What we hold about you, and for how long.
This site has no forms, no cookies and no analytics, so the list is short. What is on it is here in full, with the reason and the retention period beside each item.
Who we are
ai-cur is operated by Harvto LLC, a California limited liability company in the United States. Harvto LLC is the party you contract with and the controller of the personal data described here. Write to support@ai-cur.com for anything on this page.
Last updated 7 September 2026. This page describes what ai-cur.com and the ai-cur products actually do with personal data today. When that changes, this page changes first.
The website collects nothing
There are no forms, no cookies, no analytics and no third-party scripts on any page of this site. Every button that reaches us opens your own mail client.
The one thing the site records is a standard web server log. When your browser requests a page, our server writes the time, the page requested, your IP address and your browser's user-agent string. We use those logs to keep the site up and to investigate abuse, and for nothing else. They are deleted on a rolling basis after 15 days.
If we ever add analytics or a form, this section will say so before it happens, and the addition will ask for your consent at the point it applies.
What we hold, why, and for how long
| When | What | Why, and the legal basis | Kept for |
|---|---|---|---|
| You email us | Your name, email address, company, and whatever you write | To answer you and to follow up on a sales or support conversation you started. Our legitimate interest in responding to an enquiry you made. | 24 months from our last exchange, then deleted |
| You buy a plan | Your name, work email, company, billing address, VAT or tax ID, and the payment record. Card details go to Stripe and never reach us. | To deliver the contract you entered and to keep the accounts the law requires. | 7 years, because tax and accounting law requires it |
| You create a free account | Your email address, or the identifier Google or Microsoft gives us for you, the time you signed up and the times you sign in, and the name of any team you join or create | To give you a portal account, keep it yours, and let a teammate invite you. Performance of the service you asked for. | Until you delete the account. You can delete it yourself from a signed-in session; deletion takes effect after a 30 day grace period you can cancel, and then removes every record but the note that it happened |
| You sign in to a hosted tenant | Your name, work email, role, and the sign-in events your identity provider sends us | To run the service you subscribed to and to scope what each person can see. Performance of the contract. | The subscription term plus 30 days, then deleted |
| Your organisation's cost and usage data in a hosted tenant | The billing records, seat lists, usage counts and work references your collectors send | Your organisation is the controller of this data and we process it only on its instructions, under the data processing agreement in your contract. | As your organisation instructs, and deleted within 30 days of the subscription ending |
Prompts and session content never leave your boundary in any deployment profile, hosted or not. That is a product commitment described on the deployment page, and it is also a privacy fact: we do not hold the text of anyone's AI conversations.
The free Tracker
The AI Usage Tracker runs on your own machine and reads local files and the vendor APIs you already have credentials for. Today it sends nothing to Harvto LLC: there is no account, no sign-in and no telemetry. A coming version will send one anonymous ping when it is installed and one a week after that, carrying a random install identifier, the Tracker version and the operating system, and nothing else: no usage figures, no file names, no account. It exists so we can count installs. You can turn it off with one setting before it ever sends, and the release notes of the version that adds it will say so. Signing in to the hosted portal is a separate, explicit choice covered above.
Who else sees it
We use a small number of providers to run the business, each of which processes data only on our instructions and under its own data processing terms.
- Zoho Corporation, United States. Runs our email, so anything you send to an ai-cur.com address is stored there.
- Stripe, Inc., United States. Takes payment. Stripe receives your card details directly; we see the last four digits and the outcome.
- Oracle Cloud Infrastructure, United States, San Jose and Phoenix regions. Hosts this website, the demo, and hosted tenants unless your contract names another region.
We do not sell personal data, we do not share it with advertisers, and we do not send marketing email to anyone who has not asked for it. We disclose data to a public authority only where the law obliges us to.
If you are in the European Economic Area, the United Kingdom or Switzerland
We are in the United States, so your data is transferred here. Where the law of your country requires a transfer safeguard, we rely on the European Commission's standard contractual clauses, or the UK addendum to them, with each provider above, and on the transfer mechanisms those providers themselves maintain.
You have the right to ask what we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable form, and to withdraw any consent you gave. Email support@ai-cur.com and we will answer within one month. You also have the right to complain to the supervisory authority in your country, and we would rather you told us first.
We make no decisions about you by automated means that have legal or similarly significant effects. This site and these products are for businesses and are not directed at anyone under sixteen.
How we protect it
Traffic to this site and to every hosted tenant is encrypted in transit. Each hosted tenant is resolved by its own hostname with its own sign-in configuration, so one customer's data cannot be reached from another customer's address. Access to production systems is limited to the people who operate them and is logged. If a breach ever affects your data, we will tell you without undue delay and, where the law requires it, within 72 hours of learning of it.
Questions about any of this go to support@ai-cur.com. The terms of service and the refund and cancellation policy complete the set.