Privacy Policy

This policy explains what Curate does with personal data. It is information for you to read — you are not asked to agree to it, and nothing you do on Curate counts as agreeing to it.

1. Who is responsible

CURATE STUDIO TECHNOLOGIES LIMITED, a company registered in England and Wales (company number 17503767), registered office TODO(legal): registered office address, trading as Curate.

• Privacy and data protection requests: chris@curatestudio.dev
• Anything else: chris@curatestudio.dev
• ICO / Information Commission registration: TODO(legal): ICO data protection fee registration number
• Representative in the EU (GDPR Article 27): TODO(legal): GDPR Art 27 EU representative name + address

TODO(legal): confirm whether a data protection officer is required; on the current scale we do not believe one is, and there is none appointed.

2. Two different roles

These are separate, and it matters which one applies.

We are the controller for data about you as a customer

Your account, your subscription and payments, your token balance and spending, your acceptances of the Terms, your consent choices, the feedback you send us and our server logs. Everything in this policy describes that role unless it says otherwise.

We are a processor for the data you put into Curate

If your product feeds, images or prompts contain personal data about other people, you decide why and how it is handled and we act on your instructions. Our obligations to you in that role are in the data processing schedule in our Terms of Service. If you are one of those people and want to know how your data is used, ask the business that uploaded it — we will pass a request on if you contact us at chris@curatestudio.dev.

3. What we hold

Account and sign-in

Your email address, your name if you give one, your Clerk user id and the date you signed up. Authentication itself is run by Clerk, which holds your sign-in credentials, your sign-in history, and the IP address and device information it uses to spot suspicious sign-ins. We never see your password.

Subscription, payments and tokens

Your plan and its status; your token balance and total tokens used; each grant of tokens (how many, the source, when it expires, which month or purchase it belongs to); and a ledger row for every grant, spend, expiry and refund, which records how many tokens moved, the reason — including which feature you used — and the number of items processed. Where you buy a plan we also record the contract, when it started, whether you asked us to start supplying inside the cancellation period, and when we sent your confirmation email.

If you withdraw from a contract we keep what you submitted: the name, email address, contract reference and statement, the time you submitted it, and the refund status. These are kept as a snapshot, so they survive account deletion — they are the evidence of what you asked for and when.

We never see or store your card details. Payments are handled by Stripe through Clerk Billing.

Legal and consent records

When you agree to the Terms we record the document, its version number, the exact wording of the button you clicked, a fingerprint of the document text you were shown, where in the app you were, and the time. When you answer the analytics question we record your answer, the version of the policy and of the prompt wording it applied to, and the time. These records exist because the law puts the burden on us to show what we asked and what you answered.

Your projects and content

Project titles and descriptions, the file you imported, your product rows and pipeline configuration, thumbnails, and any tasks attached to a project. Saved templates (their configuration, accent colour, tagline and tags), saved layouts, and uploaded images and fonts (the hosted file, its name, type and size). Assets imported from Figma, with their dimensions, format, size and a content hash. Where you publish a feed, we store the feed token and the finished rows the public URL serves — the product data and the links to your rendered images.

Figma connection

If you pair the Figma plugin we store only a SHA-256 hash of the pairing code and of the access token — never the token itself, which is shown once and then lives in Figma. We also store an optional label for the token, which is usually the Figma user's name, when it was last used and when it expires.

Feedback

When you send feedback from the in-app button we store the type, your message, the page you were on and your browser's user-agent string. For a bug report there is a tick box marked “Include console logs to help diagnose the issue”. If you tick it we also store the recent console output from your browser, which can include fragments of whatever the app was working with at the time — including parts of your product data. It is off unless you tick it.

Technical and security data

Our hosting provider, Vercel, logs requests to Curate, including IP addresses, and captures errors our code reports. Where rate limiting is configured with Upstash Redis, a count of your recent requests is kept against your user id or IP address. It is deleted a day after your last request for the daily limits on the project setup analysis and the AI assistant, and ten seconds or a minute after it for everything else. Storage on your own device is listed in the Cookie and Storage Policy.

