inyourroots® Privacy Policy
What this policy covers: This policy explains what we know about you, why we use it and what you can ask us to do. We have tried to write it so you can actually read it.
Last updated: 9 October 2026
Version: 4
Next review: 10 September 2027
Quick summary
- You must be 16 or over to use Budi.
- Your work is private by default — nothing is intentionally shared with an employer unless you choose to share it.
- Ordinary conversations with Budi are removed from the active conversation store after 30 days by an automated daily process.
- We have never used anyone’s conversations to train or fine-tune an AI model, and will not during the pilot.
- We classify age, location, pronouns, health, disability and accessibility information as blocked from career-match calculations; coverage of the technical gateway intended to enforce and audit that separation across all live matching routes remains to be confirmed.
- Recording yourself is optional — you can receive strengths, industry and role suggestions without video.
- For questions or deletion requests, email support@inyourroots.com.
1) Who we are
We are Inyourroots Ltd, a company registered in England and Wales under company number 17285309.
Registered office: Suite A82, James Carter Road, Mildenhall, United Kingdom, IP28 7DE.
We are registered with the Information Commissioner’s Office under registration number ZC244626.
We trade as inyourroots®. Our product is Budi. We are the data controller for the information described in this policy.
Our Designated Safeguarding Lead is Frankie Brookton (until a dedicated person is appointed). Contact frankie@inyourroots.com.
For privacy matters, contact support@inyourroots.com.
You can complain to the Information Commissioner’s Office at ico.org.uk. You do not have to contact us before complaining to the ICO.
2) Who this policy covers
This policy covers:
- Young people aged 16–25 using Budi
- Parents, carers and supporters who contact us
- Employers and partner organisations
- People who attend our events, workshops or webinars
If a school, college or youth organisation gives you access to Budi, we will explain separately what information — if any — it can see before that information is shared. We do not intentionally share private reflections, conversations or recordings with a partner unless the arrangement and lawful basis have been clearly explained.
Budi is not intended for anyone under 16. If we learn that someone under 16 has created an account, we may restrict the account and delete the information unless there is a lawful safeguarding or record-keeping reason to retain something temporarily.
3) What we collect
What you give us
Depending on the part of the service you use, this may include:
- Your name, email address and date of birth or age range
- Your answers, choices, reflections and conversations with Budi
- Your strengths, interests, preferred environments, industries and availability
- Feedback cards, proof tiles, written work, voice notes, photographs, audio and video you choose to create or upload
- Optional information about neurodivergence, disability, accessibility or support needs
- Messages sent to support, safeguarding or other inyourroots® contacts
For employers and partners, we may collect business and contact details, verification evidence, opportunity information and activity within the employer service.
What we collect automatically
This may include:
- How you use Budi, including features opened and activities completed
- Device, browser and IP information
- Account, security and diagnostic logs
- Cookie and analytics information where permitted by your choices
Where you live
We may ask for an approximate location, such as a town, county or partial postcode, so we can show nearby information and opportunities. We do not need your full home address for career matching.
4) Video and audio
Recording is optional. You can receive strengths, industry and role suggestions without turning on a camera. Where audio and video choices are offered, our policy is not to lower a match score because someone chooses audio or does not show their face.
Retakes. Our intended design allows unlimited retakes without presenting the number of attempts as a score or failure count.
Practice recordings. We are verifying the live technical retention behaviour for practice recordings. Where this feature is available, the notice shown before recording should explain what is saved and for how long. Until deletion has been technically confirmed, we do not claim that every practice recording is removed immediately after feedback is generated.
Information derived from a recording. Where enabled, we may retain a feedback card, transcript and objective measurements such as speaking duration, pace, repeated words, whether the question was answered and whether a specific example was provided. We do not use appearance-based judgements as part of the match calculation.
A pitch you choose to save is intended to remain private until you deliberately share it.
You control sharing. Nothing is intentionally sent to an employer automatically.
Everyone receives three picks per day. When you choose an employer and give permission to share selected profile content, that employer can see your interest/profile card before accepting. You can choose audio, video or neither. When the employer selects “Yes, let’s talk”, communication opens inside Budi and you start the conversation. In-app communication flags concerns for safeguarding review. Either side can unmatch or withdraw. Recording deletion, employer recording-access/download controls and under-18 restrictions are still being tested; the exact effect of withdrawal on existing access and retained messages is being verified. You may withdraw a share, but withdrawal cannot make a recipient forget something already lawfully viewed. We do not promise that every recipient is technically incapable of copying or screen-recording shared media; employer terms and access controls are intended to prohibit unauthorised copying and onward sharing.
