1. Who we are

Custard is a UK-based company providing a software platform that helps organisations collect feedback and generate insights about team performance, culture and engagement.

Company name: Custard People Ltd
Registered office: First Floor Sterling House, Outrams Wharf, Little Eaton, Derby, DE21 5EL
Contact email: support@itscustard.com

In this policy, “Custard”, “we”, “us” or “our” means the company operating the Custard website and platform.

2. What this policy covers

This Privacy Policy covers personal data we collect when you:

• visit our website
• join the Custard waitlist
• download a lead magnet, resource or guide
• sign up for emails or marketing updates
• contact us through a form, email or social media
• book a call or request information
• create or manage a Custard account
• interact with our emails, website or platform

If you use Custard through your employer or organisation, your organisation is usually the Data Controller and Custard acts as the Data Processor. In that case, your organisation decides why and how your personal data is used, and Custard processes it on their behalf.

3. Personal data we may collect

Depending on how you interact with us, we may collect:

• name
• email address
• company name
• job title or role
• phone number, if provided
• organisation details
• billing or subscription information
• waitlist and lead magnet sign-up information
• marketing preferences
• messages, replies or enquiries you send to us
• webinar, event or community interest
• account login and usage data
• platform activity and interactions
• IP address and device/browser information
• cookie and analytics data
• team structure information, where you use the Custard platform
• feedback responses submitted through the platform, where applicable

We may also collect aggregated or anonymised data to understand trends, improve Custard, and develop new features. This data is not intended to identify any individual or organisation.

4. How we collect personal data

We collect personal data when you provide it directly to us, for example when you:

• fill in a website form
• join the waitlist
• download a resource
• subscribe to emails
• create an account
• add billing details
• reply to an email
• contact us for support
• interact with us on social media
• use the Custard platform

We may also collect data automatically through cookies, analytics tools and similar technologies when you use our website or platform.

5. How we use your personal data

We use personal data to:

• provide and operate the Custard website and platform
• create and manage user accounts
• process waitlist sign-ups and early access requests
• send resources, downloads and emails you have requested
• send marketing emails, product updates and launch communications where permitted
• manage subscriptions, billing and payments
• respond to enquiries and support requests
• improve our website, product and user experience
• understand how people use Custard
• generate insights and recommendations inside the platform
• maintain security and prevent misuse
• comply with legal, regulatory and tax obligations

We do not sell personal data to third parties.

6. Marketing emails

If you join our waitlist, download a resource, sign up for updates or otherwise opt in to hear from us, we may send you emails about Custard, leadership resources, product updates, launch information, offers or related content.

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in our emails or contacting us at support@itscustard.com.

7. Cookies and analytics

We use cookies and similar technologies to help our website and platform work properly, keep users securely logged in, understand how the platform is used, and improve performance and user experience.

Some cookies are essential and are needed for the website or platform to function. Others, such as analytics or performance cookies, are only used where required consent has been given.

The types of cookies we may use include:

• essential cookies, such as session, authentication and security cookies
• analytics cookies, such as Google Analytics cookies
• payment-related cookies, such as Stripe cookies used for fraud prevention and security

You can manage cookie preferences through our cookie banner, cookie settings link, or your browser settings.

For more information, please see our Cookie Policy.

8. Lawful bases for processing

Under UK GDPR, we only use personal data where we have a lawful basis to do so. Depending on the situation, we may rely on:

Contractual necessity
Where processing is needed to provide the Custard platform, manage your account, process billing, or deliver a service you have requested.

Consent
Where you have opted in to marketing emails or accepted non-essential cookies.

Legitimate interests
Where we use data to improve Custard, understand usage, respond to enquiries, send relevant business communications, maintain security, analyse trends or develop the product, provided your rights and freedoms do not override those interests.

Legal obligation
Where we need to retain or use information to comply with legal, tax, accounting or regulatory requirements.

9. Custard platform users

When an organisation uses the Custard platform, the organisation is usually the Data Controller and Custard acts as the Data Processor.

This means the organisation decides why and how personal data is used, and Custard processes that data on the organisation’s instructions.

When you use the platform, we may process:

• user account data, such as name, email address and job role
• team structure data, such as manager relationships and reporting lines
• feedback responses submitted through the platform
• usage data, such as logins, interactions and platform activity
• IP addresses and user-agent strings

We process this data to provide and operate Custard, generate insights and recommendations, improve functionality and user experience, and maintain platform security.

