Privacy Policy

This Privacy Policy describes how CurvUp Limited (together with its affiliated companies "CurvUp", "we", "our", or "us") collects, stores, uses, and discloses the following categories of personal data:

This Privacy Policy specifically describes our practices regarding the topics listed below. If you are a Customer, User, Prospect, or Expert & Partner, please read this Privacy Policy carefully.

Any capitalised but undefined term in this Privacy Policy shall have the meaning given to it in our Terms of Service.

1. Data Collection & Processing

When we use the term "personal data" in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or anonymised information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

We collect or generate the following categories of personal data in relation to the Services:

Usage and Device Information (Users, Prospects & Experts/Partners)

Connectivity, technical and usage data, such as IP addresses and approximate general locations derived from such IP addresses, device and application data (such as type, operating system, mobile device or app ID, browser version, location and language settings), user-customised IDs where personal data is included, activity logs, cookies and pixels installed or utilised on your device, and recorded activity (sessions, clicks, use of features, logged activities, and other interactions) of Prospects, Users, and Experts & Partners in connection with our Services. We collect and generate this information automatically, including through the use of analytics tools.

Contact and Profile Information (Customers, Users, Prospects & Experts/Partners)

Name, email address, phone number, position, workplace, business name, business stage, industry, profile picture, login credentials, contractual and billing details, and any other information submitted when signing up or logging in to the Platform (either directly or through a social media or Single-Sign-On account), when creating a User Profile, or by updating an account. We collect this information directly from you, from our Customers (your employer or organisation), from other Users and colleagues related to your organisational CurvUp account, from organisers of events or promotions that both you and we were involved in, and through tools and channels commonly used for connecting between companies and individual professionals.

Business Profile Information (Entrepreneurs, Mentors, Service Providers & Investors)

As a multi-sided platform, CurvUp collects additional business-specific data depending on your role on the platform, including: for entrepreneurs, business name, stage (Ideation, Seed & Development, Start-Up, Established & Growing), industry, country of operation, business goals, and funding status; for mentors and coaches areas of expertise, professional credentials, session availability, and rates; for service providers, service categories, portfolio, pricing, and availability; for investors, investment focus, ticket size, portfolio information, and investment stage preferences. This information is used to power matching, recommendations, and CINA's AI-driven guidance features.

Communications with Customers, Users, Prospects & Experts/Partners

Personal data contained in any forms and enquiries you may submit to us, including support requests, interactions through social media channels and messaging apps, registrations to events we host, organise, or sponsor, and participation in our online and offline communities and activities; surveys, feedback and testimonials received; expressed, presumed, or identified needs, preferences, attributes and insights relevant to our potential or existing engagement; and sensory information including phone call and video conference recordings (e.g. with our customer experience or support staff), as well as written correspondences, screen recordings, screenshots, documentation, and related information that may be automatically recorded, tracked, transcribed, and analysed for analytics, quality control, training, and record-keeping purposes.

2. Data Uses & Legal Bases

We use personal data as necessary for the performance of our Services ("Performance of Contract"); to comply with our legal and contractual obligations ("Legal Obligations"); and to support our legitimate interests in maintaining and improving our Services, understanding how our Services are used, marketing and selling our Services, providing customer support, and protecting and securing our Users, Customers, Prospects, and Experts & Partners ("Legitimate Interests").

If you reside or use the Services in a territory governed by privacy laws under which "consent" is the only or most appropriate legal basis for processing personal data as described in this Privacy Policy ("Consent"), your acceptance of our Terms and of this Privacy Policy will be deemed as your consent to the processing of your personal data for all purposes detailed herein, unless applicable law requires a different form of consent. If you wish to revoke such consent, please contact us at [email protected].