Deleting a pitch. Where account deletion controls are available, you can use them or email support@inyourroots.com. We aim to remove it from active systems promptly and within 30 days at the latest, subject to limited legal or safeguarding exceptions and the backup process explained in section 14.
5) If you are 16 or 17
The following protections apply automatically:
- Nothing private is intentionally sent to an employer automatically.
- We do not use your strengths profile for targeted advertising or sell access to your private information.
- You can receive strengths, industry and role suggestions without recording a video.
- We aim not to use countdowns, streaks or repeated prompts to pressure you into recording or sharing private information.
- Any age-based restriction on employer access to recordings must be explained and technically enforced before we describe it as a guarantee.
If something raises a safeguarding concern, we assess the circumstances rather than automatically contacting a parent or carer in every case. Depending on the level of risk, your wishes, your safety and our legal responsibilities, we may contact a parent, carer, safeguarding authority, emergency service or another person able to help. Where appropriate, we will tell you what we are doing unless that could increase the risk.
6) How your matches are worked out
Your strengths, industries and roles are calculated using deterministic arithmetic: fixed weights are added and sorted. No general-purpose AI model performs that calculation, and the calculation does not learn from other users.
Classified as blocked from matching: age, approximate location, pronouns, disability information, accessibility notes, support needs, work situation and previous experience categories.
Classified as permitted matching signals: information about how you like to work, including strengths, interests, preferred problems, technology appetite, subjects and industries you choose to explore.
We have built a database function designed to return only permitted information and write an audit record. Its coverage across all live matching routes remains to be confirmed, so we describe the separation above as our maintained classification and intended architecture — not as a complete audited guarantee for every current result.
Budi’s conversation is different. Budi may receive your name, age range and general area to make the conversation more relevant. If you have described something that makes a type of work difficult, Budi may take that into account when deciding what to discuss first. This does not change the deterministic score, automatically share the information with an employer or remove a role from your results.
Your matches are designed to help you explore options, not to decide whether an employer hires you. We are assessing whether automated ranking and employer-pick selection can have a legal or similarly significant effect on access to opportunities under the current UK GDPR automated-decision provisions (Articles 22A–22D). We do not present that assessment as complete or claim that being a core feature automatically establishes contract necessity.
Automated processing and reviewing your matches
Our calculation uses your responses, fixed scoring tables and weighted criteria. No machine learning model performs the matching calculation. The same inputs, underlying data and scoring version produce the same calculation result; this does not mean employer availability or daily picks can never change.
Permission to share your profile with an employer is separate from the lawful basis for calculating matches. Article 6 governs the lawful basis for processing; applicable automated-decision safeguards must also be met.
If you think a result does not reflect you, email support@inyourroots.com. You can explain your point of view, ask for human review and contest a result. Where the significant solely automated decision provisions apply, you are entitled to information about the decision, to make representations, obtain meaningful human intervention and contest it. We are documenting and testing the review procedure and will explain the applicable process and outcomes; an email address alone is not a completed safeguard.
See our Fairness, Inclusion & AI policy for more detail.
7) The optional neurodivergence discovery
An optional part of the journey may ask about focus, sensory needs, communication and what helps you work at your best.
- You can skip it or stop partway without losing access to the rest of Budi.
- Because the answers may reveal disability or health information, we treat them as special category data.
- Our intended lawful condition is your explicit consent under Article 9(2)(a) of the UK GDPR. We will request that consent separately before using this feature, rather than burying it in general terms.
- The answers are classified as blocked from career-match calculations.
- They are not automatically included in information shown to employers.
- Where consent applies, you can withdraw it by emailing support@inyourroots.com. We will stop using and delete the answers unless a limited legal reason requires us to retain evidence of the request.
We will review this processing and whether any additional policy document is required before the feature is launched to real users.
8) If something you say worries us
Budi is not an emergency service. Do not rely on Budi for urgent help.
What is currently live: if text suggests someone may be at risk, a separate safety check can show information about real support, including Samaritans, Shout, Childline and 999 where someone is in immediate danger. The conversation can also be marked in our records and retained longer than an ordinary conversation.
Human alerts and review: safety-flagged concerns notify our safeguarding lead in HQ and generate an additional Slack alert in the private safeguarding channel. Automated signposting is not a safeguarding decision. Our Safeguarding Policy commits to human review of every flagged interaction: the same working day for concerns suggesting immediate or serious risk, and within two working days for other flagged concerns. These are review commitments, not a promise of an immediate response or 24-hour monitoring. If someone is in immediate danger, call 999 rather than waiting for us.
If we reasonably believe you or someone else is at risk of serious harm, we may share relevant information with emergency services, safeguarding authorities, a parent or carer, or another person able to help. Where appropriate, we will tell you what we have done unless doing so could increase the risk.
