Privacy and cookie policy

This policy explains what personal data Curatum.ai collects, why, how long we keep it and what rights you have. It covers two different situations, because our role is different in each:

• Part A: when you deal with us directly, as a customer, a website visitor or someone we contact. We are the controller.
• Part B: when we handle emails and chats for a business that uses Curatum.ai. That business is the controller and we are its processor.

Who we are

Curatum.ai is a trading name of Thinking Creativity Limited, a company registered in England and Wales (company no. 07428091). Registered office: 34 Lancaster Gate, London, W2 3LP. We are registered with the Information Commissioner’s Office (ICO), registration number ZC285407.

For anything about privacy, email hello@curatum.ai.

Part A: when we are the controller

What we collect

• Your account. Your name, email address, business name and the settings you choose. Your password is handled by our login provider and stored in hashed form; we never see it.
• Billing. Payments are taken by Stripe. We never see or store your card number. We keep your Stripe customer and subscription references and a record of each invoice (amount, tax, dates).
• Mailbox connection details. If you connect a mailbox with an app password, the password is encrypted (AES-256) before it is stored. If you connect Microsoft 365 with Microsoft sign-in, we store an encrypted access token instead of a password.
• Trial requests and sign-ups. Your name, email address and business name.
• Website demo requests. Your name, email address, business name, website address, your IP address, a screenshot of your homepage, the information we read from your public website to build the demo, and the conversation you have with the demo chat. Requesting a demo also creates a Curatum.ai account for you.
• Contact form. Your name, email address and message. These are emailed to us and are not stored in our database.
• Our own Chat Bot. The curatum.ai website uses the same Chat Bot our clients use. The messages you type are stored so we can see what visitors ask.
• Help requests. Messages you send us from inside your account, and whether you asked for a call.
• Outreach. To find businesses that might want Curatum.ai, we use a prospecting service that finds publicly available business contact details: a person’s name, work email address, business name and website.
• Technical data. Our web server keeps standard request logs (IP address, page requested, time, browser type) for security and troubleshooting.

Why we use it, and our lawful basis

If you get an outreach email from us and do not want any more, reply and say so or email hello@curatum.ai. We will stop, and keep only the minimum needed to make sure we do not contact you again.

We do not sell personal data, and we do not use it for advertising.

Part B: when we are the processor

Businesses use Curatum.ai to draft email replies and answer questions in a chat on their website. To do that we handle personal data that belongs to their customers and website visitors, such as:

• emails sent to the business: sender name and address, subject, the text of the message and earlier messages in the thread;
• the drafts we write in reply, and how the business edited them;
• chat conversations on the business’s website;
• any details people include in those messages.

For this data the business is the controller. We only use it to provide Curatum.ai to that business, under the data processing terms in our terms of service. If you emailed or chatted with a business that uses Curatum.ai and want to use your data protection rights, please contact that business. If you contact us instead, we will pass your request on to them.

How the AI uses this data

• To write a draft or a chat reply, the relevant message and the business’s own information are sent to a commercial AI service. That provider processes it to return a reply and does not train its models on it.
• Email drafts go into the business’s Drafts folder. A person at the business decides whether to send them. Curatum.ai cannot send email on their behalf.
• Chat replies are automated. They are written only from information the business has added or approved, and nobody checks them before the visitor reads them.
• Curatum.ai learns from the replies a business sends, to improve that business’s own drafts and chat. Before sent emails are analysed, email addresses, phone numbers and long account or order numbers are removed. What is learned stays in that business’s account and is never shared with other businesses.

Who we share data with

We use a small number of service providers (sub-processors) to host and run Curatum.ai, such as our hosting company, database, AI provider, email delivery and payments. The full list, what each one does and where it processes data is on our sub-processors page. Each one is bound by a contract that requires it to protect the data.

We may also share data if the law requires it, or to protect our rights, our users or the public.

International transfers

Our app server and database are in the United Kingdom. Some providers process data outside the UK, for example our AI provider and payment processor in the United States. When data leaves the UK we rely on one of the safeguards UK law allows: UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge where the recipient is certified. Ask us for details of the safeguard for any provider.

How long we keep data

A client can also ask us to delete their account at any time. What the Email Agent has learned (rules and facts) is part of the account and is deleted with it.

How we protect data

• All traffic to and from Curatum.ai is encrypted in transit (HTTPS).
• Mailbox passwords and sign-in tokens are encrypted before they are stored.
• The database only accepts connections from our own server network, and its public interface is locked down.
• Each business can only see its own data.
• Our staff only look at client data when it is needed to run the service or when a client asks for help. In our admin tools, customer names, email addresses, subjects and chats are hidden by default. Showing one needs a recorded reason, and every view is logged.

More detail is on our security page.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data (access);
• correct data that is wrong;
• delete your data;
• give you your data in a format you can take elsewhere (portability);
• restrict or stop using your data, or object to how we use it, including for marketing;
• withdraw consent, where we rely on consent.

Email hello@curatum.ai. We will reply within one month. Clients can ask for a full export of their account data the same way.

If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Cookies and browser storage

We only use what is strictly necessary for Curatum.ai to work. There are no analytics, tracking or advertising cookies on curatum.ai or in the Chat Bot today. Because everything below is strictly necessary, it does not need consent and there is no cookie banner.

If we add analytics or any other non-essential cookies in future, we will ask for your consent before setting them and update this page first.

For clients: wording for your own policy

If you put the Chat Bot on your website, you are responsible for telling your visitors about it. You can copy this paragraph into your own privacy or cookie policy and change it as you need:

Our website chat is provided by Curatum.ai (Thinking Creativity Limited), which processes chat messages on our behalf so it can answer your questions using information about our business. Replies are written automatically by AI. The messages you type are stored by Curatum.ai for up to 12 months. To keep your conversation open as you move between pages, the chat saves it in your browser’s local storage. This is strictly necessary for the chat to work. The chat does not use cookies for tracking or advertising.

Changes to this policy

We will update this page when our practices change and change the date at the top. If a change materially affects clients, we will tell them by email before it takes effect.