Privacy Policy

DRAFT — PENDING ATTORNEY REVIEW. This document is a product draft prepared for beta testing. It has not been reviewed by an attorney and does not constitute legal advice. Sections marked ATTORNEY REVIEW REQUIRED must be completed by qualified legal counsel before this document is relied upon.

Version: 1.0-draft Effective Date: (set on publish)

This Privacy Policy describes how Curio ("we," "us") handles information in connection with the Curio Service. This draft accurately reflects Curio's actual data practices as currently implemented. It does not claim security measures, certifications, or privacy rights that have not been implemented.

1. Information Users Provide

When you use Curio, you may provide information including: account/profile information; professional role; project information; client and project team information; project addresses where provided; photos and images; measurements; inspiration; drawings; specifications; proposals, quotes, and bids; product information; project communications; approvals; schedules; procurement information; payment status/information; warranties; uploaded files; and feedback or support requests.

For clarity, the financial and project information Curio may process includes: purchase and order information; amounts paid and amounts potentially owed; project budgets; fees, credits, and refunds; vendor policies (return, restocking, cancellation, freight, and final-sale terms); invoices and quotes; uploaded agreements and documents; transaction and project payment history; and AI-derived information generated from those records (such as extracted vendor terms, calculated reconciliations, and estimates). Curio records this information to organize and present it; it does not determine contractual entitlement to any amount.

2. Automatically Collected Information

Curio may automatically collect device and browser information, IP/log data, usage and activity information, and authentication/security event data necessary to operate and protect the Service.

3. How Information Is Used

Information is used to: provide Curio; organize Project Brain information; provide AI-powered features; authenticate users; maintain permissions; process user requests; provide collaboration features; troubleshoot and maintain security; improve the product; and provide support.

4. AI Processing

Certain information submitted to AI-enabled Curio features may be processed by third-party AI/infrastructure providers as necessary to provide those features. Curio does not represent that user data is or is not used to train third-party models unless this has been verified for every relevant provider and configuration.

NEEDS TECHNICAL VERIFICATION. The specific AI/infrastructure providers and their data-handling practices (including model training) must be verified before definitive statements are made here.

5. Service Providers

Curio relies on third-party infrastructure and service providers to operate. The current list of providers is maintained in the Subprocessors / Service Providers document.

6. Payments

Where Stripe or another payment processor handles payment-card information, Curio distinguishes between information it receives (e.g., payment status, transaction references) and information processed directly by the payment processor (e.g., full card numbers). Curio does not unnecessarily store full payment-card credentials.

7. Sharing

Project information may be shared with authorized designers, clients, architects, contractors, vendors, trades, or other collaborators according to project permissions. Access is controlled by project owners/admins through project roles. A user's self-selected professional preference does not grant access. Confidential information does not become visible simply because someone participates in the same project.

8. Retention

POLICY DECISION REQUIRED. A final retention and deletion schedule has not been adopted. Until a retention schedule is established and inserted here, users should not assume a specific retention period.

9. Account / Data Deletion

Users may request account or data deletion by contacting the Studio administrator or Curio support. Curio will describe the actual mechanism available. Curio does not promise immediate or permanent deletion from backups unless technically accurate.

10. Security

Curio describes its security practices conservatively and accurately. Curio does not use phrases such as "completely secure," "100% secure," or "bank-level security." No specific security certification or compliance framework is claimed unless it has been actually established and verified.

NEEDS TECHNICAL VERIFICATION. Specific security measures (encryption at rest/in transit, access controls, audit logging) should be accurately described here once verified from the current architecture.

11. Children's Privacy

Curio is not intended for children.

ATTORNEY REVIEW REQUIRED. The precise age threshold and legal language for children's privacy must be confirmed by legal counsel based on applicable law.

12. State / International Privacy Rights

ATTORNEY REVIEW REQUIRED. Applicable U.S. state privacy laws and international requirements based on where Curio is initially offered must be inserted here by qualified legal counsel. Do not fabricate privacy rights that do not apply.

13. Changes to This Policy

If material changes occur, Curio will publish a new version. The acceptance architecture records the version each user acknowledged.

14. Contact

Privacy questions may be directed to the Studio administrator or Curio support.

This Privacy Policy is a draft pending attorney review and is not attorney-approved.