This policy explains how Numeris Digital Limited (“Numeris”, “we”, “us”) uses personal data for Curo: this website, our website editor and hosting, and Curo AI. We’re a company registered in England and Wales (number 17263183), registered office 52 High Street, Pinner, HA5 5PW. Questions about privacy: support@curocms.com.
1. Two roles
- We’re the controller of the data in this policy: about our customers, the people they invite to Curo, and visitors to curocms.com.
- We’re a processor for personal data in our customers’ websites, such as messages their visitors send through a site’s forms. Each customer is the controller of that data, and their own privacy policy covers it. We handle it only on their instructions, as set out in our Terms.
2. What we collect
- Account details: your name, email address and role, and those of the people you invite to your site’s team.
- Billing details: your business name, billing address, VAT number if you give one, and your plan. Card details go straight to our payment provider, Stripe. We never see or store them.
- Your use of Curo: sign-ins, the changes made to your site and who made them (kept as your site’s activity history), what you ask Curo AI, and the credits used.
- Messages: anything you send us, such as support emails.
- Technical data: IP addresses and browser details in our servers’ logs, used for security and to fix problems.
3. Why we use it, and our lawful basis
- To provide Curo (your account, your site, Curo AI, support): to carry out our contract with you.
- To bill you and keep accounting records: our contract with you, and our legal obligations.
- To keep Curo secure, prevent misuse and improve the service: our legitimate interests in running a safe, reliable product.
- To tell you about changes to Curo, your plan or these policies: our contract with you. We only send marketing emails if you’ve agreed to them, and you can stop them at any time.
4. Who we share it with
We don’t sell personal data. We share it only with the providers that help us run Curo, under contracts that require them to protect it:
- Freethought (hosting, in the UK): your website, Curo and its data.
- Stripe (payments): billing details and card payments.
- Postmark (email): the emails Curo sends, such as team invites and sign-in links.
- Anthropic (Curo AI): the text of your requests and the relevant parts of your site, to carry them out. Their terms don’t allow them to use it to train their models.
- fal.ai (AI pictures, on plans that include them): the description of the picture you ask for.
We may also share data where the law requires it, or to protect our rights or someone’s safety.
5. International transfers
Your website and Curo are hosted in the UK. Some of our providers process data in the United States or elsewhere. When they do, we rely on the UK’s adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement, so your data has the same protection.
6. How long we keep it
- Account and site data: while you subscribe, then 30 days for you to ask for a copy, after which it’s deleted. Backup copies are deleted within a further 30 days.
- Billing records: six years, as UK tax law requires.
- Server logs: up to 90 days.
- Support messages: up to two years after your last contact.
7. Keeping it safe
We protect data with encryption in transit (HTTPS), encrypted secrets, strong password hashing and two-step sign-in for Numeris staff. Access is limited to the people who need it. We tell you, and the Information Commissioner’s Office where the law requires, without undue delay if a breach affects your data.
8. Cookies
- This website (curocms.com) doesn’t use tracking or advertising cookies. It remembers your light or dark mode choice in your browser, and that stays on your device.
- Curo’s editor uses strictly necessary cookies to keep you signed in and protect your account. They’re essential, so they don’t need your consent.
9. Your rights
You can ask us to:
- give you a copy of your personal data
- correct it, or delete it
- limit or object to how we use it
- move it to another provider
Email support@curocms.com and we’ll reply within a month. Data in a customer’s website (such as a form message) belongs to that customer: we’ll pass your request on to them. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
10. Changes to this policy
We may update this policy. If a change is significant, we’ll tell our customers by email before it applies. The date at the top shows when it last changed.