Privacy policy

Controller

The controller is the publisher of CuriaVia, identified in the legal notice. For any question or to exercise your rights, use the contact form, topic “Personal data and GDPR rights”.

Principles

• Your family’s data is used only to run the service you use.
• No advertising, no sale of personal data.
• AI suggestions are reviewed by you; no decision with legal effects is taken automatically.
• Data is hosted in the European Union; exceptions are described below.

Website visitors

Data	Purpose	Legal basis	Retention
Requested page, response code, processing time	Operation, security and diagnosis of the website	Legitimate interest	Limited, as needed for diagnosis
Anonymous journey events (action name, page, language)	Understanding page use, without identifier or cookie	Legitimate interest	Limited
Language choice (curiavia_locale cookie)	Remembering the chosen language	Necessary for the requested service	12 months

The website uses no advertising cookie and no third-party audience-measurement tool. See the cookie policy.

Contact requests

Your e-mail address, name (optional), topic and message are used to reply to you. They are sent by e-mail to the CuriaVia team through our e-mail provider. Legal basis: legitimate interest in answering your request. Retention: for as long as the request and its follow-up require. The IP address is used in memory to limit abuse.

Family accounts

• Data: verified e-mail address and identifier provided by the identity provider, display name, household composition and invited guardians.
• Purpose: creating and securing your space, managing guardians’ access.
• Legal basis: performance of the contract (terms of use).
• Retention: as long as the account exists; deletion on request from the settings.

Sign-in relies on a self-hosted identity provider; CuriaVia stores no password and uses an opaque seven-day session in a secure cookie.

Data about children

Children’s profiles are created and managed by their guardians; there is no child account. CuriaVia records what you enter: first name or nickname, level, tracks, goals, planning, sessions, observations, attached productions, assessments, mastery levels and reports.

Only the household’s guardians can access them. Files are private and served only after checking household access. This data is not kept offline on the device. We recommend not attaching unnecessary sensitive data (health, for example).

Library, files and productions

The resources, notes and files you save are stored privately on our infrastructure in Germany. Technical periods: unattached temporary files deleted within 24 hours, replaced versions kept 90 days, technical traces (capture receipts, import reports) kept 30 days.

Artificial-intelligence analyses

When you trigger an analysis:

• Resource: only its content and the candidate goals are sent.
• Assessment: only the documents you chose, their context and the goals of the selected level are sent.
• Your other observations, names and household notes are not included.

The AI providers used are MiniMax (api.minimax.io) and, through OpenRouter, Inc. (United States), models from third-party providers. This processing may take place outside the European Union. The safeguards applicable to these transfers (standard contractual clauses or an equivalent mechanism) are part of the ongoing legal review; until it is completed, do not analyse documents containing information you do not wish to send. Complete tracking works without AI.

Analysis cost records are kept for 12 months.

Marketplace: buyers

Resources obtained, favourites, carts and published reviews are linked to your family account. Published reviews are publicly visible with the name you choose. When payment opens, order data will be kept for the legal accounting periods; card data will be processed by the payment provider, never by CuriaVia.

Creators

The creator account is separate. Data: sign-in identity, public profile, resources, rights declarations, review decisions, sales and, once payments open, invoicing and payout information. Legal basis: performance of the contract (creator terms) and legal obligations.

Security and logs

Technical logs (requests, errors, performance measurements) are collected on our infrastructure, with self-hosted tools, to ensure security and proper operation. They do not include the content of your messages or family data.

Recipients and processors

Provider	Role	Location
netcup GmbH	Hosting of servers, databases and files	Germany (EU)
Cloudflare, Inc.	DNS and network proxy for some technical endpoints	International
Namecheap, Inc. (Private Email)	Sending transactional e-mails and contact requests	International
MiniMax	AI analyses you trigger	Outside the EU
OpenRouter, Inc.	AI analyses you trigger	United States

The authentication, storage, error-tracking and performance-measurement tools are self-hosted on CuriaVia’s infrastructure in Germany.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. Full household export and deletion are available directly from the application settings. For any other request, use the contact form. You can lodge a complaint with the CNIL (cnil.fr) or your local data-protection authority.

Impact assessment

Processing involving children’s data and AI-assisted analyses is subject to an assessment of the need for a data-protection impact assessment, carried out as part of the ongoing review.

Changes

Any substantial change to this policy will be indicated on this page with a new version.