Privacy Policy
Effective Date: [April 1, 2025] | Last Updated: [June 1, 2026]
Thank you for choosing Curiescious. At Curiescious (“we”, “our”, or “us”), operated by Curiescious Labs, we are deeply committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Curiescious platform and related services (collectively, the “Service”).
Curiescious is an AI-powered research assistant designed for scientists, academics, and life sciences researchers. We understand that the data you work with, including unpublished hypotheses, proprietary datasets, and sensitive research material, demands the highest standard of care. This policy reflects that commitment.
By creating an account or using the Service, you consent to the practices described in this policy. If you do not agree with any part of this policy, please discontinue use of the Service immediately.
1. Information we collect
We collect information that you provide directly, information generated through your use of the Service, and certain technical information collected automatically.
(a) Information you provide to us
Account information. When you register for a Curiescious account, we collect your name, email address, and password. Passwords are stored in cryptographically hashed form; we never store plaintext passwords.
Profile information. You may optionally provide your institutional affiliation, role, department, and research area. This information is used to personalize your experience.
Communications. If you contact us for support, provide feedback, or respond to surveys, we collect the content of those communications.
(b) Information collected automatically
When you access or use the Service, we automatically collect certain technical information, including:
Device and browser data. IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
Usage data. Pages visited, features used, session duration, timestamps, clickstream data, and referring URLs.
Log data. Server logs that record requests made to our systems, used for security monitoring, debugging, and performance analysis.
This information does not, on its own, reveal your specific identity but may be associated with your account for operational purposes.
2. How we use your information
We process your personal information for the following purposes, each grounded in a legitimate legal basis (contractual necessity, legitimate interest, consent, or legal obligation):
To provide the Service. Processing your queries, analysing uploaded documents, generating AI responses, and maintaining your conversation history.
To manage your account. Authenticating your identity, managing sessions, and administering your subscription.
To communicate with you. Sending transactional emails (account verification, password reset, billing receipts), responding to support requests, and with your consent, sharing product updates or newsletters. You may opt out of non-essential communications at any time.
To improve the Service. Analysing aggregate, de-identified usage patterns to understand how the Service is used and to identify areas for improvement. We do not use your individual research data or queries for this purpose.
To ensure security. Detecting, investigating, and preventing security incidents, fraud, abuse, or violations of our terms.
To comply with law. Meeting our legal, regulatory, and tax obligations.
Important: We do not use your data for advertising, behavioural profiling, or any purpose unrelated to operating and improving the Service.
3. AI-specific data practices
Because Curiescious is an AI-powered product that handles sensitive research data, we want to be especially transparent about how your information interacts with AI systems.
We do not use your research queries, uploaded documents, conversation history, or any other user-submitted content to train, fine-tune, or improve any AI or machine learning model, ours or any third party’s. Your data is yours.
How your data is processed by AI infrastructure
To power the AI features of Curiescious, your queries and uploaded content are sent to third-party AI infrastructure providers solely to generate a response to your request. These providers:
Act as data processors under our contractual agreements and process your data only as instructed by Curiescious.
Are contractually prohibited from using your inputs, outputs, or any derived data for their own model training, product improvement, or any independent purpose.
Do not retain your content beyond the time required to generate a response, except where legally required for safety and abuse prevention.
We carefully select AI infrastructure providers that offer enterprise-grade data processing terms, including zero-data-retention or equivalent commitments where available.
What this means for your research
Your unpublished hypotheses, proprietary datasets, and draft manuscripts are not used to improve AI systems for other users or companies.
Each session is treated as confidential. The AI does not “learn” from your interactions to serve other users.
We log queries and responses in association with your account solely for the purposes of providing conversation history, debugging, and investigating misuse, never for model training.
We recommend exercising caution before uploading data subject to specific non-disclosure agreements, material transfer agreements, unless you have independently verified compliance requirements. If you have questions about whether specific data types are appropriate to upload, contact us at privacy@curiescious.com.
4. How we share your information
We do not sell, rent, lease, or trade your personal information. We share data only in the following limited, necessary circumstances:
AI infrastructure providers. As described in Section 3, to process your queries and generate responses. These providers act under strict data processing agreements.
Cloud hosting and infrastructure. Your account data and files are stored on secure cloud infrastructure providers that operate under data processing agreements consistent with this policy.
Analytics providers. We use Google Analytics to understand aggregate usage patterns. Google Analytics collects anonymized interaction data (pages visited, session duration, general location) using cookies. Google Analytics does not have access to your research queries, uploaded documents, or conversation history. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout) or by adjusting your cookie preferences.
Payment processors. If you subscribe to a paid plan, billing is handled by a PCI-DSS compliant payment processor. We do not store your credit card number or payment credentials on our servers.
Legal and regulatory requirements. We may disclose information if required by law, regulation, court order, subpoena, or governmental request, or to protect the rights, safety, and property of Curiescious, our users, or the public.
