inyourroots® Safeguarding Policy

• Young people using inyourroots®
• Parents, carers and supporters
• Employers, mentors and anyone working with us
• Our team, freelancers and volunteers

Budi is the AI career companion inside inyourroots®. Budi is not a person and will not pretend to be one. Budi can help you explore what you are good at and what you might do next, but is not a counsellor, social worker, medical professional or crisis service.

If something you type suggests you may be at risk

A separate safety check runs independently of the conversational AI. When it identifies certain risk-related wording:

• Budi’s response includes information about real sources of help, including Samaritans, Shout, Childline and 999 where someone is in immediate danger.
• The conversation is marked in our records and placed in a longer retention category.

Nobody is currently alerted at the moment the message is sent. We do not monitor conversations as they happen, we do not currently operate a live human-review queue and we are not a 24-hour safeguarding service.

If you are worried about yourself or someone else, do not wait for us to notice. Use one of the services in section 11.

Budi is designed not to provide specialist advice about self-harm, suicide, eating disorders, drugs or other matters that require a qualified professional. When those topics arise, Budi should explain its limit and direct you to appropriate help.

What we keep

Ordinary conversations with Budi are kept in the active conversation store for 30 days and then removed by an automated process that runs nightly at 03:30. Conversations marked for safety reasons are currently kept for up to 12 months. The 12-month period is a provisional safeguarding and data-protection period that remains under professional review.

We have not used anyone’s conversations to train or fine-tune an AI model. We will not start during the pilot. Any future change would require a fresh assessment, clear notice and appropriate explicit opt-in.

These protections apply automatically:

• Nothing you create is intentionally shared with an employer automatically. Sharing must be a deliberate action using the controls available at the time.
• Recording is optional. You can receive strengths, industry and role suggestions without recording video.
• We do not use your strengths profile for targeted advertising or sell access to your private information.
• Approximate location, age, health, disability, accessibility and neurodivergence information are classified as blocked from career-match calculations.
• We do not describe employer access to recordings as age-restricted unless that restriction has been technically verified and enforced.

If something raises a safeguarding concern, we assess the circumstances rather than automatically contacting a parent or carer in every case. Depending on the level of risk, your wishes, your safety and our legal responsibilities, we may contact a parent, carer, safeguarding authority, emergency service, school, college or another person able to help. Where appropriate, we will tell you what we are doing unless that could increase the risk.

An optional part of the journey may ask about focus, sensory needs, communication and what helps you work at your best.

• You can skip it or stop partway without losing access to the rest of Budi.
• The answers are classified as blocked from career-match calculations.
• They are not intentionally included in information shown to an employer unless you separately and deliberately choose to share relevant information.
• We use the information to make the experience more supportive, not to diagnose or label you.

We have built a privacy gateway designed to return only permitted matching information, but it is not yet connected to every live matching route. We therefore describe this as our maintained classification and intended design control — not as a complete audited guarantee for every current result.

Everyone using interactive or community features must follow our code of conduct:

• No bullying, harassment, hate speech or intimidation
• No sexual content or sexual messaging
• No sharing personal contact details in public spaces
• Respect boundaries, privacy and consent

If someone breaks these rules, we may remove content, restrict features, suspend accounts or take other steps to keep people safe.

Reporting something

At present, the confirmed route for reporting a safeguarding concern is email. Contact Frankie Brookton, Designated Safeguarding Lead, at frankie@inyourroots.com. We aim to acknowledge safeguarding emails within one working day. We do not claim that an in-product reporting button is available unless it is shown in the version of Budi you are using.

If someone is in immediate danger, call 999.

If recording features are available:

• Recording is optional. Our policy is not to reduce a match score because someone chooses audio, does not show their face or does not record.
• The notice shown before recording should explain what is saved and for how long.
• We are verifying the live deletion behaviour for practice recordings, so we do not claim that every unused take is immediately deleted.
• A saved pitch is intended to remain private until you deliberately share it.
• You may withdraw a share, but withdrawal cannot make a recipient forget something already viewed. We do not promise that every recipient is technically incapable of copying or screen-recording shared media.