Specifically, we use personal data for the following purposes:

Customer and User Personal Data

• To facilitate, operate, enhance, secure, and provide our Services; (Performance of Contract; Legitimate Interests)
• To invoice and process payments; (Performance of Contract; Legitimate Interests)
• To personalise our Services, including recognising an individual and remembering their information when they return, and to provide localisation and personalisation capabilities; (Performance of Contract; Legitimate Interests)
• To power CINA, CurvUp's proprietary AI model, to provide intelligent business guidance, mentor and expert matching, funding readiness assessments, and stage-specific recommendations tailored to each user's profile and business stage; (Performance of Contract; Legitimate Interests)

Customer, User, Prospect & Expert/Partner Personal Data

• To provide assistance and support, test and monitor the Services, diagnose or fix technical issues, and to train our staff; (Performance of Contract; Legitimate Interests)
• To gain a better understanding of how Users, Prospects, and Experts & Partners evaluate, use, and interact with our Services, to continuously improve our Services, overall performance, user experience, and value generated therefrom; (Legitimate Interests)
• To create aggregated, statistical, inferred non-personal, anonymised, or pseudonymised data which we or others may use to provide and improve our respective Services or for business intelligence; (Legitimate Interests)
• To facilitate and optimise our marketing campaigns, ad management and sales operations, and to manage and deliver advertisements for our Services more effectively, including on other websites and applications; (Legitimate Interests; Consent)
• To contact our Customers, Users, Prospects and Experts & Partners with general or personalised Services-related messages, as well as promotional messages that may be of specific interest to them; (Performance of Contract; Legitimate Interests; Consent)
• To support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error, or any illegal or prohibited activity; (Performance of Contract; Legitimate Interests; Legal Obligation)
• To explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences, including through partnerships with local distributors, resellers, business partners, and providers of professional services; (Legitimate Interests)
• To facilitate, sponsor, and offer certain Events, masterclasses, masterminds, webinars, contests, and promotions; (Legitimate Interests)
• To publish your feedback and submissions to our Sites, public forums, and blogs; (Performance of Contract; Legitimate Interests)
• To comply with our contractual and legal obligations and requirements, and maintain our compliance with applicable laws, regulations, and standards; (Performance of Contract; Legitimate Interests; Legal Obligation)
• For any other lawful purpose, or other purpose that you consent to in connection with our Services. (Legal Obligation; Consent)

3. Data Location & Retention

3.1 Data Location

We and our authorised Service Providers maintain, store, and process personal data in the United Kingdom, the European Economic Area (EEA), the United States, and other locations as reasonably necessary for the proper performance and delivery of our Services, or as may be required by applicable law. CurvUp Limited is headquartered in the United Kingdom.

While privacy laws vary between jurisdictions, CurvUp, its affiliates, and Service Providers are each committed to protecting personal data in accordance with this Privacy Policy, customary and reasonable industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.

For data transfers from the UK and EEA to countries not considered to offer an adequate level of data protection, we and the relevant data exporters and importers have entered into Standard Contractual Clauses as approved by the UK Information Commissioner's Office (ICO) and the European Commission, as applicable. You can obtain a copy by contacting us at [email protected].

3.2 Data Retention

We may retain your personal data for as long as it is reasonably needed to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (e.g. as required by laws applicable to log-keeping, records, and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy and at our reasonable discretion.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of such data, the potential risk of harm from unauthorised use or disclosure of such data, the purposes for which we process it, and the applicable legal requirements. If you have any questions about our data retention policy, please contact us at [email protected].

4. Data Disclosure

We may disclose personal data in the following instances:

Service Providers

We engage selected third-party companies and individuals as "Service Providers" to perform services on our behalf or complementary to our own. These include providers of: hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection and prevention services, web and mobile analytics, email and communication distribution and monitoring services, session or activity recording services, call recording, analytics and transcription services, event production and hosting services, performance measurement, data optimisation and marketing services, social and advertising networks, content and data enrichment providers, video conferencing tools (as provided by Event Hosts), support and customer relationship management systems, and our legal, compliance, and financial advisors and auditors. Our Service Providers may only use the data as determined in our agreements with them.

