inyourroots® Data Protection Impact Assessment Summary
What this policy covers: A plain-language summary of our internal Data Protection Impact Assessment: the information involved, how Budi and employer connections work, the main privacy risks and safeguards, retention, suppliers, outstanding work and your rights.
Last updated: 15 October 2026
Version: 1
Quick summary
- This is a plain-language summary of our internal DPIA — not a legal approval, a certification, or confirmation that every planned safeguard has passed testing.
- Budi serves people aged 16–25 (including 16–17s); your toolkit is private by default and nothing goes to an employer unless you deliberately share it.
- Sensitive attributes are classified as blocked from career-match calculations; the technical filter’s coverage across every route is still being verified.
- The DPIA remains under review — residual-risk approval is not yet recorded, and several controls (recording/access/deletion, supplier transfers) still need verification.
- If someone is in immediate danger, call 999 — do not wait for a Budi alert or email. For questions or rights, contact support@inyourroots.com or the ICO.
1) Why we carried out this assessment
inyourroots® / Budi helps people aged 16–25 explore their strengths, discover careers and choose whether to connect with employers. Because this involves young people, including children aged 16–17, AI conversation, career suggestions and potentially sensitive information, we are assessing the privacy risks and the safeguards needed.
This is a plain-language summary of our internal Data Protection Impact Assessment (DPIA), not a replacement for the full assessment or our Privacy Policy. It is not a legal approval, a certification, or confirmation that every planned safeguard has passed testing.
2) Who is responsible
Inyourroots Ltd is responsible for the Budi service processing described here. Frankie Brookton is the assessment owner and current safeguarding lead. Privacy questions and requests can be sent to support@inyourroots.com. Safeguarding concerns can be sent to frankie@inyourroots.com.
Schools, colleges and employers do not automatically receive access to private Budi information because they introduce someone to, or pay for, the service. Any separate programme data-sharing or processing arrangement must define the parties’ responsibilities and permitted access before it is used.
3) What information is involved
Depending on the features used, this includes account details, age information, approximate location, discovery activities, reflections and messages, progress and strengths signals, career suggestions, selected profile items, optional audio/video, employer messages, and necessary security and safeguarding records.
Some optional answers or conversations may reveal health, disability or other sensitive information. A CV or recording is not required for career discovery. Budi is not intended for children under 16.
4) How Budi and employer connections work
Budi uses AI to support conversation and generated feedback. Career-match calculations are separate weighted calculations. AI can make mistakes; Budi is not a counsellor, crisis service or substitute for professional advice.
Your toolkit is private by default. Users choose which items to include in their profile. In the documented employer flow, the young person receives three employer picks per day, chooses an employer and permits selected profile information to be shared. That employer can see the shared interest/profile card before deciding whether to accept. If communication is opened, the young person starts the conversation inside Budi. Audio, video or neither can be chosen. Either party can unmatch or withdraw.
We are still verifying what withdrawal does to existing messages and media access. Withdrawing a share cannot make someone forget information they have already seen or remove a copy they have made.
5) Main privacy risks and our approach
| Risk we are assessing | Safeguard or action |
|---|---|
| Private information reaching an unintended recipient | Private defaults, deliberate user sharing, limited access and testing of employer-visible fields and recording controls |
| Sensitive information affecting career suggestions | A policy excluding sensitive attributes from career-match calculations; checking that the technical filter covers every relevant route |
| Suggestions unfairly limiting opportunities | Assessment of matching logic, fairness, meaningful user alternatives and applicable automated-decision rights |
| A safeguarding concern being missed or acted on too late | Automated signposting and alerts to the safeguarding lead, direct reporting routes, and work to confirm effective review and absence cover |
| Information being kept longer than necessary | Category-specific retention, deletion testing and review of safeguarding and backup periods |
| Supplier or international-transfer risks | Verification of supplier contracts, locations, access, data-use terms and applicable transfer safeguards |
| Young people feeling pressured to disclose, record or share | Optional recording and sensitive answers, age-appropriate information and review of engagement features against children’s best interests |
6) Safeguarding and confidentiality
Safety checks flag specified signals and send notifications to Frankie through HQ and a private safeguarding channel. Alerts do not guarantee an immediate response or continuous monitoring, and automated checks may miss concerns. Direct reporting remains important.
Information may need to be shared with appropriate services to protect someone from harm. We aim to explain this where safe and appropriate. Having a safeguarding purpose does not itself give permission to use or retain any information indefinitely.
If someone is in immediate danger, call 999. Do not wait for a Budi alert or an email reply.
7) Retention
The documented ordinary Budi conversation period is 30 days in the active store. Safety-flagged conversations may be kept for up to 12 months where necessary; this period remains provisional and subject to review. Separate safeguarding case records may need a different, justified period. The internal case-record schedule is still under review and is not a universal legal requirement.
The inyourroots® Privacy Policy explains the wider account and content retention position. Exact periods and deletion behaviour for practice recordings, employer messages, withdrawn connections and backups still require verification. We will not describe those controls as verified until there is supporting evidence.
8) Suppliers and international processing
The internal assessment identifies Supabase for runtime data, authentication and storage; Google Cloud / Vertex AI for AI processing; Vercel for hosting; Resend for email; Notion for content and governance; and Slack for restricted safeguarding alerts. Their actual data flows, contractual terms, locations, retention and international-transfer arrangements must be checked. Listing a supplier here is not a claim of UK-only hosting, completed contractual review or unrestricted access to youth information.
9) Assessment outcome and outstanding work
The DPIA remains under review. Approval and acceptance of residual risks are not yet recorded. Outstanding work includes safeguarding review and cover arrangements, supplier and transfer evidence, the Children’s Code assessment, matching and automated-decision analysis, sensitive-data handling, and recording/access/deletion testing.
This summary does not approve unrestricted launch to under-18s or under-18 media sharing. Any limited pilot needs its own recorded scope, effective safeguards and decision. If a high privacy risk remains that cannot be sufficiently reduced, the applicable ICO prior-consultation requirement must be followed before the affected processing begins.
10) Questions and rights
Contact support@inyourroots.com to ask about information use, request access or correction, discuss deletion or withdrawal, or raise a concern about a suggestion. Rights depend on the processing and applicable law. You can also raise a data-protection concern with the Information Commissioner’s Office at ico.org.uk.
We review the assessment when the service, risks or safeguards change, after significant incidents, and when further testing or professional advice is received. This summary must be kept aligned with the internal DPIA and approved public policies before release.
Inyourroots Ltd · Company number 17285309 · Suite A82, James Carter Road, Mildenhall, United Kingdom, IP28 7DE
Questions or concerns?
If anything here feels unclear, tell us. We'll help.
Contact us about this policy →