Corporate transactions. In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.
Any third party that receives your data is bound by contractual obligations consistent with this policy and applicable data protection laws.
5. Cookies and tracking technologies
We use cookies and similar technologies to operate and improve the Service. A cookie is a small data file placed on your device that helps us recognize you and remember your preferences.
Types of cookies we use
Strictly necessary cookies. Required for authentication, session management, and core platform functionality. These cannot be disabled without breaking the Service.
Analytics cookies. We use Google Analytics to collect anonymized, aggregate data about how the Service is used, such as pages visited, session duration, and general geographic region. Google Analytics uses cookies to distinguish unique users. No personally identifiable information or research content is shared with Google. You can opt out by installing the Google Analytics Opt-out Browser Add-on or adjusting your browser settings.
Functional cookies. Used to remember your preferences (e.g., display settings, language) across sessions.
We do not use advertising cookies, retargeting cookies, or any third-party tracking cookies for marketing purposes.
Managing cookies
You can control non-essential cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling essential cookies will prevent you from using the Service. For more information about cookies generally, visit www.allaboutcookies.org.
Do Not Track
Some browsers transmit “Do Not Track” (DNT) signals. There is currently no industry-wide standard for how companies should respond to DNT signals. We do not currently alter our data collection practices in response to DNT signals, but we will continue to monitor developments in this area.
6. Data security
We implement industry-standard technical and organizational measures to protect your personal information:
Access to production systems and user data is restricted to authorised personnel on a need-to-know basis, protected by multi-factor authentication.
We conduct periodic security reviews, vulnerability assessments, and penetration testing.
We maintain incident response procedures and will notify affected users and relevant authorities in the event of a data breach, in accordance with applicable law.
No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. We do not recommend using the Service to store or transmit financial information (such as credit card numbers), government-issued identification numbers, or protected health information (PHI) unless specific compliance arrangements have been made.
7. Data retention
We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law.
Account data. Retained for the duration of your active account. Upon account deletion, we will delete or anonymize your personal information within a reasonable period, except where retention is required for legal, tax, audit, or compliance purposes.
Research queries and conversation history. Retained while your account is active. You may delete individual conversations at any time from within the platform.
Uploaded documents. Stored only for the duration necessary to process your request, or until you explicitly delete them. Documents saved to your account persist until you delete them or close your account.
Technical and log data. Retained for a limited period necessary for security monitoring, debugging, and regulatory compliance.
Backup archives. If deletion is not immediately possible due to backup retention schedules, we will securely isolate your data from further processing until deletion is completed.
To request deletion of your account and all associated data, contact us at privacy@curiescious.com or use the account deletion feature in your account settings.
8. International data transfers
Curiescious serves researchers globally. Your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States and other jurisdictions where our infrastructure providers operate.
9. Your privacy rights
Depending on your location, you may have the following rights regarding your personal information:
For all users
Access. Request a copy of the personal information we hold about you.
Correction. Ask us to correct inaccurate or incomplete personal information.
Deletion. Request deletion of your personal information (“right to be forgotten”), subject to certain legal exceptions.
Objection. Object to certain types of processing, including direct marketing.
Restriction. Request that we restrict processing of your data in certain circumstances.
Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
For European Economic Area (EEA) and UK residents
Under the General Data Protection Regulation (GDPR), the lawful bases for our processing of your personal information include: (i) performance of our contract with you; (ii) our legitimate business interests (such as maintaining the security of the Service); (iii) your consent; and (iv) compliance with legal obligations. We do not use automated decision-making, including profiling, in a way that produces legal effects concerning you.
For California residents
Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. We do not sell, and do not have actual knowledge of any sale of, the personal information of minors under 16 years of age.
For Indian residents
Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have rights to access, correct, and erase your personal data, and to nominate a representative to exercise these rights. We process your data based on your consent or for legitimate uses as defined under the Act. You may withdraw consent at any time by contacting us.
To exercise any of these rights, please contact us at privacy@curiescious.com. We will respond to all valid requests within 30 days (or the applicable statutory period). We may need to verify your identity before processing your request.
10. Third-party links and services
The Service may contain links to third-party websites, tools, or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites. We encourage you to review the privacy policy of every site you visit. This policy applies only to information collected through the Curiescious Service.
11. Children’s privacy
The Service is not directed to individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will take reasonable steps to delete that information promptly. If you believe we have collected information from a minor, please contact us immediately at privacy@curiescious.com.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:
Update the “Last Updated” date at the top of this policy.
Provide prominent notice via email or an in-platform notification before the changes take effect.
Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.
13. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Curiescious Labs
Pune, Maharashtra, India
Email: privacy@curiescious.com
Website: https://curiescious.com
We aim to respond to all privacy-related enquiries within 30 days.