Privacy Policy

This Privacy Policy explains how CURVE Reports Inc. (“CURVE,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information through curvereports.com and related CURVE services. Those services include accounts, trials, subscriptions, building and unit pages, owner lists, reports, analytics, data tools, CURVE AI, Condo Docs AI, Social Studio, shared links, referrals, alerts, emails, APIs, embeds, support, and sales interactions (collectively, the “Service”).

This Policy applies to account holders, trial users, team administrators and members, people who receive or open CURVE shares or invitations, website visitors, business contacts, and people whose professional contact details we use for legitimate business outreach. It also explains our treatment of personal information found in property, deed, listing, assessor, and other source records.

A third-party website, public agency, payment provider, or other service has its own privacy practices. This Policy does not govern information that a third party controls independently, even when CURVE links to or receives data from it.

We collect information directly from you when you create an account, choose a plan, add a payment method through our processor, search or navigate, ask an AI question, save or share work, change settings, invite a teammate, join a referral, contact us, or otherwise use the Service.

We collect information automatically from browsers, devices, product events, cookies, authentication systems, email-delivery systems, security tools, and server logs. We may associate these events with an account, organization, shared link, campaign, device, or session.

We receive information from team administrators, people who share or refer others, payment and authentication providers, analytics and communications providers, public agencies, registries of deeds, assessor databases, licensed data sources, public websites, professional directories, brokerages, and other lawful sources.

Account and profile information may include your name, email address, email-verification state, organization, professional role, market, selected plan, signup source, referral or invitation attribution, selected buildings, preferences, onboarding progress, team membership, access state, and account metadata.

Subscription information may include plan, price identifier, trial and renewal dates, billing status, market entitlements, seat quantity, promotion or referral state, customer and subscription identifiers, failed-payment state, cancellation details, and billing-support history.

A payment processor collects and stores payment-card details. CURVE generally does not receive or store your full card number or security code. We may receive limited billing information such as card brand, last four digits, expiration, billing name or address, transaction identifiers, payment status, disputes, refunds, and fraud or authentication signals.

Communications may include support requests, sales conversations, feedback, survey responses, cancellation reasons, email replies, and any files or context you choose to provide. Please do not send passwords, full payment-card numbers, government identification numbers, or unnecessary sensitive information.

We collect product activity such as pages and buildings viewed, units opened, searches, filters, navigation paths, reports and modes used, owner-list interactions, analytics queries, Social Studio projects and exports, downloads, shares, favorites, follows, notification settings, feature use, first-view and onboarding events, timestamps, and session state.

When you use Social Studio, we process the buildings, units, sales, neighborhoods, formats, creative instructions, branding fields, and authorized identity images you select. CURVE may send selected public-record context, creative instructions, the CURVE wordmark, and any authorized logo or headshot to a business-service AI provider to generate or revise artwork, email copy, or email HTML. Drafts, generation history, identity images, provider request metadata, generated email content, and immutable exports are stored so you can resume, revise, duplicate, copy, or download your work. Uploaded and generated assets are stored privately and are disclosed publicly only when you download, export, copy, or share the resulting asset.

We use this information to deliver the requested workflow, restore context, rank or personalize relevant buildings and suggestions, measure adoption, improve navigation and performance, determine feature and plan eligibility, prevent abuse, and understand how the Service is used.

We may derive preferences, likely interests, account-health signals, and aggregate product metrics from activity. These inferences support CURVE experiences and customer operations; we do not use authenticated-product behavior to place third-party advertisements or build advertising profiles for sale.

When you use CURVE AI, Condo Docs AI, owner intelligence, or another AI-assisted feature, we process AI prompts, chat history, selected buildings or units, retrieved public-record evidence, document excerpts, prior messages, tool activity, citations, generated outputs, feedback, and technical usage such as model and token information.

We use this information to answer the request, preserve chat history, let you revisit or share work, ground responses in CURVE evidence, detect failures, control abuse and cost, evaluate answer quality, personalize useful suggestions, and improve CURVE’s own workflows. You can delete supported AI threads from the product. Some related security, billing, audit, or de-identified records may remain as described under Retention.

