Privacy Policy

Last updated 7 October 2026

Curtex is a place where a team keeps its written knowledge and works on it with AI. This policy explains what we collect when you use it, where that information is kept, who else handles it, and what you can ask us to do with it.

Curtex is operated by Noughts & Crosses Ltd, a company registered in England and Wales. We are the data controller for your account information and for how the service itself is run. For the content your organisation puts into Curtex, your organisation is the controller and we process it on their instructions.

Questions and requests go to [email protected].

What we collect

Account information

You sign in with Google or Apple. We receive your name, email address and, where the provider offers one, your profile picture. We do not receive or store your password. We keep a record of which accounts and workspaces you belong to and the settings you choose.

Content

Everything you put into Curtex: documents, lists, spreadsheets, presentations, chats with the AI and with colleagues, comments, uploaded files, and the files you import. Content belongs to the account it is created in and is visible to the people that account's permissions allow.

Usage and billing records

For each AI request we record which model answered, how many tokens it used, what it cost, which account and feature it was for, which provider served the request and the region the request was routed through. These records are what your account's billing and audit views are built from.

Technical information

Our web server logs record the IP address, browser and pages requested, as web servers do. We use these for security and for diagnosing faults, and keep them for a limited period. We do not run analytics or advertising trackers.

Optional channels

If you pair a phone number for WhatsApp notifications we store that number and the messages exchanged on it. If you use a voice feature (dictation, reading aloud or a live voice conversation) the audio is sent to Google for transcription or speech as described below; we keep the text, not the audio.

Cookies

Curtex sets a session cookie that keeps you signed in, and a small number of short-lived cookies that remember where to send you after sign-in or that you signed out on purpose. They are all needed for the service to work. There are no analytics, advertising or third-party cookies.

How we use it

• To run the service: store your content, show it to the right people, and sync it to the apps and connectors you choose.
• To answer AI requests: the content a request needs is sent to an AI model provider to produce the reply.
• To bill accounts for their usage and to let account owners see what was used.
• To keep the service secure, investigate abuse and fix faults.
• To reply when you contact us.

Under UK data protection law our bases for this are the contract with you or your organisation, our legitimate interest in running a secure and reliable service, and, for optional channels such as WhatsApp, your consent.

We do not train AI models on your content, and we do not allow our providers to. We do not sell personal information and we do not use it for advertising.

AI providers

Text requests go through OpenRouter, a US company, which forwards each request to the host running the model you chose. On every request we instruct the host not to retain or train on the data. Account owners can go further in Account settings → Privacy:

• Retention tiers limit requests to hosts that keep nothing, or to hosts whose retention period is stated and short.
• Allowed geographies restrict which countries' models and hosts an account may use.
• Where OpenRouter can serve a model from its EU endpoint we use that endpoint.

For each reply we record which host served it and which region OpenRouter routed it through, so an account owner can see where a request was sent.

Voice features use Google's Gemini services directly rather than through OpenRouter. Audio and the text around it are sent to Google to produce the transcription or the speech. If an account has Zero Data Retention switched on and our Google project has not yet been approved for it, Curtex asks before a voice feature runs and refuses if you decline.

Where your data is kept

The service runs on Hetzner servers in Helsinki, Finland, inside the European Economic Area. Encrypted backups are taken hourly to Backblaze in the EU. Search is done on our own servers and nothing is sent to a third-party search index.

Transfers from the UK to the EEA rely on the UK adequacy regulations. Transfers to providers in the United States (OpenRouter and the model hosts it routes to, Google, Apple for sign-in, Cloudflare for network services, and Meta if you use WhatsApp) rely on those providers' standard contractual clauses with the UK addendum, or on the UK-US data bridge where the provider is certified under it.

Who else handles it

Beyond these we share personal information only when the law requires it, or to the people and connectors you have chosen to share with (see below).

Sharing you control

• Colleagues. Content is visible to the members of the account and workspace it lives in, according to the permissions set by that account's owners and admins.
• Share links. A public share link can be opened by anyone who has it. A private one can be opened by anyone in the owning account.
• Connectors and the API. When you connect an AI client (Claude, ChatGPT, Cursor and others) or create an API key, that client reads exactly what you can read, as you. What that client then does with the content is governed by its own provider's terms.
• External tools. If an account connects outside tools, the content needed for a request is sent to that tool.

How long we keep it

• Content and account information are kept while the account is open.
• Deleting a document, chat or account removes it from view immediately. The data is erased from our live systems by an automated job after 30 days.
• Backups are kept for up to 12 months, after which erased data is gone from them too. Backups are only ever used to restore service.
• A minimal record of a closed account (its name, dates and billing totals) is kept for accounting purposes for as long as tax law requires.
• Server logs are kept for a short period and then discarded.

Security

Access to our servers is by SSH key only. Secrets for connected services are sealed with a server-side key. Backups are encrypted before they leave our servers and the backup store is append-only, so a compromised server cannot delete them. Permissions inside Curtex are enforced on the server for every read. For security review and auditing information, ask us.

Your rights

You can ask us for a copy of your personal information, to correct it, to erase it, to restrict or object to how we use it, or to receive it in a portable form. Your content is stored as Markdown and can be exported from Curtex at any time. Where we act as processor for your organisation, we will pass your request to them.

Write to [email protected]. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Curtex is a service for organisations and is not intended for anyone under 18.

Changes

When this policy changes we will update the date at the top. If a change materially reduces your rights or widens what we do with your information, we will tell account owners before it takes effect.