This policy explains how FlyoverWorks, Inc., doing business as Cultivate Labs ("Cultivate Labs," "we," "us" or "our"), collects, uses, shares and protects personal data. FlyoverWorks, Inc. is a corporation registered in the State of Illinois in the United States.
It applies to our websites (including cultivatelabs.com and hinsley.ai), our software products including Hinsley, and the forecasting platforms we operate for our clients.
Where we decide why and how personal data is processed, such as on our own websites and for our own customer relationships, we are the data controller and this policy describes our practices.
We also operate forecasting and analysis platforms on behalf of government, nonprofit and corporate clients, including public crowd-forecasting websites. On those platforms our client is the data controller and we process personal data only on its documented instructions, as its service provider (data processor). The client's own privacy notice tells you how it uses your data, and you should contact the client to exercise your rights; we will help the client respond. Our commitments under the Data Privacy Framework (section 5) apply to this data as well.
Category |
What it includes |
Why we use it |
Legal basis |
|---|---|---|---|
Account and profile data |
Username, name, email address, password (stored hashed) and optional profile details |
To create and run your account, secure the service, keep backups and communicate with you |
Performance of a contract with you or your employer, or our legitimate interest in running our services |
Forecasts and contributions |
Forecasts, rationales, comments, forum posts, survey answers and links you submit |
To operate the platform, calculate scores and aggregate forecasts, publish content you choose to share and produce reports |
Performance of a contract, or our legitimate interest in running our services |
Optional demographic data |
Information you choose to provide, such as age range, gender or nationality |
To support analysis of forecasting results |
Your consent |
Usage and technical data |
IP address, approximate location, browser and device type, pages visited, and login and activity times |
To secure and maintain our services, prevent abuse and understand how our services are used |
Our legitimate interest in securing and improving our services |
Notification data |
Email address and notification preferences |
To send the notifications and newsletters you ask for |
Your consent |
Enquiry and correspondence data |
The content and details of messages you send us |
To reply to you and keep records |
Our legitimate interest in communicating with you |
Customer relationship and transaction data |
Contact details, employer, role, invoicing and payment details |
To manage customer relationships, provide purchased services and keep financial records |
Performance of a contract and our legal obligations |
We may also process any of this data where necessary to establish, exercise or defend legal claims, to comply with a legal obligation, or to protect someone's vital interests. We may use anonymized, aggregated data to obtain insurance or professional advice.
Please don't give us another person's personal data unless we ask you to.
Hinsley and some of the platforms we operate use AI models to analyze information, generate forecasts, and summarize forecasts, comments and discussions. When you use these features, relevant content may be sent to an AI model provider acting as our service provider under contract. Our providers do not use this content to train their models. Where a client requires it, AI processing runs only in the locations the client specifies. AI-generated forecasts and content are labeled as such.
We do not sell personal data. We share it only as follows:
Our clients. On platforms we operate for a client, we share personal data with that client, and with its prime contractor or partners where we work as a subcontractor, as the client instructs.
Service providers that process personal data on our behalf, under contracts that require them to protect it and use it only to provide their services to us:
cloud hosting and backup (Amazon Web Services);
email delivery;
bot protection at registration;
AI model providers;
content moderation services;
website analytics and performance monitoring (Google Analytics on cultivatelabs.com; New Relic);
payments, invoicing and accounting (Stripe, Xero).
Professional advisers and insurers, using anonymized, aggregated data where possible.
Public authorities and others where the law requires it. We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may also disclose data where necessary to establish, exercise or defend legal claims, or to protect someone's vital interests.
We are based in the United States, and our staff may access personal data from the United States to operate and support our services. Where a client requires it, we host and process its platform's data in a specific country, such as Sweden for European government clients. Transfers of personal data from the European Union and the United Kingdom to the United States are covered by our Data Privacy Framework certification (section 5).
FlyoverWorks, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. FlyoverWorks, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (the "DPF Principles") with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension. If there is any conflict between this policy and the DPF Principles, the DPF Principles govern. To learn more about the Data Privacy Framework program and to view our certification, visit https://www.dataprivacyframework.gov/.
Scope. Our commitments cover all personal data we receive from the EU and the UK in reliance on the DPF: the categories described in section 2, whether we process them for ourselves or for our clients, for the purposes described in this policy.
Sharing and onward transfers. We share personal data with the third parties and for the purposes described in section 3. We remain liable under the DPF Principles if a service provider we engage processes personal data received under the DPF in a way that is inconsistent with the Principles, unless we prove we are not responsible for the event giving rise to the damage.
Your choices. You may opt out of our disclosing your personal data to a third party other than our service providers, or using it for a purpose materially different from the one for which it was collected or that you later authorized. Contact us using the details in section 10. We will not process sensitive personal data for those purposes without your express consent.
Access. You have the right to access the personal data we hold about you and to correct, amend or delete it where it is inaccurate or processed in breach of the DPF Principles. Contact us using the details in section 10.
Complaints. If you have a question or complaint about our handling of your personal data under the DPF, please contact us first at [email protected]. We will respond within 45 days. If your complaint is not resolved, FlyoverWorks, Inc. commits to cooperate and comply with the advice of the panel established by the EU data protection authorities and the UK Information Commissioner's Office with regard to unresolved complaints about personal data received in reliance on the EU-U.S. DPF and the UK Extension. You can contact those authorities free of charge.
Enforcement. FlyoverWorks, Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
Binding arbitration. Under certain conditions, described on the Data Privacy Framework website, you may invoke binding arbitration for complaints about DPF compliance that are not resolved by any of the other DPF mechanisms.
Disclosure to public authorities. We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
We keep personal data only as long as necessary for the purposes it was collected for. On platforms we operate for clients, we retain and delete personal data as the client instructs, for example deleting or pseudonymizing a user's data when their account is closed. For our own purposes, we keep personal data for up to three years after we stop actively using it, unless the law requires us to keep it longer.
Depending on where you live, data protection law may give you the right to:
access your personal data and receive a copy;
correct inaccurate or incomplete data;
have your data erased;
restrict or object to our processing, including for direct marketing;
receive your data in a portable format;
withdraw consent at any time, without affecting earlier processing; and
complain to a data protection supervisory authority where you live or work, or where the alleged infringement took place.
These rights have conditions and exceptions set out in the law. You can exercise many of them from your profile page, or by contacting us using the details in section 10. If your data is on a platform we operate for a client, we will pass your request to the client and help it respond.
Cookies are small files a website stores in your browser. We use them to:
keep you signed in and recognize you as you move through our services;
protect accounts and our services, including against fraudulent logins;
remember your preferences, including your cookie choices; and
understand how our services are used and how they perform.
Our service providers also set cookies: Google Analytics on cultivatelabs.com, and New Relic to monitor performance. Where cookies are not strictly necessary, we ask for your consent when you first visit. You can block or delete cookies in your browser settings, though some features may then stop working.
We may update this policy from time to time by publishing a new version on our website. We will notify you of significant changes by email or through our services.
FlyoverWorks, Inc. (Cultivate Labs) 155 N Wacker Dr, #4250, Chicago, IL 60606
Email: [email protected]
Our data protection officer is Ben Roesch, who can be reached at the same address.