CURVE uses business-service AI providers to process the context needed to generate an answer. We do not sell private account content or permit it to be used for advertising, and we do not use private account content to train a general-purpose model made available to unrelated companies. Providers may process and temporarily retain inputs and outputs under their business terms to deliver the service, prevent abuse, and maintain security.

Do not include confidential, privileged, regulated, or sensitive personal information in a prompt or upload unless you are authorized to provide it and it is necessary for the workflow. AI systems can produce incorrect output; review the evidence and independently verify material facts.

When a user shares a report, unit, owner list, analysis, AI chat, condo-document workspace, master deed, or client update, we may process the sender’s identity, recipient name or email, subject being shared, message, share token, expiration, send status, delivery and open events, first-open time, and related attribution.

After a successful share, CURVE may keep share-recipient history for that sender so previously used email addresses can appear as suggestions in later share dialogs. Suggestions are scoped to the signed-in sender and exclude addresses recorded as suppressed where supported. A sender can ask us to remove recipient history by contacting info@curvereports.com.

A recipient may see the sender’s name and the content or context intentionally included in the share. The sender may see delivery or engagement information supported by the workflow. Anyone who obtains an active link may be able to view its contents, so senders and recipients should protect links from unintended distribution.

Referral and invitation data may include codes, inviter and invitee identifiers, click and signup attribution, subscription milestones, qualifying payments, reward status, and fraud or reversal signals. We use it to deliver invitations, attribute eligible signups, administer trial access, apply future billing extensions, prevent abuse, and communicate program status.

If you choose to connect Google, CURVE receives your Google account identifier, email address, granted permissions, and an OAuth credential that lets CURVE perform only the actions you authorize. We encrypt the credential at rest. The Google Workspace connector may send a Gmail message that you compose and explicitly approve in CURVE; it cannot read, search, draft, label, archive, delete, or otherwise manage your Gmail mailbox. The connector may also list and manage calendars and events; create secondary calendars; edit calendar properties and subscriptions; grant, change, or revoke calendar sharing permissions; permanently delete an owned secondary calendar after typed confirmation; and create or update Google Docs, Sheets, and Drive files created or uploaded through CURVE. CURVE does not permanently delete a primary calendar. A Curve AI email or calendar preview is encrypted while it awaits your confirmation, expires after 20 minutes, and is cleared when completed or cancelled; its content is not written to the Workspace activity ledger.

Google content is fetched on demand to display or complete the action you requested. Before an email send, calendar write or deletion, or file write, CURVE shows an action preview and requires confirmation. CURVE does not build a permanent copy of your mailbox, calendars, or Drive. We retain minimized action metadata—such as action type, time, success or failure, and an irreversible target representation—for security, troubleshooting, abuse prevention, and user-visible history. We do not place email bodies, recipient addresses, document contents, or calendar descriptions in that activity ledger.

Google user data received through Google APIs is isolated from CURVE’s AI-assisted features. CURVE does not send Gmail, Google Calendar, Google Drive, or Google Docs and Sheets content—or Google OAuth credentials—to OpenAI or any other AI or machine-learning provider, gateway, aggregator, or model hub. No AI-assisted CURVE feature accepts Google API user data as model input. CURVE does not use or transfer Google user data for advertising, sale, model training or improvement, lending or credit decisions, or human review except where necessary to provide or secure the connected service, comply with law, or act at the user’s direction. CURVE’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Google in Account Settings. CURVE immediately blocks the credential from active use, requests revocation from Google, and deletes the stored credential once Google confirms revocation. If Google is temporarily unreachable, CURVE retains the encrypted credential only so you can retry revocation; Workspace actions remain blocked. You can also delete or change content directly in Google. Disconnecting does not delete emails already sent, recipient-controlled copies, Google files or events you chose to create, security or audit records that must be retained, or information Google independently controls.