If you have questions about how your organisation uses your personal data inside Custard, you should contact your organisation first.

10. Anonymous feedback

Custard is designed to support anonymous feedback and meaningful team-level insight.

To support this:

• feedback is aggregated before being shown to managers
• reports are only generated once a minimum response threshold is met
• individual responses are not intended to be visible to managers

However, absolute anonymity cannot be guaranteed in every situation, particularly in small teams or where response patterns may indirectly identify someone.

Custard is designed to provide team-level insight, not to monitor, identify or evaluate individuals. Organisations and managers are responsible for using insights appropriately and not attempting to identify individuals from anonymous feedback.

11. AI and automated insights

Custard uses automated processing and AI-powered features to generate insights, recommendations and guidance based on feedback and platform data.

These insights are intended to support human decision-making, not replace it.

Custard does not make solely automated decisions that produce legal or similarly significant effects on individuals. Managers and organisations remain responsible for reviewing recommendations and using their judgement before taking action.

12. Who we share data with

We may share personal data with trusted service providers who help us operate Custard and deliver our services.

These may include:

• cloud hosting and infrastructure providers
• payment processors
• email delivery providers
• marketing and communications platforms
• analytics providers
• AI insight and chat providers
• database and product infrastructure providers
• professional advisers, such as legal, accounting or compliance support

Our current service providers and sub-processors include:

• Laravel Cloud, for cloud hosting and infrastructure
• Stripe, for payment processing
• Resend, for transactional email delivery
• GoHighLevel, for marketing and communications
• Claude, for AI-powered insights and chat
• Supabase, for resource embedding database functionality
• Anthropic, for team member import validation

Where required, we put appropriate agreements in place with our service providers to protect personal data.

We may also share personal data where required by law, regulation, court order, legal process or to protect our rights, users or business.

13. International transfers

Some of our providers may process personal data outside the UK or EEA.

Where personal data is transferred internationally, we will take steps to ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, Standard Contractual Clauses, transfer impact assessments, or other lawful transfer mechanisms where required.

14. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this policy.

This may include keeping data for as long as:

• you are subscribed to our emails
• you remain on our waitlist
• you have an active Custard account
• we need it to provide the platform or support
• we need it for legal, tax, accounting or regulatory purposes
• we need it to resolve disputes or enforce agreements

When a customer organisation terminates use of the Custard platform, Custard will, at the Controller’s choice, manually delete or return personal data within 90 days of the termination date, unless we are required by law to retain it for longer.

You can request deletion of your personal data by contacting us at hello@itscustard.com or support@itscustard.com.

15. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or destruction.

These measures may include:

• role-based access controls
• encryption of data in transit and at rest where appropriate
• secure cloud infrastructure
• monitoring and security assessments
• confidentiality obligations for personnel
• staff training on data protection responsibilities

No system can be guaranteed to be completely secure, but we take reasonable steps to protect personal data and maintain the security of our platform.

16. Your rights

Depending on where you are based and the nature of our relationship with you, you may have rights under data protection law, including the right to:

• access your personal data
• correct inaccurate or incomplete data
• request deletion of your personal data
• restrict or object to certain processing
• request data portability
• withdraw consent where we rely on consent
• object to automated processing where it has legal or similarly significant effects

If you are using Custard through your organisation, your organisation is usually the Data Controller and should be your first point of contact for exercising your rights.

You can also contact us at support@itscustard.com and we will help where we are able to do so.

17. Complaints

If you have concerns about how your personal data is handled, please contact us first so we can try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office, or your local data protection authority if you are outside the UK.

18. Children

Custard is intended for business and workplace use. You must be at least 18 years old to use the Custard platform.

We do not knowingly collect personal data from children.

19. Links to other websites

Our website and emails may include links to third-party websites, services or social media platforms.

We are not responsible for the privacy practices, content or security of those third-party websites. You should review their privacy policies before providing them with personal data.

20. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, legal obligations or how we use personal data.

The latest version will always be available on our website. Where changes are material, we will take reasonable steps to notify users.

21. Contact us

For questions about this Privacy Policy or how we handle personal data, contact us at:

Email: support@itscustard.com
Registered office: First Floor Sterling House, Outrams Wharf, Little Eaton, Derby, DE21 5EL