What we hold about you, and for how long.

Who we are

ai-cur is operated by Harvto LLC, a California limited liability company in the United States. Harvto LLC is the party you contract with and the controller of the personal data described here. Write to support@ai-cur.com for anything on this page.

Last updated 11 October 2026. This page describes what ai-cur.com and the ai-cur products actually do with personal data today. When that changes, this page changes first.

What we hold, why, and for how long

When	What	Why, and the legal basis	Kept for
You email us	Your name, email address, company, and whatever you write	To answer you and to follow up on a sales or support conversation you started. Our legitimate interest in responding to an enquiry you made.	24 months from our last exchange, then deleted
You buy a plan	Your name, work email, company, billing address, VAT or tax ID, and the payment record. Card details go to Stripe and never reach us.	To deliver the contract you entered and to keep the accounts the law requires.	7 years, because tax and accounting law requires it
You create a free account	Your email address, or the identifier Google or Microsoft gives us for you, the time you signed up and the times you sign in, and the name of any team you join or create	To give you a portal account, keep it yours, and let a teammate invite you. Performance of the service you asked for.	Until you delete the account. You can delete it yourself from a signed-in session; deletion takes effect after a 30 day grace period you can cancel, and then removes every record but the note that it happened
You sign in to a hosted tenant	Your name, work email, role, and the sign-in events your identity provider sends us	To run the service you subscribed to and to scope what each person can see. Performance of the contract.	The subscription term plus 30 days, then deleted
Your organisation's cost and usage data in a hosted tenant	The billing records, seat lists, usage counts and work references your collectors send	Your organisation is the controller of this data and we process it only on its instructions, under the data processing agreement in your contract.	As your organisation instructs, and deleted within 30 days of the subscription ending
You enrol the mobile app on a phone or watch	The device name, platform, app identifier and a random install key, plus a hash of the credential and of your network address. The full list is in the mobile apps section above.	To let the app read your workspace's figures and to let you see and revoke each device. Performance of the contract.	A request never approved: 24 hours after it expires. A revoked device: 90 days after revocation. Otherwise until the workspace is deleted
The mobile apps contact our servers	The server request log: IP address, method and path, response status	To keep the service up and to investigate abuse. Our legitimate interest in running a secure service.	At most 14 days

Prompts and session content never leave your boundary in any deployment profile, hosted or not. That is a product commitment described on the deployment page, and it is also a privacy fact: we do not hold the text of anyone's AI conversations.

Mobile apps: iPhone, Apple Watch, Android and Wear OS

The ai-cur apps show your organisation's AI cost and usage on a phone or a watch. They are read-only windows onto a hosted workspace, so they send very little, and this section lists all of it.

What an app sends when you enrol it

You start from the app, which shows an eight-digit code. You then approve that code while signed in to your workspace in a browser. Only after you approve does the app receive a credential. To make that work the app sends us:

• A device name. On iPhone and Apple Watch this is the name the operating system reports for the device. Recent versions of iOS give apps a generic name such as "iPhone" unless the app holds a special entitlement, and ours holds none, but we have not checked what every device returns, so a name you gave your own device could be sent. On Android and Wear OS the app sends a fixed label, "Android phone" or "Wear OS watch", and does not read a name from the device.
• The platform: iPhone, Apple Watch, Android or Wear OS.
• The app identifier: the bundle identifier on Apple devices, the package name on Android.
• A random install key. The app creates it the first time you enrol, from random numbers. It identifies that one installation to your workspace, so you can see it in your device list and revoke it. It is not an advertising identifier and it is not derived from your hardware, your account or your name.
• The read credential, on every later request. We create it when you approve the device. It is a read-only credential for your workspace's usage figures, and it is tied to the person who approved it.

The app does not send your name or email address. Those stay in the browser sign-in at the workspace.

What the apps do not do

The iPhone, Apple Watch, Android phone and Wear OS apps do not ask for your location or your contacts, do not read the advertising identifier, and contain no analytics or crash-reporting software from us or from anyone else. The Android apps request only network access. The Apple apps declare in their privacy manifests that they do not track you. We checked this against the app source on 11 October 2026; a later version could differ, and this page will change first.

What our servers record

• A pending enrolment request: the device name, platform, app identifier and install key above; the address of our server the app contacted; hashes of the code and of the request's secret; the times it was made, approved or cancelled; and, once you approve, which workspace and which person approved it. The request lasts five minutes.
• A hash of the connecting network address. We keep a one-way hash of the IP address the enrolment came from, not the address itself, and use it to limit how fast enrolment can be attempted. A hash of an IP address can be reversed by trying every possible address, so we treat it as personal data. The counters built from it are deleted within about ten minutes.
• A device record once you approve: the same device name, platform, app identifier and install key, the time it was enrolled, and the time it was revoked if you revoke it.
• A credential record: a hash of the credential (we never store the credential itself), its label, its creation time, its expiry (a year after it is issued), whether it has been revoked, and the time it was last used to read data.
• Short-lived approval values for the browser page where you approve a device: single-use anti-forgery values, stored as hashes, valid for ten minutes.
• A server request log. The application server writes a line for each request with the connecting IP address, the method and path requested, and the response status. Its format does not include the user-agent header or the content of the request. Any web server or proxy in front of it keeps its own log, which this policy also limits to the period below.

We do not store your IP address or your phone's user-agent string in the database. The IP address appears in the request log and, as a hash, in the enrolment records above.

How long we keep it

• Enrolment requests that are never approved are deleted within 24 hours of the time they expire.
• A device record and its credential record are deleted 90 days after the device is revoked or its credential expires, whichever comes first.
• Server request logs are kept for at most 14 days.
• Everything else about a workspace, including devices that are still active, is deleted when the workspace is deleted: a 30-day grace period, then a purge.

How to delete it

To stop one phone or watch, revoke it from the devices page of your workspace in a browser. Its credential stops working at once and the record is deleted 90 days later. To delete your account or leave a team workspace, go to app.ai-cur.com/account/delete. Or email support@ai-cur.com and we will do it for you.

If you are in the European Economic Area, the United Kingdom or Switzerland

We are in the United States, so your data is transferred here. Where the law of your country requires a transfer safeguard, we rely on the European Commission's standard contractual clauses, or the UK addendum to them, with each provider above, and on the transfer mechanisms those providers themselves maintain.

You have the right to ask what we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable form, and to withdraw any consent you gave. Email support@ai-cur.com and we will answer within one month. You also have the right to complain to the supervisory authority in your country, and we would rather you told us first.

We make no decisions about you by automated means that have legal or similarly significant effects. This site and these products are for businesses and are not directed at anyone under sixteen.