Verified Experts, Mentors, Coaches & Service Providers

As a multi-sided platform, CurvUp may share relevant personal data between Customers and Users with Verified Experts, mentors, coaches, and service providers on the platform, to facilitate connections, matching, bookings, and the delivery of Expert Services. This includes sharing your name, contact details, business profile, and any other information you have provided on your CurvUp profile, to the extent necessary to facilitate your engagement with a Verified Expert. Any sharing of your data with a Verified Expert is subject to both this Privacy Policy and the Verified Expert's own privacy practices.

Investors

Where you are an entrepreneur seeking investment connections, or an investor browsing the platform, CurvUp may share relevant profile information (including business name, stage, industry, funding goals, and contact details for entrepreneurs, or investment focus and preferences for investors) to facilitate introductions and connections on the platform, subject to your settings and preferences.

Partners

We engage selected business and channel partners, resellers, distributors, and providers of professional services related to our Services. In such instances, we may disclose relevant contact, business, and usage details to the respective partner to allow them to engage with Customers and Users for such purposes. If you directly engage with any of our partners, please note that any aspect of that engagement which is not directly related to our Services and directed by CurvUp is beyond the scope of CurvUp's Terms and Privacy Policy, and may be governed by the partner's terms and privacy policy.

Event Hosts and Event Sponsors

If you register for any Event on the CurvUp platform (whether CurvUp-Hosted or Expert-Posted), we or the Event Host may share your registration details with the hosts, organisers, speakers, and sponsors of that event so that they may contact you with relevant information and offers, or to fulfil any promotions related to the event. Video conferencing links for Events are provided by individual Event Hosts using their own third-party tools (e.g. Zoom); CurvUp does not control or manage such tools.

Customers and Other Users

Your personal data may be disclosed to the Customer owning the Account to which you are subscribed as a User (including data and communications concerning your User Profile), as well as to other Users of that Account. Your personal data and activity within the Services may also be monitored, processed, and analysed by the Account Admin. Please note that CurvUp is not responsible for and does not control any further disclosure, use, or monitoring by or on behalf of the Customer, who itself acts as the "Data Controller" of such data (as further described in Section 9 below).

Feedback or Recommendations

If you submit a public review, rating, or feedback about a Verified Expert or any aspect of the CurvUp platform, note that we may store and present your review publicly on our Sites and Services. If you wish to remove your public review, please contact us at [email protected]. If you choose to send others an invitation to use the Services, we may use the contact information you provide us to automatically send such an invitation on your behalf.

Community & Public Forums

Our Sites may include public blogs, community forums, or social channels. Any information you submit on these forums — including profile information associated with the account you use to post — may be read, collected, and used by others who access these Sites. Your posts and certain profile information may remain visible to all even after you terminate your User Profile. To request removal of your information from publicly accessible Sites operated by us, please contact us at [email protected].

Legal Compliance

In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant, or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect the security or integrity of our products and Services.

Protecting Rights and Safety

We may disclose your personal data to others if we believe in good faith that this will help protect the rights, property, or safety of CurvUp, any of our Users or Customers, or any members of the general public.

CurvUp Subsidiaries & Corporate Transactions

We disclose personal data internally within our group of companies for the purposes described in this Privacy Policy. Should CurvUp or any of its subsidiaries undergo any change in control, including by means of merger, acquisition, or purchase of substantially all of its assets, your personal data may be disclosed with the parties involved in such an event. If we believe that such change in control might materially affect your personal data then stored with us, we will notify you of this event and the choices you may have via email or prominent notice on our Services.

5. Cookies and Tracking Technologies

Our Sites and Services (including some of our Service Providers) utilise "cookies", anonymous identifiers, pixels, container tags, and other technologies in order for us to provide and monitor our Services and Sites, to ensure that they perform properly, to analyse our performance and marketing activities, and to personalise your experience. Such cookies and similar files or tags may also be temporarily placed on your device. Certain cookies and other technologies serve to recall personal data, such as an IP address.

