How we handle your data
Last updated: 2 February 2026
Curie ("we", "us", or "our") operates the Curie platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
We are the data controller for the personal data we process under UK GDPR.
Data we collect
Account data
- Email address (from Google OAuth)
- Authentication tokens (encrypted)
- Team membership and role
Email content
- Email subject lines and body text
- Sender and recipient addresses
- Thread metadata and timestamps
- Attachment metadata (not content)
Document content
- Google Drive files you connect
- Document text for knowledge base
- File metadata (name, type, modified date)
Calendar data
- Event titles and times
- Attendee information
- Meeting links
Usage data
- Actions taken (replies, archives)
- Feature usage patterns
- Performance metrics
AI-generated content
- Draft replies we generate
- Suggested actions
- Email classifications
How we use your data
We process your data to deliver and improve Curie.
Service delivery
- Prioritizing your inbox with AI ranking
- Generating context-aware reply drafts
- Providing next best action suggestions
- Running compliance checks on outgoing emails
- Syncing team knowledge from connected documents
Improvement and analytics
- Learning your team's communication patterns
- Tracking which suggestions you accept or dismiss
- Identifying top performer patterns (anonymized)
- Monitoring service performance and errors
Legal basis for processing
Contract performance
Processing your emails and documents is necessary to provide the Curie service you signed up for.
Legitimate interest
We process usage data to improve our service and detect issues. This does not override your privacy rights.
Third-party processors
We share data with these service providers to operate Curie.
Gmail, Drive, and Calendar APIs
Processes your emails and documents via their APIs. Subject to Google Privacy Policy.
Location: United States
Anthropic
Claude AI for drafts and suggestions
Processes email content to generate drafts and classifications. Data not used to train models.
Location: United States
AWS
Cloud infrastructure hosting
Hosts our databases, search indices, and application servers. Data encrypted at rest.
Location: EU (Ireland)
Data retention
We keep your data only as long as necessary.
| Data type | Retention period | Reason |
|---|---|---|
| Email content | 90 days | Service delivery and context |
| AI suggestions | 48 hours | Ephemeral, auto-expires |
| Reply drafts | Until deleted or 30 days | User convenience |
| Account data | Duration of contract + 7 years | Legal and tax requirements |
| Analytics | 2 years | Service improvement |
| Audit logs | 7 years | Compliance and security |
Your rights
Under UK GDPR, you have the following rights regarding your personal data.
Access
Request a copy of your personal data
Rectification
Correct inaccurate personal data
Erasure
Request deletion of your data
Portability
Receive your data in a portable format
Objection
Object to processing based on legitimate interest
Restriction
Limit how we process your data
To exercise these rights, contact us at privacy@curiehq.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
International data transfers
Some of our service providers (Google, Anthropic) are based in the United States. When we transfer your data outside the UK, we ensure appropriate safeguards are in place.
We rely on Standard Contractual Clauses (SCCs) approved by the UK government for transfers to countries without an adequacy decision. Our AWS infrastructure is hosted in the EU (Ireland), which has an adequacy decision from the UK.
Security measures
Encryption in transit
TLS 1.2+ for all connections
Encryption at rest
AES-256 for stored data
OAuth 2.0
No password storage
Team isolation
Multi-tenant data separation
Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Curie application. The "Last updated" date at the top of this page indicates when this policy was last revised.
Contact us
If you have questions about this Privacy Policy or our data practices, contact us at:
Curie
Email: privacy@curiehq.com