Privacy Policy

1. Who we are

Curious360 builds AI-powered decision intelligence platforms for enterprises, operates the Curious360 App Marketplace, and provides scheduling software at meet.curious360.io. In this policy, "Curious360", "we", "us" and "our" mean Curious360 and its affiliates.

If you have any question about this policy or how we handle your data, contact us at connect@curious360.io.

2. Our role: controller and processor

Our responsibilities differ depending on whose data is involved.

• We are a controller for data about visitors to our websites, people who contact us, marketplace customers, and users who create their own Curious360 accounts — including scheduling accounts at meet.curious360.io. This policy governs that data.
• We are a processor for the business data an enterprise customer loads into a platform we host or build for them. That customer decides what is collected and why; we act on their documented instructions under our agreement with them. If you are an employee or contact of such a customer, please direct privacy requests to that organisation.

3. Information we collect

Information you give us

• Account data — name, email address, profile photo, job title, time zone, and the URL slug you choose for a public scheduling page.
• Contact and enquiry data — anything you send when requesting a demo, emailing us, or completing a form.
• Marketplace order data — billing contact details, the packages purchased, and deployment or support correspondence. Card details are handled by our payment provider and are never stored on our systems.
• Scheduling data — for hosts: availability hours, event types and meeting preferences. For invitees who book a meeting: name, email address, chosen time, time zone, any guests added, and anything written in the notes or answers to a host's questions.

Information we collect automatically

• Usage data — pages viewed, features used, approximate timestamps and referring page.
• Device and connection data — IP address, browser type, operating system and language.
• Security and abuse data — request rates and related signals used to rate-limit public booking pages and block abuse.

Information from third parties

• Sign-in providers — if you sign in with Google or Microsoft, we receive your name, email address, profile picture and a stable account identifier.
• Connected calendars — if you choose to connect a calendar, we receive the data described in section 4.

4. Google user data

This section explains exactly what we do with data obtained through Google APIs. It applies only if you sign in with Google or connect a Google Calendar account.

Signing in

When you create an account with Google we request only your basic profile and email address (openid, email, profile). We do not request access to your calendar, your Gmail, your files or your contacts in order to sign you in.

Connecting a calendar

Calendar access is requested separately, later, and only if you choose to connect a calendar. You can use our scheduling service without ever granting it. When you do connect one, we request the narrowest permissions that make the feature work:

What we access	Why
Free/busy times on the calendars you select	To hide times you are already busy, so invitees cannot double-book you. We read when you are busy — we do not need, and do not use, the titles, descriptions, attendees or contents of those events.
Create, update and delete calendar events	To place a confirmed booking on your calendar, add the invitee, generate a video conferencing link, and update or remove that event if the meeting is rescheduled or cancelled.
Your list of calendars	So you can choose which calendars are checked for conflicts and which one new meetings are added to.

We do not request permission to permanently delete entire calendars, and we only modify events that our service created — with the sole exception of reading availability, we do not alter your existing entries.

Limited Use commitment

Curious360's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we confirm that we do not:

• sell, rent or trade Google user data;
• use Google user data for advertising, profiling or marketing of any kind;
• use Google user data to train, fine-tune or improve generalised artificial intelligence or machine learning models;
• allow humans to read Google user data, except with your explicit consent for a specific issue you have raised, where required by law, or where strictly necessary for security purposes such as investigating abuse — and always on data that has been aggregated or anonymised where possible;
• transfer Google user data to third parties, other than the infrastructure providers listed in section 7 who process it on our behalf and under contract, or where required by law.

Storage, retention and revoking access

• Access and refresh tokens are encrypted at rest and are never exposed to your browser or to any other user.
• Free/busy information is used to calculate availability at the moment it is requested and is cached only briefly. We do not build a copy of your calendar.
• You can disconnect a calendar at any time in your Curious360 settings, which deletes the stored tokens immediately.
• You can independently revoke our access at any time at myaccount.google.com/permissions.
• Deleting your Curious360 account deletes the associated tokens and connection records.

Where you connect a Microsoft account instead, we apply the same principles and the equivalent minimum permissions under Microsoft's terms.

