Privacy Policy

1. Who we are and our role

BlueCurve Corp, 28 Geary St STE 650, San Francisco, California 94108, United States. Contact us about privacy at [email protected] or at this postal address.

BlueCurve is the controller of personal information used for its own website, inquiries, business contacts, account administration, billing and security purposes, to the extent we determine why and how that information is processed.

When an organization provides information for BlueCurve to process on its behalf, that organization generally determines the purposes of processing and BlueCurve acts as its processor or service provider. This includes personal information in connected sources, uploaded files and customer-directed workflows. That processing is governed by the applicable customer agreement, customer instructions and any required data processing agreement. The organization's privacy notice explains its own use of that information.

2. Information we process

• Contact and business information: name, work email, phone number, company, website, country and postal or billing address, where provided or needed for onboarding, contracting or billing.
• Correspondence: messages, inquiries, waitlist or evaluation requests, support communications, feedback and submission dates.
• Account and access information: user and organization identifiers, authentication information, roles, permissions, identity-provider attributes, account status and access records.
• Commercial and usage records: subscriptions, service consumption, invoices, tax information, transaction records and payment-provider references, where applicable. Payment processing, when enabled, is handled by the provider identified in your transaction or billing documentation. Do not send full payment-card details through our contact or support forms.
• Technical information: IP address, browser and device information, pages and referring URLs, timestamps, interactions, diagnostic information, and security, audit and operational records.
• Customer content and derived information: connected documents and database records, images, audio and video, extracted text, transcripts, metadata, search indexes and embeddings, prompts, conversations, attachments, generated outputs, research results, customer-specific contextual memory and retained knowledge. These may contain personal information about people other than the user.

Information comes from you, your organization and its authorized users, connected systems and identity providers, enabled integrations, and automatic collection when you use our website or services. Research features may also obtain information from public websites, market-information sources and research services. We derive additional information when we extract, classify, search, summarize or analyze content.

We do not request sensitive personal information through our public contact form. Do not submit health information, payment-card data or other specially regulated information unless the relevant service and contractual protections have been expressly agreed for that use. Without information necessary to handle a request or provide a feature, we may be unable to do so.

3. How we use information

• Respond to inquiries, manage requested waitlist and evaluation communications, onboard organizations, and provide support and service notices.
• Administer accounts, authenticate users and services, enforce permissions, and manage subscriptions, usage and billing.
• Provide enabled search, document extraction, transcription, AI assistance, research, insight generation and customer-directed agent workflows.
• Maintain customer-specific conversation context, feedback and reusable knowledge for continuity and the customer's subsequent searches and insights.
• Operate, troubleshoot and improve the website and service; detect abuse and fraud; and protect confidentiality, availability and security.
• Meet legal obligations, manage disputes and enforce applicable agreements.

Where these activities involve customer content processed on an organization's behalf, we act under its instructions and applicable agreement. We do not use personal information for targeted advertising or remarketing.

4. Legal bases where EU or UK GDPR applies

For processing where BlueCurve is the controller, we rely on the legal basis appropriate to the purpose:

• Legitimate interests: responding to business contacts, administering relationships with organizational customers, providing support, maintaining reliable services and protecting against abuse, subject to the required balancing of individual rights.
• Contract: processing necessary to perform a contract with you, or take steps you request before entering one, where you are personally a party to that contract.
• Legal obligations: processing required by applicable accounting, tax, regulatory or other law.
• Consent: processing for which consent is required, including non-exempt analytics technologies under applicable law. Consent can be withdrawn without affecting the lawfulness of earlier processing.

For customer content processed on behalf of an organization, the organization is responsible for identifying its applicable legal bases and instructions.

5. AI, research and retained knowledge

Depending on enabled features, AI processing can use document excerpts, metadata, images, audio, transcripts, retrieved evidence, user messages and original attachments to generate search representations, summaries, responses, insights and derived knowledge. Configured AI, OCR, transcription and research services receive the content or queries needed to perform those functions. Processing may use models hosted within the customer deployment or third-party model services, depending on the agreed configuration.

Conversation history, agent state, customer-specific contextual memory, feedback and knowledge records can persist beyond an individual request. Creating embeddings or retaining this context is distinct from training the underlying AI model. Provider retention and any use of content for model training or improvement depend on the provider terms applicable to the deployment. Contact us for the providers and data-use terms applicable to your service before submitting content that requires particular restrictions.

Customer organizations determine how to use generated outputs and configure customer-directed workflows and review requirements. Questions about an organization's decisions or the use of its information should be directed to that organization; we assist where required by our role and applicable law.

6. Cookies and website services

Our website uses Google Analytics to understand visits and interactions. Analytics can process browser and device information, pages, referring URLs, interaction events and cookie identifiers. Google also processes network information to deliver the service; its treatment of IP addresses depends on the applicable Analytics processing rules. See Google's Privacy Policy, Google's Analytics privacy information and the Google Analytics opt-out add-on.

We use Cloudflare for website delivery and security, Cloudflare Turnstile to distinguish people from automated abuse, and Cloudflare Web Analytics for website performance and usage information. These services can receive technical information such as IP address, browser signals and request details. See Cloudflare's Privacy Policy and its Turnstile Privacy Addendum. Third-party content delivery and font services, including jsDelivr and Google Fonts, also receive the request information needed to deliver their resources.