We aim to work only with employers and partners that share our values and follow our safety rules. Where appropriate, we may:

• Carry out identity and business verification
• Ask for safeguarding assurances and evidence of training
• Require background checks, including DBS checks, where the role or setting requires them

An employer should receive only the information you have deliberately shared using the controls available. Health, disability, accessibility and neurodivergence information is not intended to be included by default.

We set out employer conduct, confidentiality and onward-sharing requirements in the relevant employer or partner terms. Technical access controls are kept under review and are not a substitute for those obligations.

If we run events, workshops or mentoring:

• Each session will have ground rules and a named person to speak to.
• In a school, college, youth service or other host setting, that organisation’s safeguarding arrangements and designated lead apply, and we work under them.
• We take steps to keep one-to-one interactions safe, including using appropriate venues, involving a parent or carer where appropriate, or using secure online tools.
• We ask what participants need to feel comfortable, including accessibility adjustments.
• Before a session begins, inyourroots® and the host agree the DBS, safeguarding-training, supervision and reporting requirements for everyone involved. Anyone whose role requires evidence of a particular check or training must provide it before carrying out that role.

No concern is too small.

If you report something:

1. We listen and take you seriously.
2. We assess the risk, record what is necessary and decide what action is needed and how quickly.
3. We support you and keep you informed where we can.
4. Where someone may be at risk of harm, we refer to an appropriate service. This may be children’s social care, the police, emergency services, or the young person’s school or college.

We only share information when necessary to protect someone from harm or meet a legal responsibility. Where appropriate, we will explain what we shared and why unless doing so could increase the risk.

If your concern is about us

Inyourroots® currently has one named Designated Safeguarding Lead and no deputy. If a concern involves the Safeguarding Lead or anyone working with us, you do not have to report it to us first. You can contact the relevant local authority children’s services, the NSPCC or the police directly using section 11.

For a non-emergency police matter, call 101. If someone is in immediate danger, call 999.

If someone is in immediate danger, call 999.

Our safeguarding contact

Designated Safeguarding Lead: Frankie Brookton. Email frankie@inyourroots.com. We aim to acknowledge safeguarding emails within one working day. We are not a 24-hour service. If you need help now, use an appropriate service below.

UK support services

• Childline — call 0800 1111. Free support for children and young people under 19, 24 hours a day, 7 days a week. childline.org.uk
• Samaritans — call 116 123 free, any time, day or night. samaritans.org
• Papyrus HOPELINE247 — call 0300 102 2470 or text HOPE to 88247. Support is available 24 hours a day. papyrus-uk.org
• Shout — text SHOUT to 85258 for free, confidential, 24-hour UK text support. giveusashout.org
• The Mix — call 0808 808 4994 for support for people under 25, or check its website for current support options and opening times. themix.org.uk
• NSPCC — adults worried about a child can call 0808 800 5000, currently 10am–4pm Monday to Friday, or email help@nspcc.org.uk. nspcc.org.uk

Opening hours and contact routes can change. If a listed service is unavailable and the risk is urgent, contact the police or the relevant local authority children’s service.

Children’s services

• Essex: 0345 603 7627, Monday to Thursday 8:45am–5pm and Friday 8:45am–4:15pm. Out of hours and bank holidays: 0345 606 1212. Essex County Council
• Hertfordshire: 0300 123 4043, available 24 hours a day. Hertfordshire County Council
• Suffolk: 0808 800 4005, available 24 hours a day. Suffolk County Council

Inyourroots® is in an early stage and some features are being developed or tested.

Current limitations include:

• The automated typed-risk check and crisis signposting are live, but a real-time human notification and review queue are not.
• Safeguarding concerns are currently accepted by email; an in-product reporting button is not presented as available unless it appears in the version being used.
• Mentoring and community features may not yet be live.
• Practice-recording deletion, employer recording-download controls and any age-based restriction on employer access to recordings are still being technically verified.
• The matching privacy gateway is not yet connected to every live matching route.
• Some employer and partner checks may be manual during the pilot.

We will not present a planned control as live until it has been verified. If you are unsure whether a feature is available or how we protect it, ask us and we will explain the current position.

We review this policy at least once a year, and sooner if a feature, partnership, incident, legal requirement or safeguarding practice changes. We use feedback, evidence from incidents and near misses, and current professional guidance to improve it.

The 12-month retention period for safety-marked conversations and the referral approach will be reviewed with an appropriate data-protection or safeguarding professional.