See our Safeguarding Policy for more information.
9) How we use your information
We use personal information to:
- Run your account and provide the service
- Work out strengths and show career suggestions
- Produce Budi’s feedback and conversational support
- Save information and work you choose to keep
- Let you share selected items
- Support safety and safeguarding
- Keep the service secure and working
- Respond to support requests and communicate important service information
- Understand and improve the service
- Send optional marketing where you have agreed
- Meet legal, regulatory and record-keeping obligations
We do not sell personal data.
10) Our lawful bases
| What we do | Lawful basis |
|---|---|
| Create and run your account | Performance of our contract with you |
| Provide strengths activities and calculate career matches | Performance of our contract with you; legitimate interests may apply to limited service improvement and evaluation |
| Save a pitch or optional item you choose to keep | Consent and/or performance of our contract, depending on the feature |
| Share an item at your request | Consent and taking a step you request as part of the service |
| Process optional neurodivergence, disability or health answers | Consent under Article 6(1)(a), with separate explicit consent under Article 9(2)(a) for special category data; consent must be valid and withdrawable |
| Detect and respond to safeguarding concerns | Legitimate interests; vital interests where necessary to protect life; and legal obligations where they apply |
| Keep the service secure and investigate incidents | Legitimate interests and applicable legal obligations |
| Essential measurement needed to operate and improve the service | Legitimate interests, balanced against user rights and with additional care for users under 18 |
| Non-essential analytics and marketing | Consent |
| Keep statutory business and financial records | Legal obligation |
For special category information used in safeguarding, we must also identify an Article 9 condition. Article 9(2)(g) with DPA 2018 Schedule 1, Part 2, paragraph 18 may apply where its specific safeguarding requirements are met; it is not a blanket permission for all safety-related processing. Article 9(2)(c) applies only where necessary to protect vital interests and the person is physically or legally incapable of consenting. The applicable condition and retention justification are assessed separately from the Article 6 basis.
Where we rely on legitimate interests, we consider our purpose, whether the processing is necessary and how it affects your rights. We take additional care where the person is under 18. You can object to processing based on legitimate interests by contacting us.
11) AI
Budi’s conversations use Google Gemini 2.5 Flash through Google Cloud Vertex AI.
- Google’s safety filters are configured for harassment, hate speech, sexually explicit content and dangerous content.
- Budi uses inyourroots® data and tools when discussing stored strengths, roles and progress, but AI output may still be inaccurate.
- We have never used anyone’s conversations, recordings, reflections or uploads to train or fine-tune an AI model.
- We will not use identifiable user content for model training during the pilot. Any future change would require a new assessment, a clear notice and an appropriate explicit opt-in.
The system currently contains an unused admin-only export function and filtered conversation view created for possible future model training. No export has been run. We are reviewing whether to remove that unused capability.
We do not make a UK-only data-residency promise until the configured processing region and any fallback behaviour have been verified. International transfers are addressed in section 13.
12) Who we share information with
We share only what is necessary with organisations that help us provide, secure or protect the service.
| Organisation or recipient | What it helps us do |
|---|---|
| Supabase | Account data, databases, authentication and private file storage |
| Google Cloud / Vertex AI | Budi conversations, feedback and safety-related processing where enabled |
| Vercel | Hosting and delivering the web application |
| Resend | Verification, account, lifecycle and support-related email delivery |
| Slack | Restricted safeguarding alerts to authorised people in our private safeguarding channel |
| Google Analytics, where enabled | Understanding use of the website or service, subject to consent where required |
| Employers you choose | Only information you deliberately share through the available controls |
| Schools, colleges and youth partners | Only information explained for the relevant programme and supported by an appropriate lawful basis |
| Safeguarding authorities, emergency services, parents, carers or other appropriate organisations | Protecting someone from serious harm or meeting legal responsibilities |
| Professional advisers and regulators | Legal, compliance, insurance and regulatory purposes where necessary |
The live web application is hosted through Vercel. We require processors to protect personal information and use it only for agreed purposes.
13) International transfers of personal data
Some providers we use are based outside the United Kingdom or may process information on infrastructure outside the UK. Where a restricted transfer occurs, a lawful transfer mechanism under Chapter V of the UK GDPR is required. An applicable UK adequacy route or an appropriate safeguard, such as a UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, may be used, with the required transfer assessment where applicable.
Google Cloud / Vertex AI: Budi’s conversational AI uses Google Gemini through Google Cloud Vertex AI. Google is a US-based provider. We are confirming the precise processing region, fallback arrangements and the transfer provisions applicable to our accepted Cloud Data Processing Addendum. A UK Addendum to EU Standard Contractual Clauses is a potential safeguard to verify; we do not yet present our account’s acceptance or applicable transfer mechanism as confirmed.