Necessary technologies support security and requested functionality. Non-exempt analytics require consent where applicable law requires it; browser controls and the Google opt-out add-on do not replace that requirement. You can also control cookies through your browser settings, although blocking necessary technologies may affect functionality. Contact us about privacy choices at [email protected].

7. Disclosures and recipients

We do not sell personal information or share it for cross-context behavioral advertising. We disclose information as needed to:

• Service providers: website delivery, hosting, storage, security, analytics, communications, customer relationship management, identity, payment and billing services, and configured AI and research providers. Some software is operated within our infrastructure; using a software product does not necessarily involve transferring information to its vendor.
• Your organization and enabled integrations: authorized users and administrators, connected systems and tools to which information is sent under customer instructions and access settings.
• Professional advisers and legal recipients: where necessary for advice, compliance with law or valid legal process, legal claims, or protection of rights and security.
• Business successors: where necessary in a proposed or completed merger, acquisition, financing or asset transfer, subject to appropriate confidentiality and data-protection requirements.

Recipients act as processors, service providers or independent controllers depending on their function and applicable terms. Contact us for information about the providers and subprocessors relevant to your customer deployment.

8. Retention and deletion

Retention depends on the type of information, purpose, applicable customer instructions and service settings, legal requirements and any legal hold. We assess contact and inquiry records against the status of the request and business relationship; account records against account administration and security needs; billing records against accounting and legal requirements; and operational records against troubleshooting, security and audit needs.

Customer source content, extracted files, indexes, conversations, stored responses and retained knowledge can have different retention rules. Deleting one source or ending a conversation does not necessarily remove its derived records, agent memory or backups at the same time. Applicable retention settings, return or deletion arrangements, and backup schedules are addressed for the customer deployment.

Deletion may require coordinated removal from active systems, derived stores, connected services and backups. Backup expiry and required legal retention can delay final removal. We do not promise immediate deletion from every system or backup. Contact us to request deletion or information about the retention and deletion arrangements applicable to your data.

9. Security

We use administrative, technical and organizational safeguards appropriate to the processing, including access controls, authorization, separation of customer data, encryption, protected credentials and operational monitoring. Controls depend on the deployment and service involved. No transmission or storage method is completely secure.

10. Processing locations and international transfers

BlueCurve is based in the United States. Website providers and enabled service providers may process information in the United States or other countries. Customer-platform locations depend on the agreed deployment, connected services and model providers; the website address does not establish where a customer's content is stored or processed.

Where an international transfer requires safeguards under applicable law, the relevant arrangement must use an available lawful mechanism, such as an applicable adequacy decision, EU Standard Contractual Clauses and, for UK transfers where appropriate, the UK Addendum or IDTA. Contact us for the countries, transfer mechanism and a copy or description of the safeguards applicable to your information.

11. Your privacy rights

Depending on applicable law, you may request access to or a copy of personal information, correction, deletion, restriction of processing or portability. Where EU or UK GDPR applies, you may withdraw consent and complain to the relevant supervisory authority, including the UK Information Commissioner's Office.

Right to object: where processing is based on legitimate interests, you may object based on your particular circumstances. You may object to processing for direct marketing at any time.

Where the California Consumer Privacy Act, as amended, applies, California residents may request disclosure of the categories and specific pieces of personal information collected about them, its sources, purposes and recipients; correction; and deletion, subject to legal exceptions. Applicable rights also include opting out of sale or sharing for cross-context behavioral advertising, limiting certain uses or disclosures of sensitive personal information, and receiving equal treatment for exercising privacy rights. We do not sell or share information for that advertising purpose.

Submit requests to [email protected], through our contact form, or by post to the address above. We may need proportionate information to verify an access, correction or deletion request; do not send passwords or payment-card details. Authorized agents may submit requests where the law permits, subject to appropriate authorization checks. We do not require identity verification for a sale or sharing opt-out.

We respond within applicable legal periods. EU and UK GDPR requests are generally handled within one month, subject to permitted extensions. Applicable California access, correction and deletion requests are generally acknowledged within 10 business days and answered within 45 calendar days, with a further 45-day extension where permitted and explained. We explain applicable exceptions or refusals and available complaint options.

If your request concerns information processed on behalf of an organizational customer, contact that organization first. We help the organization respond in accordance with applicable law and its instructions, and direct requests to it where appropriate.

12. Browser signals and children

Our website does not currently respond to legacy Do Not Track signals. Global Privacy Control is a separate signal for opting out of sale or sharing where applicable law requires recognition; we do not engage in sale or sharing for cross-context behavioral advertising.

Our website and enterprise services are intended for business use and are not directed to children under 13. We do not knowingly solicit personal information directly from children under 13. If you believe a child has submitted information, contact us. Information about children in customer-provided records is subject to the customer's instructions and the separate customer-content arrangements described above.

13. Changes and contact

We post updates on this page and revise the date above. For material changes, we provide additional notice where required and obtain new consent where the law requires it. An update does not remove your statutory rights or itself provide consent to new processing.

For questions or requests, email [email protected] or write to BlueCurve Corp at the address in section 1.