Please note that we do not change our practices in response to a "Do Not Track" signal in the HTTP header from a browser or mobile application; however, most browsers allow you to control cookies, including whether or not to accept them and how to remove them. You may set most browsers to notify you if you receive a cookie, or to block or remove cookies altogether. For more information about our use of cookies and how to manage your cookie preferences, please see our Cookie Policy available at curvup.io.

6. Communications

6.1 Services Communications

We may contact you with important information regarding our Services. For example, we may send you notifications (through any of the means available to us) of changes or updates to our Services, billing issues, log-in attempts or password reset notices, new connections or matches on the platform, Expert session reminders, Event enrolment confirmations, and other platform activity. You can control your communications and notifications settings from your User Profile settings, or otherwise in accordance with the instructions included in the communications sent to you. However, please note that you will not be able to opt out of receiving certain Services communications which are integral to your use (such as password resets or billing notices).

6.2 Promotional Communications

We may also notify you about new features, additional offerings, Events, masterclasses, masterminds, special opportunities, or any other information we think you will find valuable as a Customer, User, Prospect, or Expert & Partner. We may provide such notices through any of the contact means available to us (e.g. phone, mobile, or email), through the Services, or through our marketing campaigns on any other sites or platforms. If you do not wish to receive such promotional communications, you may notify CurvUp at any time by sending an email to [email protected], changing your communications preferences in your User Profile settings, or by following the "unsubscribe", "stop", "opt-out", or "change email preferences" instructions contained in the promotional communications you receive.

7. Data Security

In order to protect your personal data held with us, we use industry-standard physical, procedural, and technical security measures, including encryption as appropriate. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties as described in Section 4 above.

CurvUp implements reasonable security measures and procedures designed to assist in protecting your Customer Data. If you have any security concerns or wish to report a potential vulnerability, please contact us at [email protected].

8. Data Subject Rights

If you wish to exercise your privacy rights under applicable law — including the UK GDPR, EU GDPR, and the UK Data Protection Act 2018, such as (each to the extent applicable to you under the laws which apply to you):

• The right to know or request access to personal data collected about you, the categories of sources, the purpose of collection, and the categories of third parties with whom we have disclosed your data;
• The right to request rectification or erasure of your personal data held with CurvUp;
• The right to restrict or object to the processing of your personal data;
• The right to data portability, to obtain a copy of your personal data in a structured, commonly used, and machine-readable format;
• The right to withdraw consent at any time where processing is based on consent;
• The right not to be subject to solely automated decision-making, including profiling, that produces legal or similarly significant effects.

Please contact us at [email protected] to exercise any of the above rights. If you are a UK GDPR or EU GDPR-protected individual, you also have the right to lodge a complaint with the relevant supervisory authority, in the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

You may designate an authorised agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf. The authorised agent may submit a request to exercise these rights by emailing us at [email protected].

Please note that when you ask us to exercise any of your rights under this Privacy Policy or applicable law, we may need to verify your identity before we can act on your request. Such additional information will be retained by us for legal purposes in accordance with Section 3 above.

9. Data Controller / Processor

Certain data protection laws and regulations, such as the UK GDPR and EU GDPR, distinguish between two main roles for parties processing personal data: the "data controller", who determines the purposes and means of processing; and the "data processor", who processes such data on behalf of the data controller. Below we explain how these roles apply to our Services.

CurvUp as Data Controller

CurvUp Limited is the "data controller" of its Prospects', Users', Experts & Partners', and Customers' personal data, as detailed in Section 1 above. Accordingly, we assume the responsibilities of a data controller as set forth in this Privacy Policy.

