Privacy Policy

01Introduction

Cura is an AI-powered operational platform designed for businesses to automate customer engagement, bookings, communications, and payments.

We respect your privacy and are committed to protecting personal data processed through the Cura platform. This Privacy Policy explains how Cura Group Co., Ltd. (“Cura”, “we”, “our”, or “us”) collects, uses, discloses, and protects personal data, as well as the rights available to individuals whose data is processed.

Information privacy is an ongoing responsibility. We may update this Privacy Policy from time to time as our services, technology, or legal requirements evolve. Material changes will be communicated appropriately.

Unless otherwise agreed in writing:

• Clients (businesses using the Cura platform) act as the data controllers for personal data relating to their customers or end-users.
• Cura acts as a data processor or service provider, processing such data solely to provide the Cura services.

02Contacting Us About Data Protection

If you have questions, concerns, or requests regarding this Privacy Policy or the processing of personal data, please contact:

03How We Collect and Use Personal Information

Cura processes personal information relating to two primary groups:

• Clients (business owners or authorized users of the Cura platform)
• End-Users (customers or individuals interacting with Cura on behalf of a Client)

A. Information from Clients (Business Users)

Cura may collect the following information from Clients:

• Name, job title, and business name
• Work email address and phone number
• Account credentials and user preferences
• Billing and subscription information (processed via secure third-party payment providers)
• Operational content uploaded by the Client (e.g., service lists, FAQs, pricing, workflows, SOPs)

Purpose of use: To create and manage accounts, provide platform functionality, deliver customer support, process payments, and improve service reliability.

B. Information from End-Users (Customers of Clients)

When End-Users interact with Cura through supported channels (such as messaging apps, web chat, SMS, or voice), Cura may process information on behalf of the Client, including:

1. Communication and Interaction Data

• Messages, chat logs, transcripts, and voice recordings
• Images, documents, or files voluntarily submitted during interactions

2. Identity and Contact Data

• Phone numbers, usernames, or profile names provided by the communication platform
• System-generated identifiers related to bookings or conversations

3. Booking and Transaction Data

• Appointment details, service selections, booking history
• Payment or deposit status (payments handled by third-party providers)

4. Sensitive Personal Data (Optional and Contextual)

Depending on the Client's industry and use case, End-Users may voluntarily share information that could be considered sensitive personal data (e.g. age, personal circumstances, or service-related details). Cura does not require such data and processes it only as instructed by the Client.

C. How We Use This Information

Cura processes personal data solely to operate and improve its services, including to:

• Automate responses to inquiries
• Coordinate bookings and scheduling
• Send confirmations, reminders, and follow-ups
• Facilitate deposits or payments
• Maintain platform security, performance, and reliability

Cura does not sell personal data and does not use Client or End-User data to train open or generalized AI models.

D. Cura's Role, Data Visibility, and Limitations

• Cura is an operational automation platform, not a professional service provider in any specific industry.
• Cura does not provide advice, recommendations, or decisions that require professional judgment.
• Cura processes End-User data only on behalf of and under the instruction of the Client.
• Access to personal data is restricted to authorized systems and personnel strictly for operational, support, security, and compliance purposes.
• Cura does not intentionally review End-User content unless required for system operation, troubleshooting, abuse prevention, or legal obligations.

Clients remain responsible for:

• Determining what data is collected from End-Users
• Ensuring appropriate notices and consents are provided
• Complying with applicable industry-specific regulations

04Use of Third-Party Integrations

Cura integrates with third-party services to provide core functionality, such as:

• Messaging platforms (e.g. WhatsApp, LINE, social platforms)
• Calendar and scheduling tools (e.g. Google Calendar)
• Payment processors
• Voice and telephony providers

Data shared with these services is limited to what is necessary to deliver the requested functionality and is governed by the respective third party's privacy policies.

Data obtained through third-party APIs is used solely to provide the relevant service features and is not used to train generalized AI models.

05Google User Data (Google Calendar)

If a member of a Client's team connects a Google Account to Cura's Google Calendar integration, this section explains what Google user data Cura accesses, how it is used, how it is protected, and how it is retained and deleted. It applies in addition to the rest of this policy. Where it differs from another part of this policy on Google user data, this section prevails.

A. What we access

Cura requests only the permissions it needs, and does not request full access to your calendars:

• The list of your calendars (name and identifier), so you can choose which calendars Cura checks and which calendar receives bookings.
• Your availability (busy and free times), so Cura can tell when a booking overlaps an existing commitment.
• Events on your calendars. Cura creates, updates and deletes the booking events it writes to the calendar you choose, and reads events on the calendars you select in order to detect overlaps.
• The email address of the connected Google Account, so Cura can show which account is connected.

B. How we use it

We use this data only to provide the scheduling features you turn on in Cura: letting you choose calendars, writing and keeping up to date the booking events Cura creates, and alerting your team when a booking overlaps an existing event. The events Cura writes contain the booking's service name, the customer's name, the provider's name and the appointment time.

