Privacy Policy

1.1. The controller is CUR NOVA LTD, company number 17240836, registered at Dept 6831, 196 High Road, Wood Green, London, N22 8HH, United Kingdom. References to “Cur Nova”, “we”, “us” and “our” mean that company.

1.2. You can contact us about privacy at info@cur-nova.com or by writing to the address above.

1.3. This Policy covers personal data processed for visitors, customers, business contacts and authorised users of the Service. The Service is intended for people aged 18 and over.

1.4. We process personal data under applicable data protection law, including the UK GDPR and the Data Protection Act 2018, as amended. Where another mandatory data protection regime applies to a particular activity, its requirements also apply.

1.5. This Policy provides information about our processing. Reading it or using the website does not, by itself, constitute consent to processing that requires a separate choice.

2.1Information you provide

Depending on the features you use, we may process:

• Account details, such as your name or display name, company information where relevant, email address, authentication details, telephone number, preferred currency and region.
• Learning and order requirements, such as your experience, educational goals, markets of interest, approximate deposit range, risk preferences and information provided for a Trader Custom Course, AI Custom Course or AI Strategy Output.
• Generation inputs, including prompts, selected form fields, notes, strategy descriptions, educational scenarios and any other content you choose to submit.
• Purchase and Usage Unit information, including top-ups, balances, redemptions, transaction references, purchased materials and delivery records.
• Billing information needed for receipts, invoices and tax treatment, such as billing name, address and relevant business tax details.
• Support communications, feedback and attachments you send to us.

Account passwords, where used, are held in hashed form rather than as readable passwords. We do not ask you to send passwords or full payment card details in support messages or prompts.

2.2Information collected automatically

We may collect technical and usage data needed for operation and security, including IP address, browser and device information, operating system, language, time zone, session identifiers, login attempts, access events, requested features, generation status, error identifiers and performance records.

Non-essential analytics and similar tracking are used only where permitted by applicable law and subject to the choices described in section 6. We use aggregated or pseudonymised information where suitable; pseudonymised data is still treated as personal data where it can be linked back to a person.

2.3Information exchanged with service providers

Payment providers. We receive information needed to identify and reconcile transactions, such as payment status, transaction references, payment method type, limited card information such as the last four digits where provided, and relevant dispute or fraud-prevention information. Card details are processed by the payment provider. We do not receive or store full card numbers or CVV codes in our own payment records.

Authentication providers. If you choose a supported third-party sign-in method, such as Google, we may receive basic profile and authentication information, including your name, email, profile image and the identifier supplied by that provider.

OpenAI. We use OpenAI's API to generate AI Custom Courses and AI Strategy Outputs. We send the prompt and the generation fields needed for your request, such as the selected market, educational level, goals and other relevant instructions. We receive the resulting generated Content and technical status information.

We do not attach your account email address, internal Account ID or payment card data from our account or payment systems to OpenAI generation requests. This describes the account and payment data we include in those requests; it is not a claim that free-text prompts are anonymous. If you type personal information into a prompt or submitted field, that information may be included in the material sent to OpenAI. Please avoid names, contact details, card information or sensitive information that is unnecessary for the educational task.

Other relevant providers. We may receive limited information from hosting, security, verification and support providers to operate the Service, investigate faults or protect payments. Professional advisers may provide information relevant to a legal, accounting or compliance matter.

2.4User content and sensitive information

Prompts, notes and uploaded material may contain information about you or other people. Only include third-party personal data where you have an appropriate legal basis and the information is necessary for your request.

We do not require special-category data, such as health information, political opinions, religious beliefs or biometric identifiers, to provide trading education. Please do not include it in prompts or ordinary intake fields. Voluntarily typing sensitive information does not, by itself, establish valid explicit consent for every use of it. If such information is received, we assess the lawful basis and any additional legal condition before using or retaining it, and remove or restrict it where there is no appropriate basis.

3.1Performing our agreement

We use the information necessary to enter into and perform an agreement with you, including to create and maintain your Account, process Orders, administer Usage Units, generate requested materials, provide access to purchased Content and communicate about delivery, cancellation or support.

This includes transmitting the necessary inputs to OpenAI when you choose an AI generation feature. We do not treat a request for AI generation as consent to unrelated marketing or model training.

Where a customer organisation is the contracting party and you are its contact or authorised user, relevant processing may instead be based on our legitimate interests in providing and administering that organisation's access.

3.2Consent

Where required, we rely on consent for non-essential cookies and tracking, optional marketing communications, or publication of an identifiable testimonial. Any processing of special-category data requires a separate applicable legal condition; explicit consent is used only where it is appropriate and validly obtained.

You can withdraw consent through the relevant preference control, unsubscribe link or by contacting us. Withdrawal does not affect processing already lawfully carried out. We will explain if a requested optional activity cannot continue without the data or consent concerned.