Analytics — only if you allow it

Vercel Web Analytics is off unless you choose “Allow”. Nothing is loaded or sent before that. If you allow it, each page view sends the page address with query strings removed and project identifiers replaced by a placeholder, the page you came from, and your device and browser type. It sets no cookies and creates no identifier for you. You can change your mind at any time in Cookie settings, and it stops immediately.

4. Why we use it, and on what legal basis

We do not sell personal data, we do not use it for advertising, and we do not use your content to train AI models. We send no marketing emails; if that ever changes we will ask first and there will be an easy way out.

6. Whether you have to give us data

An email address is required: without one there is no account, and no contract we could perform. Your name is optional. Uploading content is your choice, but Curate cannot produce anything without it. Feedback is entirely voluntary, and the console logs attached to a bug report are optional within it. Refusing any of the optional items has no consequence beyond the feature not being available.

7. Who else handles the data

These providers process data on our instructions, under a contract, and only for what we have engaged them to do — except where the table says a provider also acts for itself.

We also disclose data where we have to: to a court, regulator or law enforcement body acting lawfully, to our professional advisers, and to a buyer if the business is sold — in which case we will tell you.

We will publish a change to this list at least 30 days before it takes effect. Business customers may object in that period; see the data processing schedule.

8. What each AI feature sends

AI features run only when you use them: the project setup analysis when you add a file, or press Continue on a feed’s address, in the Create project dialog, and every other feature when you press its button. Nothing else is sent to a model provider. This is what leaves Curate in each case:

AI copy optimisation (AI Optimize node)

The columns you selected, for the rows you selected, plus your instruction. Sent in batches to an OpenAI model through the Vercel AI Gateway.

Product description optimiser (older canvas)

The rows you selected and your instruction, sent directly to OpenAI's API rather than through the Gateway.

Template suggestions

A description of your dataset — column names, row count, whether there are images, prices and descriptions, average product name length — together with our own template library. Your product rows are not sent. Goes to Claude through the Gateway.

Template generation

Your written brief and the same dataset description, plus the fonts and palette available. Goes to Claude through the Gateway.

Project setup analysis

A profile of your data, to propose a starting pipeline, sent as soon as you add a file in the Create project dialog (or press Continue there on a feed's web address). The profile gives each column's name, the kind of values it holds, simple statistics such as how full it is, and up to three sample values, each no longer than 80 characters, with web addresses reduced to the site's name and file type. With it go how many rows there are, the file's name (for a feed, the last part of its web address, or the site's name), your browser's language setting and the proposal our own rules made. Nothing else from your rows is sent. Goes to a Claude model through the Gateway, and falls back to our own rule-based proposal if the call fails. TODO(legal): confirm this entry. Version 1 named only the column names and shape and the file name, though the analysis has sent the sample values and the language setting since it launched. Confirm too that adding a file counts as starting the feature, as this section's opening line says: the analysis has no button of its own.

AI assistant (“Ask for a change” on the project canvas)

Nothing is sent until you press Ask (or Enter in the box). Then it sends what you typed, up to 500 characters; a summary of your canvas; and, once your data reaches the Refine node that feeds a template, a profile of its columns. The summary gives each node's id, type and title; how the nodes are connected; row counts; each template's name, id and where it came from, its aspect ratio and the fields it shows; and the settings the assistant can change, which are the currency, the column that feeds each field, the template and how many items to render. The profile gives each column's name, the kind of values it holds, simple statistics such as how full it is, and up to three sample values, each no longer than 80 characters, with web addresses reduced to the site's name and file type. Your browser's language setting goes too. No other product data is sent: not your rows or images, your feed's address, your edits and filters, or the designs themselves. Goes to a Claude model through the Gateway. The assistant only proposes changes: nothing on your canvas changes until you press Apply, and nothing runs until you press Run. We keep none of what is sent, or the answer: our server logs record only counts, codes and the type of any error. Changes you apply are saved to your project like any other edit. To enforce the daily limit, a count of your requests is kept against your account until a day after your last one. TODO(legal): confirm this entry, and that the assistant needs no row of its own in section 4: it runs as part of the service, under our contract with you.

