Privacy Policy

Your privacy matters to us. This Privacy Policy describes the types of information we collect, how we process it, and your rights regarding your data. It applies to all users of the Service, whether you interact via the dashboard, the gateway API, SDKs, or any other interface.

By using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

Account Information

When you create an account, we collect your email address, name, and password (hashed). If you sign up using OAuth providers (Google, GitHub), we receive basic profile information (name, email, profile picture URL) from those services. For organization accounts, we also collect organization name and billing contact information.

Usage Data

We collect information about how you use our platform, including API call metadata, gateway request volumes, agent execution counts, dashboard feature usage, and runner session activity. This data is used to provide cost tracking, analytics, and to improve the Service.

Technical Data

We automatically collect certain technical information, including IP addresses, browser type, device information, operating system, referring URLs, and timestamps. This data is used for security, debugging, and service optimization.

Billing Information

Payment card details are collected and processed by our payment processor, Stripe. We do not store full credit card numbers. We retain billing records (invoices, payment amounts, dates) as required for accounting and legal purposes.

When you route API requests through the Curate-Me gateway, we process the following data:

• Model name — Which LLM model was requested (e.g., gpt-4o, claude-3-opus).
• Token counts — Input and output token counts for billing and analytics.
• Cost data — Estimated and actual cost per request, accumulated daily totals.
• Governance policy results — Whether the request passed or was denied by each governance step (rate limit, cost check, PII scan, model allowlist, HITL gate).
• Request metadata — Timestamp, response latency, HTTP status code, and API key identifier (not the key itself).

PII Scanning

When PII scanning is enabled in your governance policies, request content is scanned in memory using regex-based pattern matching. The scan checks for API keys, passwords, email addresses, phone numbers, social security numbers, credit card numbers, and other sensitive data patterns. Content is scanned in a streaming fashion and immediately discarded after the scan completes. We do not retain, log, or store scanned content.

Prompt & Completion Content

The actual content of your prompts and completions passes through our gateway as a transparent proxy. Request and response bodies are forwarded to the upstream LLM provider via encrypted connections (TLS 1.2+) and are not persisted, cached, or logged by Curate-Me. We do not use your content to train models or for any purpose other than proxying the request.

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Process transactions and manage your subscription and billing.
• Enforce governance policies (rate limits, cost caps, model allowlists).
• Provide cost tracking, usage analytics, and observability features.
• Send technical notices, security alerts, and support messages.
• Detect, investigate, and prevent fraud, abuse, and security threats.
• Comply with legal obligations.
• Respond to your requests and provide customer support.

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

We retain your data according to the following schedule:

You may request earlier deletion of your data at any time, subject to legal retention requirements.

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256 encryption.
• API keys are stored using SHA-256 hashing; plaintext keys are not retained after issuance.
• Passwords are hashed using bcrypt with appropriate work factors.
• Multi-tenant data isolation ensures organizations cannot access each other's data.
• Infrastructure is hosted in European data centers in Germany with physical security controls.
• We perform regular security reviews and maintain a vulnerability disclosure program.

For more information about our security practices, see our Security page.

We use the following third-party service providers (sub-processors) to operate the Service:

Upstream LLM providers receive the content of your API requests as part of normal gateway proxying. Your use of LLM providers through our gateway is also subject to their respective privacy policies and terms of service.

We will notify you of changes to our sub-processor list by updating this page and, for material changes, by email notification.

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable local data protection laws.

Legal Bases for Processing

• Contract performance — Processing necessary to provide the Service you have subscribed to.
• Legitimate interests — Improving the Service, preventing fraud, and ensuring security.
• Legal obligation — Retaining billing records and complying with applicable laws.
• Consent — Where required (e.g., marketing communications), we will obtain your explicit consent.

Data Processing Agreement

A Data Processing Agreement (DPA) is available on request for customers who need formal data processing terms under GDPR Article 28. Contact privacy@curate-me.ai to request a DPA.

EU Data Processing

Our primary infrastructure is hosted in data centers in Germany (EU). For EU customers, data can be processed entirely within the European Union. Where data is transferred outside the EU (e.g., to US-based sub-processors like Stripe), we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.

Data Protection Officer

For GDPR-related inquiries, contact our Data Protection team at dpo@curate-me.ai.

You can export all of your data at any time using the following methods:

• Dashboard export — Use the Settings page in the dashboard to request a full data export, which will be delivered as a downloadable archive.
• API export — Use our B2B API endpoints to programmatically retrieve your usage records, cost data, audit logs, and governance policy configurations.
• CLI export — Use the curate CLI tool to export data in JSON or CSV format.

Exported data includes account information, usage records, cost data, audit trail events, governance policy configurations, and runner session logs. Prompt and completion content is not included because we do not store it.

You may request account deletion at any time by:

• Using the account deletion option in your dashboard settings.
• Emailing privacy@curate-me.ai with the subject line "Account Deletion Request".

Upon receiving a deletion request, we will:

• Confirm receipt of the request within 2 business days.
• Complete the deletion within 30 calendar days.
• Delete all personal information, usage records, API keys, governance policies, and runner configurations associated with your account.
• Revoke all active API keys immediately upon processing the request.
• Retain only billing records required by law (anonymized where possible).

Deletion is irreversible. We recommend exporting your data before submitting a deletion request.

We use essential cookies only:

• Authentication cookies — To maintain your logged-in session. These are strictly necessary for the Service to function.
• Preferences cookies — To remember your dashboard settings (e.g., theme, layout preferences).

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. We do not engage in cross-site tracking.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete personal data.
• Erasure — Request deletion of your personal data (see Account Deletion above).
• Portability — Receive your data in a structured, machine-readable format.
• Restriction — Request restriction of processing in certain circumstances.
• Objection — Object to processing based on legitimate interests.
• Withdrawal of consent — Where processing is based on consent, withdraw consent at any time.

To exercise any of these rights, contact us at privacy@curate-me.ai. We will respond within 30 days, or sooner where required by law.

If you are in the EU/EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

If you have questions about this Privacy Policy or our data practices, please contact us: