Privacy Policy
Who we are
Curviate is operated by Redmer Holding GmbH ("Curviate", "we", "us"), a German GmbH registered at Amtsgericht Bonn, HRB 29957, registered address Hostertstraße 16, 53332 Bornheim, Germany. Full company details are on our Imprint. We haven't appointed a statutory Data Protection Officer, since our processing doesn't reach the scale or sensitivity that requires one. Privacy questions go to privacy@curviate.com.
The two roles we play
When you create an account and use Curviate, we process your own data (identity, billing, API keys, connector authorizations). For that data, we are the controller.
When you use Curviate to act on your own connected LinkedIn account, viewing profiles, sending messages, managing engagement, that content and those contacts belong to that account and its people. You are the controller of that data; we are the processor, acting only on your instructions, under a Data Processing Agreement available on request (see below). If one of your contacts has a question about being reached through Curviate, you're who they should contact first; email privacy@curviate.com if you need help routing it.
What we collect, and why
| Data | Why |
|---|---|
| Account identity (name, email, sign-in method) | Create and secure your account |
| Your LinkedIn credentials | Operate the actions you request |
| LinkedIn content Curviate retrieves on your behalf | Fulfil your requests, and answer later requests for the same records without fetching them from LinkedIn again |
| API keys and connector (OAuth) authorizations | Authenticate your API, CLI, MCP, or SDK requests |
| Billing details | Charge you correctly and meet our tax obligations |
| Usage and security logs | Keep the service reliable and abuse-free |
| Support messages | Respond to you |
| Website analytics, only if you opt in | Understand how the site is used |
We rely on our contract with you, our legitimate interest in running and securing the service, our legal obligations (tax law, for example), and, for analytics, your consent. We never sell your data or use it to train models.
If you arrive through an advertisement or a campaign link, we record the campaign parameters in that link (such as source, medium, campaign name, keyword, and the advertiser's click identifier, for example Google's gclid) with your account when you sign up, so we can measure which campaigns bring in customers. These come from the link itself; we do not set a cookie or use storage on your device for this. We store them in our EU database and send them to PostHog EU, and keep them for the lifetime of your account.
Where it's processed, and who else touches it
Our infrastructure runs in the EU. Hosting: Railway. Database and auth: Supabase, Ireland. Email: Resend. Payments: Stripe. Network security: a DDoS-protection provider sits in front of our app and never sees or stores request content. LinkedIn connectivity: a third-party infrastructure provider that lets us execute LinkedIn actions on your behalf. Error tracking: Sentry, Frankfurt. Product analytics: PostHog, Frankfurt. Uptime monitoring: Better Stack.
We give the current, named list of every provider above to any customer who asks: security@curviate.com.
Data processing agreement
A data processing agreement under Article 28 of the GDPR is available to business customers on request. Email security@curviate.com and we will send you the current version.
Outside the EU
All customer LinkedIn data, account data, and telemetry are processed and stored exclusively in EU regions of our sub-processors. A few providers we rely on (Stripe and Sentry, for example) are headquartered outside the EU/EEA; where that applies, it's covered by their own GDPR safeguards, typically the EU Standard Contractual Clauses.
How long we keep it
| Data | Retention |
|---|---|
| Account and workspace data | While your account is active |
| Closed account | Deleted immediately and irreversibly; see Deleting your account below |
| LinkedIn credentials | Until you disconnect that account |
| LinkedIn profiles, companies, posts, jobs, comments, and groups | While your account is active |
| Chats and messages from your connected accounts' personal LinkedIn inboxes | While your account is active |
| Contacts you keep (added, imported, or filled in from public profiles), with their Tags and list memberships | While your account is active, or until you delete the Contact |
| LinkedIn activity events we receive for your accounts | Kept briefly, then deleted automatically |
| Search queries, recruiter screening answers and candidate ratings, and personal contact details from profiles, such as email addresses and phone numbers | Not kept |
| Short-lived cache | Cleared within 1 hour |
| API keys | Until you revoke or rotate them |
| Connector (OAuth) authorizations | Access token ~1 hour; refresh token up to ~12 months, or until you revoke it, whichever comes first |
| Billing records | As required by German tax law, currently up to 10 years |
| Logs | A short operational window; metadata only, never message content |
We keep LinkedIn content only when Curviate retrieves it from LinkedIn on your behalf or receives an event for one of your connected accounts. It is kept only for your workspace, and we never use it to train models. It is deleted when you close your account, except copies queued for delivery to your webhooks, which expire on their own shortly afterwards.
The 12-month figure above is a server-side credential for a connected AI agent or app. It is not a cookie and doesn't touch your browser session; see Cookies below for that. You can see and revoke every connector from Authorized applications in your dashboard at any time.
Cookies
We keep cookies to a minimum, and ask before anything beyond the essentials runs.
Strictly necessary, no consent needed:
| Name | Purpose | Expiry |
|---|---|---|
cc_cookie | Remembers your cookie choice | 12 months |
sb-*-auth-token | Keeps you signed in | While active; cleared on sign-out |
Analytics, only if you accept:
| Name | Purpose | Expiry |
|---|---|---|
_ga | Google Analytics: distinguishes visitors | 2 years |
_gid | Google Analytics: distinguishes visitors | 24 hours |
_ga_<container id> | Google Analytics: persists session state | 2 years |
No advertising cookies, ever. Accept and reject are equally easy, and you can change your mind any time via Cookie Preferences in the footer; we won't ask again for 12 months unless something material changes. Our LinkedIn connect flow and OAuth authorization screen never set anything beyond the essentials, so no banner appears there.
Connecting an AI agent or app
Curviate is built for AI agents and automated clients as much as for people. If you connect an app like Claude, or your own code, via an API key or an OAuth connector, it can act on your workspace within the access you gave it. What it does with anything it receives back, including what it sends to its own AI model, is between you and that provider; review its practices before connecting it. Review and revoke any connection any time from your dashboard.
Deleting your account
You can delete your account yourself, from Settings in your dashboard. It takes effect immediately and it cannot be undone. There is no grace period and nothing to restore afterwards, so export anything you want to keep before you start.
Deleting removes your sign-in identity, which frees your email address for reuse straight away, along with your profile, your workspace membership and settings, your API keys, and your seats. For any connected LinkedIn account, we instruct our infrastructure provider to delete it, and your access ends immediately. Records of the connection itself can remain in our systems; email privacy@curviate.com if you need those removed as well. The LinkedIn content we kept for your account, including chats and messages, is deleted with it. The one exception is event copies already queued for delivery to your webhooks, which expire on their own shortly afterwards.
You control the Contacts you keep, and you can delete any of them. Deleting a Contact removes its fields, Tags, and list memberships. It is not an erasure of that person from Curviate: records of the same person that came from LinkedIn (profile and inbox records) and the log of your actions remain until you close your account, and a one-way fingerprint of the deleted Contact's LinkedIn identity is kept for 90 days so that a deleted person is not added back by an import.
A few things are kept on purpose. We would rather name them than claim a clean sweep:
- Billing records, for as long as German tax law requires. They hold plan, seat count, amount, and payment references; no name, no email, no LinkedIn data.
- A record that the deletion happened, so we can show you or a regulator that we did it.
- A security log of which requests were made, kept for 90 days and then removed automatically. It records that a request happened, never what was in it.
- A one-way fingerprint, if you used a free trial, that lets us recognise a repeat trial. It holds no readable identifier and cannot be read back into your name, your email, or your LinkedIn profile.
Internal workspace identifiers can also remain in operational records such as queue entries and rate-limit counters. Those carry no name, no email, and no content. If you want to know exactly what is left for your own account, ask us at privacy@curviate.com.
Your rights
You can access, correct, delete, restrict, or object to your data, port it elsewhere, and withdraw consent at any time: email privacy@curviate.com. A copy of your data in a machine-readable format is available on request. We don't make automated decisions about you that have a legal or similarly significant effect. You can also complain to a supervisory authority; ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de, though you're free to complain to the one in your own country instead.
Keeping it secure
Credentials are encrypted and never logged, returned, or shared. LinkedIn actions run through native, humanized flows; full detail is on our Security & Compliance page. If a breach puts your rights at risk, we'll notify the authorities and you, as GDPR requires. Curviate isn't directed at, or offered to, anyone under 16.
Changes
We'll update this page when our practices change, and reset the cookie prompt if the change is material.
Contact
- Privacy and data rights: privacy@curviate.com
- Sub-processor list and Data Processing Agreement requests: security@curviate.com
- Everything else: raphael@curviate.com