If you choose to connect Microsoft 365, CURVE receives your Microsoft account identifier, email address, granted permissions, and an encrypted OAuth credential. The connector may read, search, draft, send, and manage Outlook messages; list and manage calendars and events; and create or update Word, Excel, and OneDrive files. When you explicitly ask Curve AI to analyze Outlook, Calendar, or OneDrive, CURVE sends only the matching content needed for that request to OpenAI to produce your answer. Connected source content is fetched on demand and is not written to CURVE's tool-run logs; the resulting answer remains in your Curve AI chat until you delete the chat. OpenAI API data is not used to train OpenAI models unless CURVE affirmatively opts in, and CURVE does not opt in; under OpenAI's default API data controls, request content may be retained in abuse-monitoring logs for up to 30 days. Email sending and calendar creation require a separate exact preview and confirmation; the preview is encrypted, expires after 20 minutes, and is cleared when completed or cancelled. Disconnecting immediately blocks CURVE and deletes its stored Microsoft credential; it does not delete emails, files, or events you previously chose to create.

CURVE compiles real estate information from public records and other lawful sources. It may include owner names, entity names, property and mailing addresses, unit identifiers, deed parties, transaction dates and amounts, mortgage references, recording information, assessor facts, listing history, listing participants, professional roles, brokerage information, and source links.

We may collect professional contact information for brokers, agents, and other real estate professionals from public websites, directories, brokerages, listings, licensed sources, or direct interactions. This may include name, business email, telephone number, brokerage, role, license-related identifiers, source evidence, verification state, and prior outreach history.

We use professional contact data for data-quality work, relationship management, and relevant business outreach concerning a listing, closing, building, report, or CURVE service. We may record send, delivery, bounce, unsubscribe, reply, email opens, and link-click events to operate the communication, honor suppression, measure relevance, and protect sender reputation.

Public and source records can be inaccurate or change. A correction or privacy request does not necessarily require CURVE to remove an accurate public record, professional business record, or information we must retain, but we will evaluate requests under applicable law and may correct CURVE’s matching or presentation when appropriate.

Technical information may include IP address, approximate location inferred from IP, browser, device type, operating system, referring and destination URLs, cookie and session identifiers, request and response metadata, performance timing, error details, authentication events, and security telemetry.

We use first-party cookies and similar technologies to authenticate users, protect sessions, remember settings, route users through signup and billing, maintain shared-link state, measure product and website performance, and prevent fraud or misuse. Blocking necessary cookies may prevent the authenticated Service from working.

We may use measurement providers for website and product analytics. CURVE does not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use authenticated-product behavior to target ads on unrelated services.

We use personal information to provide, personalize, maintain, and support the Service; create and secure accounts; authenticate users; process subscriptions and team seats; deliver reports and shares; preserve work; administer trials, promotions, and referrals; and respond to requests.

We also use it to retrieve and improve data, run analytics and AI features, monitor availability, debug errors, test changes, develop features, forecast capacity, understand engagement, and communicate product, account, billing, security, and service information.

We process information to detect credential sharing, fraud, spam, prohibited automation, payment abuse, security threats, and violations; enforce agreements; protect users and CURVE; comply with law; establish or defend legal claims; and maintain records.

Where applicable law requires a legal basis, we rely on performance of a contract, compliance with law, legitimate interests, protection of rights and security, and consent. You may withdraw consent where applicable, but withdrawal does not affect prior lawful processing and may make a dependent feature unavailable.

We disclose information to service providers that help with cloud hosting, databases, authentication, security, payment processing, email delivery, analytics, support, AI inference, document processing, data operations, and other functions. They receive only information reasonably needed for their role and are subject to contractual or legal obligations appropriate to the service.

We disclose information within a team or organization as needed to administer membership, access, plan, billing, invitations, and security. A team administrator may receive information about member status or use that is reasonably necessary to operate the team.

We disclose information to a recipient or sender when you intentionally use a share, invitation, referral, or collaboration workflow. We may disclose information at your direction, with your consent, or when you connect a third-party integration.

We may disclose information to courts, regulators, law enforcement, public authorities, counterparties, or advisers when we reasonably believe disclosure is required by law or necessary to enforce agreements, investigate misuse, protect rights or safety, collect amounts owed, or establish or defend a legal claim.

We may disclose information in connection with a financing, audit, insurance review, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to customary confidentiality protections where appropriate. We may use and disclose aggregated or de-identified information that does not reasonably identify a person.

CURVE does not sell personal information for money. CURVE does not share personal information for cross-context behavioral advertising and does not use authenticated-product activity to let third parties target advertising to you across unrelated services.