CurvUp as Data Processor

CurvUp is the "data processor" of personal data contained in Customer Data, as submitted or otherwise collected by our Customers and their Users to their Account features and boards available via the Services. We process such data on behalf of our Customer (who is the "data controller" of such data) and in accordance with its reasonable instructions, subject to our Terms and our Data Processing Addendum with such Customer.

Customer Responsibilities

Our Customers are solely responsible for determining whether and how they wish to use our Services, and for ensuring that all individuals using the Services on the Customer's behalf, as well as all individuals whose personal data may be included in Customer Data processed through the Services, have been provided with adequate notice and given informed consent to the processing of their personal data where such consent is necessary or required, and that all legal requirements applicable to the collection, use, or other processing of data through our Services are fully met by the Customer. Our Customers are also responsible for handling data subject rights requests under applicable law.

If you would like to make any requests or queries regarding personal data we process as a data processor on our Customer's behalf, including accessing, correcting, or deleting your data, please contact the Customer's Account Admin directly.

10. CINA — CurvUp's Proprietary AI Model

CurvUp operates CINA (CurvUp Intelligence Navigation Assistant), our proprietary machine learning model purpose-built to serve users across the CurvUp platform. CINA processes certain personal data — including your business profile, stage, industry, goals, and platform activity — to deliver personalised recommendations, mentor and expert matching, funding readiness assessments, stage-specific business guidance, and intelligent navigation across the platform.

CINA does not make fully automated decisions that produce legal or similarly significant effects without human oversight.

You may contact us at [email protected] at any time to enquire about how CINA uses your personal data, to request access to such data, or to request that it not be used for personalisation purposes.

CurvUp may also integrate third-party AI model providers (such as OpenAI, Anthropic, Google Gemini, Groq, and Vercel AI SDK) to power specific features within the platform. Where such third-party AI providers process your data, this is governed by those providers' own privacy practices, in addition to this Privacy Policy. Please refer to our AI Acceptable Use Policy for further details on third-party AI providers and their applicable policies.

CurvUp may use anonymised and aggregated interaction data to continue training and improving CINA's accuracy and relevance, in accordance with this Privacy Policy. Such data is rendered non-personal before use for model improvement purposes.

11. Additional Notices

11.1 Updates and Amendments

We may update and amend this Privacy Policy from time to time by posting an amended version on our Services. The amended version will be effective as of the date it is published. When we make material changes to this Privacy Policy, we will give notice as appropriate under the circumstances, e.g. by displaying a prominent notice within the Services or by sending an email. Your continued use of the Services after the changes have been implemented will constitute your acceptance of the changes.

11.2 Third Party Websites and Services

Our Services include links to third-party websites and services, and integrations with Third Party Services as defined in the Terms. Such websites, services, and Third Party Services, and any information you process, submit, transmit, or otherwise use with or to such websites, services, and Third Party Services, are governed by such third party's terms and privacy practices and policies, and not by this Privacy Policy. We encourage you to carefully read the terms and privacy policies of such websites, services, and Third Party Services.

11.3 Third-Party Calendar & Scheduling Integrations

The CurvUp platform offers integrations with third-party calendar and scheduling tools, including Google Calendar, Microsoft Calendar (Outlook), and Calendly, to help Users manage Expert sessions, bookings, and Event schedules ("Calendar Integrations"). CurvUp may also integrate with additional calendar or scheduling tools in the future.

When you choose to connect a Calendar Integration to your CurvUp Account, you will be asked to grant permission (via that provider's own authorisation screen) for CurvUp to access certain data from your calendar account. Depending on the integration and the permissions you grant, this may include:

• Your calendar event details (such as event titles, times, dates, and attendee lists) for the purpose of checking availability and avoiding scheduling conflicts;
• The ability to create, update, or delete calendar events on your behalf, in order to reflect bookings, sessions, or Events made through CurvUp;
• Your basic profile information associated with the connected calendar account (such as your name and email address), to identify and link the integration to your CurvUp Account.

