rather your data not leave Sri Lanka, the practical consequence is that you cannot use the AI features. Tell us and we will explain what is still available to you.

When a retention period ends we delete the data or irreversibly anonymize it. Anonymized, aggregated statistics that cannot identify anyone may be kept indefinitely.

Under the Personal Data Protection Act you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong or incomplete.
• Delete your personal data, where we are not required to keep it.
• Stop or limit a particular use of your data.
• Withdraw consent you previously gave, at any time. Withdrawing consent does not undo processing that already happened lawfully.
• Object to direct marketing, at any time, with no reason needed.

To exercise any of these, email connect@cultiv8hub.com from the address on your account. We will respond within 21 days. If we need longer because your request is complex, we will tell you why within those 21 days.

We do not charge for this. If a request is clearly excessive or repetitive we may charge a reasonable fee or decline, and we will explain why if we do.

If you are not satisfied with how we have handled your request, you can complain to the Data Protection Authority of Sri Lanka.

• All traffic is encrypted in transit using HTTPS.
• Passwords and authentication are handled by Clerk. We never see or store your password.
• Card details are handled entirely by PayHere. They never touch our systems.
• Secrets and API keys are held server side only and are never exposed to your browser.
• Access to the production database is limited to Cultiv8's owner alone, and protected by Supabase's own account authentication.
• Individual survey responses are readable only by the scoring process, and reports are produced only once the minimum respondent threshold is met.

No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to affect your rights, we will notify you and the Data Protection Authority of Sri Lanka as the Act requires, without undue delay.

Cultiv8Hub is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18.

Where we work with a university or educational institution, students under 18 may only be given access through that institution, and only where the institution has obtained the consents required of it. If you believe someone under 18 has created an account directly, tell us at connect@cultiv8hub.com and we will delete it.

If we change anything material, we will update the date at the top, publish the new version here, and tell account holders by email or by a notice in the product before it takes effect. Small clarifications may be made without notice, but the “last updated” date always changes.

• Privacy and data requests: connect@cultiv8hub.com
• General support: connect@cultiv8hub.com
• Post: No. 28/1, Pereira Lane, Wellawatte, Colombo 06

If you are unhappy with our response, you may complain to the Data Protection Authority of Sri Lanka.