AI image editing and generation

The images you selected, fetched from where they are hosted, and your prompt. Goes to a FLUX model from Black Forest Labs or to Google Imagen through the Gateway, as you choose.

Banner generator

Your prompt and the style, size and format options, as text. Reference images are described in the prompt, not uploaded. Sent directly to OpenAI's image API.

Background removal

The image itself, sent to Photoroom. The result is stored on UploadThing and the original is left alone.

Figma binding suggestions

Only the layers our own rules could not place: their names, whether each is text or an image, and a short sample of the text in them. Goes to Claude through the Gateway.

Please do not put personal data into prompts or product feeds where you can avoid it. If you do, you are the controller for it and the data processing schedule applies.

TODO(legal): confirm in writing with each provider, and with Vercel for the Gateway, that inputs are not retained for training and note the retention period each one applies.

9. Sending data outside the UK and EEA

Most of the providers above are in the United States, so your data is transferred there. Where a provider is certified under the EU–US Data Privacy Framework and its UK Extension, we rely on that. Otherwise we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the European Commission's Standard Contractual Clauses, and we assess the transfer before making it. You can ask us for a copy of the safeguards for any provider at chris@curatestudio.dev.

TODO(legal): record which providers are Data Privacy Framework certified, and complete and keep a transfer risk assessment for those that are not.

10. Data you choose to make public

A published feed URL is readable by anyone who has the link, with no sign-in. It serves the product rows and the links to your rendered images. Please do not publish personal data there. This is explained further in the Terms.

11. How long we keep it

Retention is not yet enforced by an automatic purge job for every category. Until it is, ask us at chris@curatestudio.dev if you want something removed sooner.

12. Your rights

You can ask us to: give you a copy of your data; correct it; delete it; restrict what we do with it; give it to you or another provider in a portable form; or object to us using it (see section 5). Where we rely on consent you can withdraw it at any time, which does not affect anything done before you did.

Email chris@curatestudio.dev. We answer within one month, and tell you if we need longer, which we may where a request is complex. There is no charge unless a request is excessive, and we will say so first. We may need to check who you are before we answer.

Some data we cannot delete on request, because keeping it is a legal obligation or because we need it to defend a legal claim — the payment ledger, acceptance records and withdrawal records. We will tell you which parts those are.

Automated decisions. You have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects for you. We make no such decisions. The AI features are tools you run on your own content; they produce text and images, not decisions about you.

13. Complaining

You can complain to us. Email chris@curatestudio.dev and say what the problem is. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome and what we are doing about it.

You can also complain to a regulator, at any time. You do not have to come to us first, and complaining to us does not affect that right.

• In the UK: the Information Commissioner's Office / Information Commission — ico.org.uk/make-a-complaint, or 0303 123 1113.
• In the EU or EEA: the supervisory authority where you live, where you work, or where the problem happened. Our Article 27 representative is TODO(legal): GDPR Art 27 EU representative name + address.

You can also go to court.

14. Children

Curate is not for children. You must be at least 18 to have an account, and we do not knowingly collect data about children. If you believe we hold data about a child, tell us at chris@curatestudio.dev and we will delete it.

15. Security

Data is encrypted in transit, and at rest by our database and file storage providers. Every request checks who you are and whether the thing you asked for belongs to you. Access to production systems is limited to those who need it. Figma tokens are stored only as hashes. Card details never reach us. No system is perfectly secure, so please tell us at chris@curatestudio.dev if you find a weakness.

16. Changes to this policy

When we change this policy we publish the new version here with a new version number and date, and keep the previous one at its archive URL. If a change materially affects how we use your data we will tell you by email before it takes effect. Because this is information rather than a contract, we do not ask you to agree to it — but where a change needs your consent, we will ask for that separately.