You may disconnect any Calendar Integration at any time through your CurvUp Account settings. Disconnecting an integration will stop CurvUp from accessing further data from that calendar account, but will not retroactively delete data already synced prior to disconnection unless you separately request deletion (see Section 8 above).

11.4 Google API Services User Data Policy

Where CurvUp's use of Google Calendar (or any other Google Workspace API) involves accessing, collecting, or otherwise processing data obtained through Google APIs ("Google User Data"), CurvUp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google User Data is not used to serve advertisements, and is not sold, transferred, or disclosed to third parties, except as necessary to provide or improve the specific Calendar Integration feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets (subject to confidentiality commitments and your continued rights under this Privacy Policy).

Google User Data is not used to train, develop, or improve any artificial intelligence or machine learning model, whether generalised or otherwise, including CINA. CINA does not have access to or use any Google User Data obtained through this integration.

Human review of Google User Data is restricted to instances reasonably necessary for security purposes (such as investigating abuse), to comply with applicable law, with your explicit consent, or as part of merger, acquisition, or similar transaction, in each case subject to appropriate confidentiality and access controls.

CurvUp retains Google User Data only for as long as necessary to provide the Calendar Integration feature you have enabled, or until you disconnect the integration or delete your Account, whichever is earlier, save where a longer retention period is required to comply with applicable law (see Section 3.2 above on Data Retention). You may revoke CurvUp's access to your Google Account at any time through your Google Account security settings (myaccount.google.com/permissions), in addition to disconnecting the integration within CurvUp.

11.5 Microsoft & Calendly Integrations

Where you connect a Microsoft Calendar or Microsoft Teams (Outlook) or Calendly integration to your CurvUp Account, CurvUp's access to and use of data obtained through such integrations is subject to the same principles set out in Section 11.4 above (limited to providing the requested scheduling feature, not used for advertising, not used to train AI models including CINA, and not sold or shared except as necessary to provide the feature or comply with law). Your use of Microsoft Calendar or Calendly is also subject to Microsoft's and Calendly's own respective terms of service and privacy policies, which we encourage you to review.

11.6 Video Conferencing Platforms & Integrations

The CurvUp platform offers direct integrations with third-party video conferencing platforms, including Microsoft Teams and Google Meet, to automatically generate, update, and manage video conferencing links for scheduled Expert sessions, bookings, and Events. CurvUp may also allow Event Hosts to manually provide links from other external platforms (such as Zoom).

When you utilize a direct video conferencing integration, CurvUp interacts with that provider's APIs solely to facilitate the creation and scheduling of the video meeting space. Your use of any third-party video conferencing platform remains subject to that specific platform's own terms of service and privacy policies.

For integrations involving Google Meet, all data accessed or processed adheres strictly to the Google API Services User Data Policy and the protections outlined in Section 11.4 above (including Limited Use restrictions, a strict prohibition on using data to train AI models like CINA, and a ban on selling or using data for advertising).

11.7 UK Representative & ICO Registration

CurvUp Limited is registered with the UK Information Commissioner's Office (ICO) as required under the UK Data Protection Act 2018 and UK GDPR. For enquiries relating to the processing of personal data of UK residents, please contact us at [email protected].

11.8 EU Representative

To the extent that CurvUp processes personal data of individuals in the European Economic Area (EEA) subject to the EU GDPR, CurvUp will designate an EU representative where required by Article 27 of the EU GDPR. For enquiries relating to the processing of personal data of EEA residents, please contact us at [email protected].

11.9 Accessibility

Upon request, this Privacy Policy can be made available in an accessible format. For more information, please contact [email protected].

11.10 Questions, Concerns & Complaints

If you have any comments or questions regarding our Privacy Policy or practices, any concerns regarding your personal data held with us, or if you wish to make a complaint about how your personal data is being processed by CurvUp, please contact us at: [email protected]