Privacy Policy

For purposes of this Policy, "Personal Data" means any information that identifies or relates to a particular individual, and includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules, or regulations.

Cura is a business-to-business platform used by venture capital firms, accelerators, and corporate venture groups. As part of providing the Services, Cura processes Personal Data about individuals who are not direct users of the Services — including founders, portfolio company employees, and other individuals referenced in customer data sources or in publicly available information. This Policy describes how that data is handled.

Cura is designed to ingest data from sources you choose to connect or upload — including email, calendars, documents, notes, messaging tools, CRM systems, and public web sources. We refer to this data as "Customer Content."

Customer Content belongs to you (or to your organization, as applicable). We process Customer Content on your behalf to provide the Services. We do not use Customer Content for our own purposes beyond providing and improving the Services for you, and we do not sell Customer Content.

Where Customer Content contains Personal Data about individuals (including individuals who are not Cura users, such as founders or portfolio company employees), we process that data as a processor on your behalf. You, as our customer, are responsible for ensuring that you have the appropriate legal basis to share that data with Cura and for honoring data subject rights with respect to that data. We process this data in accordance with applicable data protection laws and our contractual commitments to customers.

Cura uses large language models and other AI techniques to provide its features. When you use the Services, Customer Content and other inputs may be sent to our AI sub-processors (currently OpenAI and Anthropic) for processing in transit.

Customer Content is not used to train AI models. Inputs and outputs sent through our AI sub-processors' APIs are not used to train their models. We also do not use Customer Content to train our own models, and we do not use Customer Content to train shared machine learning models across customers.

AI processing is performed only to provide the Services requested by the customer. Customer Content is processed in tenant-isolated workflows and is not co-mingled across customers for model training or fine-tuning purposes.

We may use aggregated, de-identified, or anonymized data derived from Service usage to improve the Services, provided that such data does not identify you, your organization, or any individual.

We seek to protect your Personal Data from unauthorized access, use, and disclosure using appropriate physical, technical, organizational, and administrative security measures based on the type of Personal Data and how we are processing it. Our security practices include encryption of data in transit and at rest, access controls, and ongoing monitoring. You can learn more at cura.inc/security.

You should also help protect your data by selecting and protecting your password appropriately, limiting access to your computer or device, and signing off after you have finished accessing your account. Although we work to protect the security of your account and data, please be aware that no method of transmitting data over the internet or storing data is completely secure.

We retain Personal Data about you for as long as you have an open account with us or as otherwise necessary to provide you with our Services. Upon termination of an account, Customer Content is deleted from active production systems within 30 days, with residual copies removed from encrypted backups in accordance with our backup rotation schedule (typically within 90 days). In some cases we retain Personal Data for longer if doing so is necessary to comply with our legal obligations, resolve disputes, collect fees owed, or as otherwise permitted or required by applicable law. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

Cura is operated from the United States. If you access or use the Services from outside the United States, your Personal Data may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

For transfers from the European Economic Area, the United Kingdom, and Switzerland to the United States, we rely on appropriate safeguards including Standard Contractual Clauses approved by the European Commission and the UK's International Data Transfer Agreement, as applicable.

By using the Services, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions that may have different data protection laws than your country of residence.

If you are a resident of the European Union ("EU"), the European Economic Area, the United Kingdom, Liechtenstein, Norway, Iceland, or Switzerland, you may have additional rights under the EU General Data Protection Regulation (the "GDPR") or the UK GDPR with respect to your Personal Data, as outlined below.

For this section, we use the terms "Personal Data" and "processing" as they are defined in the GDPR. Cura is the controller of Personal Data we process about you in connection with your account and use of the Services. Where we process Personal Data on behalf of our customers (for example, Customer Content), our customers are the controllers and Cura is the processor. If we are the processor of your Personal Data, please contact the controller (typically the Cura customer whose workspace contains your data) in the first instance.

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data, or your choices and rights regarding such collection and use, please contact us at privacy@cura.inc.

If you have a disability and need this Privacy Policy in an alternative format, contact privacy@cura.inc.