Privacy notice — CurioExtract

1. Data controller

The data controller for this product is Curio Capital AG, Bahnhofstrasse 12, 6300 Zug, Switzerland. You can contact our Data Protection Officer at dpo@curioinvest.com.

2. What data we collect

• Account data: name, work email, hashed password, organization name
• Contract data you upload: PDF/DOCX files and any metadata extracted from them
• Usage data: pages visited, features used, IP address (for security)
• Integration data: if you connect QuickBooks/Xero, OAuth tokens (encrypted at rest) and synced invoice metadata

3. Lawful basis (nDSG / GDPR)

We process your data on the basis of (a) consent — for analytics and marketing communications; (b) contract performance — to provide the extraction, dashboard, and tokenization-simulator services you signed up for; (c) legitimate interest — for security, fraud prevention, and product improvement.

4. Where your data lives

Application data is stored on Swiss-hosted infrastructure (Infomaniak / Exoscale, both FINMA-aligned providers) in Switzerland. Database snapshots are encrypted at rest with AES-256. Contract PDFs are stored on Swiss object storage. Backups are kept in a separate Swiss region.

5. Subprocessors

For transfers to the US (Anthropic), we rely on the EU Standard Contractual Clauses (SCCs) and conduct transfer impact assessments per Schrems II.

6. Your rights (nDSG Art. 8 / GDPR Arts. 15–22)

• Access — request a copy of your data
• Rectification — correct inaccurate data
• Erasure — request deletion (right to be forgotten)
• Restriction — limit how we process your data
• Portability — export your data in machine-readable format
• Object — object to processing based on legitimate interest

To exercise any of these rights, email dpo@curioinvest.com. We respond within 30 days. You can also lodge a complaint with the FDPIC (Switzerland) or your local data protection authority.

7. Retention

Account data is retained while your account is active + 90 days after deletion. Contract data is retained until you delete it. Anonymized usage analytics may be retained indefinitely.

8. Security

AES-256 at rest, TLS 1.3 in transit, SOC 2 Type II in progress (target Q4 2026). Bug bounty program launching Q1 2027. Report security issues to security@curioinvest.com.

9. Changes to this notice

Material changes are notified by email at least 30 days in advance. The current version is always at this URL.