Other providers: we are confirming data-residency settings and applicable transfer mechanisms for each provider. Being based outside the UK does not by itself establish where every processing operation occurs. We will update this section as the relevant arrangements are verified. Email support@inyourroots.com for the current provider information, confirmed locations and information about safeguards, including how to obtain a copy where applicable.
More information is available from the Information Commissioner’s Office. These outstanding checks are recorded in our DPIA; this wording does not certify a transfer whose safeguards have not been established.
14) How long we keep information
| Information | How long we keep it |
|---|---|
| Ordinary conversations with Budi | 30 days in the active conversation store, then removed automatically by a daily process |
| Conversations marked for safety reasons | Currently up to 12 months, subject to safeguarding and data-protection review |
| Account and ordinary profile data | While the account is open, then removed from active systems as soon as practicable and within 30 days, unless a legal exception applies |
| A pitch you save | Until you delete it, or within 30 days of closing the account, subject to limited exceptions |
| Feedback cards, transcripts and recording measurements | While the account is open, then within 30 days of account closure unless deleted sooner |
| Practice recordings | According to the notice shown before recording; the exact live deletion behaviour is still being technically verified |
| Optional neurodivergence, disability or health answers | Until consent is withdrawn or the account closes, then within 30 days, subject to limited legal exceptions |
| Security and diagnostic logs | Only for as long as reasonably necessary for security, incident investigation and legal obligations |
| Analytics information | According to the configured analytics retention period and consent choices, and no longer than necessary for the stated purpose |
| Safeguarding case-log records, separate from Budi conversations | The current Safeguarding Policy sets the longer of six years from recording the concern or, for a concern involving an under-18, until their 25th birthday. Longer retention may be necessary for a statutory referral. The period is reviewed at case closure and remains subject to documented necessity and proportionality review; it is not a universal statutory period. |
| Business and financial records | For the period required by applicable law |
Where this policy says “within 30 days”, that is the outside operational limit for deletion from active systems, not a reason to delay deletion.
Encrypted or access-restricted backups may retain information for the provider’s normal backup cycle. Deleted information is not restored to ordinary active use; if a backup must be restored for disaster recovery, deletion requests and retention rules must be reapplied. We are reviewing provider backup periods so future versions can state a more precise maximum.
Information that has been irreversibly anonymised so it can no longer identify anyone may be retained for research, reporting and service improvement.
15) Your rights
Depending on the circumstances, you can ask us to:
- Show you the personal information we hold
- Correct information that is wrong or incomplete
- Delete information
- Stop or limit certain processing
- Provide information in a portable form
- Object to processing based on legitimate interests
- Withdraw consent at any time
- Explain significant automated processing and involve a person where applicable
Email support@inyourroots.com. We may need to verify your identity. We will respond within one month. For a complex request, the law may allow up to two additional months; if so, we will explain why.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.
16) Keeping information safe
We use technical and organisational controls intended to protect personal information. These include access restrictions, private storage and database-level permissions where configured, along with security and diagnostic logging.
Specific controls — including storage-bucket privacy, row-level permissions, signed media-link lifetimes, server-side file validation and removal of hidden location metadata from uploaded photographs — are being verified across the production service. We do not present every intended control as active until that verification is complete.
No system is completely secure. If you believe someone has accessed your account or information without permission, email support@inyourroots.com immediately.
17) Cookies
We use cookies that are necessary for the service to work and stay secure. Where non-essential analytics cookies are used, including Google Analytics, we rely on your consent where required.
See our Cookie Policy for more information. You can change your cookie choices through the available cookie settings or your browser.
18) Changes to this policy
If we make a significant change to how we use your information, we will update this policy and provide an appropriate notice rather than changing the page silently. Where a change requires fresh consent, we will ask for it.
Version history
| Version | Date | Summary |
|---|---|---|
| 4 | 9 October 2026 | Added ICO registration and a standalone international-transfer section; clarified automated matching and review requests without adopting the former Article 22(2)(a) assertion; aligned alerts, targeted sharing, privacy-gateway wording and separate safeguarding case retention. Automated-decision applicability and transfer verification remain under review. |
19) Contact
Inyourroots Ltd
Suite A82, James Carter Road, Mildenhall, United Kingdom, IP28 7DE
General and privacy: support@inyourroots.com
Safeguarding: Frankie Brookton, frankie@inyourroots.com
Regulator: Information Commissioner’s Office
Questions or concerns?
If anything here feels unclear, tell us. We'll help.
Contact us about this policy →