5. How we use information

• To provide, operate and maintain our services, including calculating availability and confirming bookings.
• To create and administer accounts and authenticate users.
• To send service communications — booking confirmations, reschedules, cancellations, reminders, security alerts and important changes to our services. These are not marketing and cannot be turned off while you hold an account.
• To fulfil marketplace orders and provide deployment and support assistance.
• To respond to enquiries and provide customer support.
• To secure our services — detecting, preventing and investigating abuse, fraud and technical faults.
• To understand aggregate usage so we can improve our products.
• To comply with legal obligations and enforce our agreements.
• To send marketing communications, only where you have asked to receive them or where permitted by law. Every marketing email contains an unsubscribe link.

6. Legal bases

Where data protection law requires a legal basis, we rely on the following: performance of a contract (operating an account, delivering a booking or an order); legitimate interests (securing our services, preventing abuse, understanding aggregate usage, and business communications with organisations — balanced against your rights); consent (connecting a calendar, non-essential cookies, marketing email — withdrawable at any time); and legal obligation (tax, accounting and lawful requests).

7. Sharing and subprocessors

We do not sell personal data. We share it only in these circumstances:

• Service providers acting on our behalf, under contract and only as needed to run our services — cloud hosting and infrastructure, database and storage services, email delivery, payment processing, and error monitoring.
• Calendar and conferencing providers you connect — Google or Microsoft — to read availability and create meetings you have asked us to create.
• The other party to a meeting. When a booking is made, the host sees the invitee's name, email address, chosen time and any notes; the invitee sees the host's name and meeting details. This is the purpose of the service.
• Professional advisers such as lawyers and accountants, where necessary.
• Legal and safety — where required by law, court order or regulator, or to establish, exercise or defend legal claims.
• Business transfers — if we are involved in a merger, acquisition or sale of assets, data may transfer to the acquirer under this policy's protections. We will notify you.

8. International transfers

We and our service providers may process data in countries other than your own. Where we transfer personal data across borders, we put appropriate safeguards in place — such as Standard Contractual Clauses or an adequacy decision — so that your data continues to receive an equivalent level of protection. You can request details of these safeguards using the contact address below.

9. Retention

We keep personal data only as long as we need it:

• Account data — for as long as your account is active, then deleted or anonymised within a reasonable period after closure.
• Booking records — retained while the account is active so both parties have a record of meetings, then removed with the account.
• OAuth tokens — deleted immediately when you disconnect an integration or delete your account.
• Marketplace and billing records — retained for the period required by tax and accounting law.
• Support correspondence — retained for a reasonable period for quality and dispute purposes.
• Security logs — retained for a short period appropriate to detecting and investigating abuse.

10. Security

We take technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS) and encryption at rest for credentials and OAuth tokens; access controls and least-privilege administration; tenant isolation so one customer's data is not accessible to another; rate limiting and abuse protection on public endpoints; and regular backups.

No system is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where the law requires it.

11. Your rights

Depending on where you live, you may have the right to access a copy of your data; correct inaccurate data; delete your data; restrict or object to processing; receive your data in a portable format; withdraw consent at any time; and, where applicable, nominate someone to exercise these rights on your behalf. We do not use your data for automated decision-making that produces legal or similarly significant effects about you.

To exercise any of these, email connect@curious360.io. We will respond within the period required by applicable law. We may need to verify your identity first. We will not discriminate against you for exercising a right.

If you are unhappy with our response, you may complain to your local data protection authority.

12. Cookies

We use a small number of cookies and similar technologies. Strictly necessary cookies keep you signed in, secure your session and protect against cross-site request forgery; these cannot be disabled without breaking the service. Preference storage remembers choices such as your time zone or theme. Where we use analytics or any non-essential cookie, we will ask for your consent first where the law requires it.

Most browsers let you block or delete cookies, though doing so may stop parts of our services working.

13. AI and machine learning

Our platforms use analytics, automation and generative AI to produce insights for enterprise customers. Where a feature sends data to a third-party AI model provider, we do so under agreements that prohibit the provider from using that data to train their models.

We do not use personal data obtained from connected Google or Microsoft accounts to train AI or machine learning models. Enterprise customer data is used only to serve that customer, in line with our agreement with them.

14. Children

Our services are business tools intended for adults and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

15. Changes to this policy

We may update this policy as our services evolve. We will change the "last updated" date above, and for material changes we will give prominent notice — by email or an in-product notice — before the change takes effect where practicable.

16. Contact us

For any question, request or complaint about privacy — including to exercise the rights in section 11 — contact us at connect@curious360.io. This mailbox is monitored, and it is the fastest route to a response.