A disclosure to an operational service provider, a team administrator, a recipient you choose, or as part of a corporate transaction is not a sale for money. Referral benefits and promotional access are offered for eligible program activity, not in exchange for permission to sell personal information.

If our practices change in a way that creates a legal right to opt out, we will update this Policy and provide the required control before engaging in that practice.

We send service communications such as verification, password reset, login, security, payment, subscription, team, trial, referral, report-share, requested alert, support, and important administrative messages. Some are necessary to provide the Service and may continue even if you opt out of marketing.

We may send product news, onboarding, reengagement, and relevant professional outreach where permitted by law. You can use an unsubscribe link or contact info@curvereports.com to stop non-essential commercial email. Account settings may also control supported daily-sale, favorite-building, and other notifications.

We maintain suppression records so we can honor opt-outs, bounces, complaints, and recipient-level restrictions. Suppression may require retaining an email address or irreversible representation of it rather than deleting it completely.

We retain personal information only as long as reasonably necessary for the purpose collected, including providing the Service, preserving user-requested work, maintaining security, honoring preferences and suppressions, supporting billing, meeting legal and accounting duties, resolving disputes, enforcing agreements, and protecting CURVE and its users.

Retention depends on the record. Account and team information generally remains while the account or relationship is active and for a reasonable period afterward. AI chats, Social Studio drafts and source images, saved work, and share-recipient history may remain until deleted through an available control, the account is deleted, or the information is no longer needed. Completed Social Studio exports may remain available in immutable history until the related project or account is deleted. Billing, transaction, consent, dispute, security, and audit records may be retained longer where required or reasonably necessary.

Deletion from active systems may not immediately remove encrypted backups, immutable logs, delivered emails, files already downloaded by others, or records another party controls. We isolate or age out backup data through ordinary cycles. Aggregated or de-identified information may be retained and used without a fixed period where permitted by law.

CURVE uses administrative, technical, and organizational safeguards designed for the nature of the information and our operations. Measures include encrypted transport, managed infrastructure, authentication, server-side authorization, access controls, audit and security logging, provider review, and operational monitoring.

No website, transmission, database, model provider, email system, or storage service is completely secure. CURVE cannot guarantee that information will never be accessed, lost, altered, or disclosed without authorization. You are responsible for securing your email account and devices, protecting credentials and share links, and notifying info@curvereports.com promptly if you suspect unauthorized access.

Depending on where you live and the law that applies, you may have rights to access, correct, delete, or obtain a portable copy of personal information; learn the categories of information, sources, purposes, and recipients; restrict or object to processing; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; and limit certain uses of sensitive information.

You may also have the right to use an authorized agent, appeal our decision, and receive equal service, including a right to non-discrimination for exercising a privacy right. These rights are subject to definitions, exceptions, verification rules, and applicability thresholds in the relevant law. We will not ask you to waive a non-waivable statutory right.

Submit a request to info@curvereports.com with the subject “Privacy Request.” State the right you want to exercise and identify the account, email, shared link, professional record, or other information involved. Do not send government identification unless we specifically request an appropriate verification method.

We will verify requests in a manner proportionate to the information and risk. An authorized agent may need to provide proof of authority, and we may confirm the request directly with you. If we deny a request, you may appeal by replying with the subject “Privacy Appeal.” You may also contact the regulator available in your jurisdiction.

CURVE is a professional service for adults and is not directed to anyone under 18. We do not knowingly collect personal information online from children under 13. If you believe a child has provided personal information through the Service, contact info@curvereports.com so we can investigate and take appropriate action.

CURVE is operated from the United States. Information may be processed in the United States and other locations where our service providers operate. Those places may have data-protection laws different from the laws where you live.

If applicable law requires a transfer mechanism or additional contractual protection, we will use an appropriate mechanism for the relevant processing. By using the Service from another country, you understand that information will be processed as described in this Policy.

We may update this Policy as the Service, data sources, vendors, laws, or business operations change. We will post the updated Policy here and revise the date above. If a change materially affects how we use previously collected personal information, we will provide additional notice or obtain consent when required by law.

Questions, privacy requests, data corrections, and complaints may be sent to CURVE Reports Inc. at info@curvereports.com. Include enough detail for us to locate and understand the request, but do not send passwords, full payment-card numbers, government identification numbers, or unnecessary sensitive information.