C. What we store

Cura stores the authorization tokens issued by Google, the email address of the connected account, the identifiers and names of the calendars you select, and a flag on a booking when an overlap is detected. Cura does not store the contents of the events on your calendar (their titles, descriptions or attendees). Those are read only temporarily, to work out busy times and detect overlaps. Authorization tokens are never sent to your browser.

D. Limited Use

Cura's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data, or transfer it, to develop, improve or train generalized artificial intelligence or machine learning models. Google Calendar data is not used by Cura's AI features.
• Cura personnel do not read Google user data, except with your consent, where necessary for security purposes or to investigate abuse, to comply with applicable law, or in aggregated and anonymized form for internal operations.
• We do not transfer Google user data to third parties except as needed to provide the features described above, to comply with applicable law, or as part of a merger, acquisition or sale of assets after you are notified.

E. Service providers

Google user data is held in the database that Cura's platform runs on, provided by our cloud infrastructure provider, who processes it on our behalf. Operational alerts sent to our internal team may mention that a scheduling conflict was detected for a booking, but never the contents of your calendar events.

F. Retention, deletion and revoking access

We keep the records described above while your connection is active. You can disconnect at any time in Cura under Booking, Settings: Cura then revokes its access at Google and deletes the stored authorization tokens. To make reconnecting easy, the names of the calendars you selected and the connected account's email address are kept, and events Cura already created remain in your Google Calendar until you delete them. You can also remove Cura's access at any time from your Google Account under Third-party apps & services. To have all Google-derived data we hold about you deleted, email support@cura.so and we will act on your request within 30 days.

06Facebook and Messenger Data

If a Client connects a Facebook Page to Cura, this section explains what Facebook data Cura receives and how it can be deleted. It applies in addition to the rest of this policy.

A. What we receive

• The Page ID, the Page name, and an access token that lets Cura send and receive messages for that Page.
• The messages and comments sent to the Page, including text and attachments, the sender's Page-scoped ID, and the name and profile picture that Facebook provides.

B. How we use it

We use this data to provide the Client's messaging service: showing conversations to the Client's team, sending replies they approve, and keeping the records the Client chooses to keep in Cura.

C. Deletion

A Client can disconnect the Page in Cura and remove Cura's access in Facebook settings. Anyone who messaged or commented on a connected Page can ask us to delete their data. Step-by-step instructions are at cura.so/data-deletion.

07Data Protection Measures

Cura implements appropriate technical and organizational safeguards to protect personal data, including:

• Encryption: Data encrypted in transit and at rest using industry-standard practices
• Access Controls: Role-based and purpose-limited access to systems and data
• Data Minimization: Processing only data reasonably necessary to deliver services
• Logical Segregation: Client data is logically separated to prevent cross-access
• Security Monitoring: Measures to detect, prevent, and respond to misuse or unauthorized access

No system can be guaranteed to be 100% secure, but Cura takes reasonable steps to protect personal data from loss, misuse, or unauthorized access.

08Sharing Information with Third Parties

Cura may share personal data with third parties only as necessary to operate the platform, including:

• Cloud infrastructure and hosting providers
• Messaging, voice, and communication platforms
• Payment processors
• Analytics and monitoring providers

These third parties are contractually restricted from using personal data for purposes beyond providing their services to Cura.

We may also disclose personal data where required to:

• Comply with legal or regulatory obligations
• Enforce our rights or agreements
• Protect the safety, rights, or property of users or others

09Data Storage and Retention

Cura retains personal data for as long as necessary to provide services to the Client and for a reasonable period thereafter for operational continuity, dispute resolution, or legal compliance.

Upon verified request, personal data may be deleted or anonymized, subject to legal, contractual, or regulatory retention requirements.

10International Data Transfers

Personal data may be processed and stored in countries outside your country of residence, including Thailand, Singapore, and the United States.

Where required, Cura applies appropriate safeguards to protect personal data during international transfers in accordance with applicable data protection laws.

11Data Subject Rights

Depending on your jurisdiction, you may have rights including:

• The right to be informed
• The right to access your personal data
• The right to correct inaccurate data
• The right to request deletion
• The right to object to or restrict processing

Requests may be submitted to support@cura.so. We may need to verify identity before fulfilling requests.

12Children's Data

Cura's services are not directed at children. We do not knowingly collect personal data from children without appropriate consent. If such data is identified, it will be deleted promptly.

13Consent and Acceptance

By accessing or using Cura's services, Clients confirm that they have obtained all necessary rights, permissions, and consents to process End-User data through the platform.

End-Users acknowledge that their interactions may be processed by automated systems on behalf of the Client in accordance with this Privacy Policy and the applicable Terms of Service.

14Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates will be reflected by revising the effective date and, where appropriate, notifying Clients through the platform or other reasonable means.

15Questions or Complaints

If you have questions, concerns, or complaints regarding this Privacy Policy or Cura's data practices, please contact: