Privacy Policy

En bref : Tes données financières sont chiffrées au repos et en transit. Elles ne sont jamais vendues ni partagées. Tu peux exporter ou supprimer ton compte à tout moment.

Effective Date: April 22, 2025
Contact Email: support@cura.tax
Domain: https://cura.tax

CURA ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our services at cura.tax.

1. What Data We Collect

We collect the following types of data when you use CURA:

• Account Data: Email address, display name, optional avatar image. No passwords are stored.
• Communication Data: Email messages we send for verification, updates, or newsletters.
• Uploaded Files: Invoices, receipts and any other files that you upload, which may contain sensitive personal or financial information.
• Session Metadata: IP address, browser type, and timestamps for session security.
• Service Usage Data: Metadata related to your activity within the platform (e.g. number of uploaded files, AI tokens usage).

2. How We Use Your Data

We use your data to:

• Create and manage your CURA account
• Store and analyze your uploaded files
• Improve your financial organization through AI-powered insights
• Communicate with you about your account and service updates
• Comply with legal obligations

3. AI-Powered Processing

We use external AI services — including OpenAI, Google (Gemini) and Mistral — to:

• Extract and interpret information from invoices using OCR
• Analyze financial data for better user insights

By using CURA, you consent to the transfer of relevant data to these third-party providers for the purpose of processing. These providers operate under appropriate data protection agreements in compliance with PIPEDA (Canada) and applicable privacy laws.

4. Cookies and Tracking

CURA does not use tracking cookies or third-party analytics. We only collect aggregate access logs and usage statistics via Cloudflare for infrastructure performance and security.

5. Data Storage and Security

• Files are stored via Supabase Storage, with servers located in Canada and the United States.
• Files and personal data are encrypted at rest (AES-256) and in transit (TLS).
• Access to personal data is limited to authorized team members for debugging or support purposes only.

While we apply industry-standard security practices, no system is completely immune to breaches. We notify affected users promptly in the event of a data incident.

6. Legal Basis for Processing

We process personal data based on:

• Your consent, which you grant when you create an account or upload data
• Our contractual obligations to provide the services you signed up for

You can withdraw consent at any time by deleting your account or contacting us directly.

7. Data Retention

We retain your data:

• As long as your account remains active
• Until you request deletion

Once deleted, your data is removed from our systems, though some residual logs may remain for a short time due to backups or operational needs.

8. Tes droits (PIPEDA, Loi 25 du Québec)

As a user, you have the right to:

• Access and review your personal data
• Correct or update inaccurate information
• Download a full backup of your data
• Request permanent deletion of your account and associated data
• Object to certain forms of processing
• Lodge a complaint with a data protection authority

To exercise your rights, contact us at support@cura.tax or use the self-service account deletion at Settings → Danger Zone → Supprimer mon compte.

Conformément à la Loi 25 du Québec :

• Responsable de la protection des renseignements personnels : support@cura.tax
• Notification d'incident : En cas d'incident de confidentialité présentant un risque sérieux de préjudice, nous vous notifierons dans les 72 heures et en informerons la Commission d'accès à l'information (CAI) du Québec.
• Plaintes : Vous pouvez déposer une plainte auprès de la Commission d'accès à l'information (CAI) du Québec.

9. Billing and Refunds

CURA offers a 14-day satisfaction guarantee. If you cancel your subscription within 14 days of your initial purchase, you will receive a full refund automatically. Renewals and subsequent billing periods are non-refundable. Billing is handled by Stripe and no payment card data is stored on CURA servers.

10. Children's Privacy

CURA is not intended for users under the age of 18. We do not knowingly collect or store data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated "Effective Date." We encourage you to review the policy periodically.