3.3Legitimate interests

Where the law permits and our interests are not overridden by your rights, we process necessary information to keep the Service secure, investigate suspected misuse, troubleshoot faults, administer business relationships, defend legal claims and improve reliability and usability.

We assess the purpose, necessity and impact of such processing. Product improvement does not give us an unrestricted right to reuse private prompts or enable provider training. Marketing and tracking must also meet any separate communications or cookie requirements.

3.4Legal obligations

We process information where necessary to meet applicable tax, accounting, consumer protection and data protection duties, comply with lawful requests and preserve records that we are legally required to keep.

If information is needed to fulfil an Order or meet a legal requirement and you do not provide it, we may be unable to complete the relevant transaction. We will explain this where relevant rather than treating every field as compulsory.

4.1. AI generation uses your submitted inputs to produce educational material. We also use automated functions for account operation, generation status, transaction administration, diagnostics and security screening.

4.2. OpenAI states that inputs and outputs sent through its API are not used to train or improve its models by default unless the API customer explicitly opts in. Our use of the API for the Service does not include an opt-in to share customer generation inputs or outputs for that training purpose.

4.3. No training by default does not mean no storage. OpenAI may process and retain data for service operation, abuse monitoring, security and legal compliance under the applicable API arrangements. Its standard abuse-monitoring retention is generally up to 30 days, subject to documented exceptions. Some API features store application data for different periods depending on the endpoint and configuration. We do not represent that Cur Nova's deletion periods automatically delete all provider-side records or that a special zero-retention arrangement applies.

4.4. Information about OpenAI API data controls is available at https://developers.openai.com/api/docs/guides/your-data. Our responsibilities for the data we disclose remain subject to applicable law and our arrangements with the provider.

4.5. We do not use AI generation to make solely automated decisions that produce legal or similarly significant effects about you. Educational personalisation based on your stated level or goals is used to tailor learning material. If you believe an account or other decision has been made solely by automated means and affects you significantly, contact us so we can investigate and provide any review or safeguards required by law.

4.6. AI outputs may contain errors or reproduce personal information included in the input. Please check generated material before sharing it and contact us if you identify a privacy issue.

5.1. We disclose personal data only where necessary for the stated purposes and with an appropriate legal basis. Relevant recipients may include payment providers, hosting and storage providers, authentication providers, OpenAI, email and PDF-delivery services, monitoring and security providers, support tools and professional advisers. Analytics providers receive information only as permitted by law and the relevant choices.

5.2. Providers acting as our processors are subject to appropriate contractual obligations. Some recipients, including payment providers or professional advisers, may act as independent controllers for particular activities under their own legal responsibilities. We do not describe every recipient as a processor regardless of its actual role.

5.3. For a Trader Custom Course, the person preparing the material receives only the information reasonably needed for that assignment, subject to appropriate confidentiality and data-handling arrangements.

5.4. We may disclose relevant information to banks, payment providers or card-scheme participants to handle a refund, disputed transaction or suspected unauthorised payment, and to competent authorities where lawfully required. Information provided for a dispute is limited to what is relevant; the existence of a chargeback does not justify unrestricted disclosure of Account data or prompts.

5.5. If a lawful merger, acquisition or business transfer involves personal data, we use appropriate safeguards and give notice where required. We do not sell personal data as a separate commercial product.

5.6. Some providers may process data outside the UK or the European Economic Area. Where a transfer is restricted by applicable data protection law, it is made only with the necessary lawful transfer mechanism. Depending on the destination and legal regime, this may be an applicable adequacy arrangement or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses together with the UK Addendum where required. EU clauses alone are not treated as sufficient for a restricted UK transfer when the UK regime requires an additional mechanism.

5.7. We assess additional measures where required, including access restrictions and security safeguards. Contact info@cur-nova.com for information about the transfer safeguards relevant to your data and how to obtain a copy, subject to lawful redactions.

6.1. We use cookies and similar storage technologies for functions such as authentication, session security and operation of requested features. Technologies that are strictly necessary for a service you request may operate without cookie consent where the law permits.

6.2. Non-essential analytics, marketing or similar technologies are used only where legally permitted and, where required, after your consent. A preference or performance function is not automatically treated as essential merely because it is useful to us.

6.3. You can manage relevant choices through the site's cookie controls and your browser settings. Blocking essential technologies may affect login or other requested functions. See the Cookie Policy at https://www.cur-nova.com/cookies for further information.

7.1. We retain personal data for the period necessary for its stated purpose and delete or irreversibly anonymise it when no longer needed, subject to lawful preservation requirements. The following periods distinguish generation working data from purchased materials and records needed for other purposes.

7.2. Generation prompts and input fields. We normally retain submitted prompts and the associated source fields used for generation for up to 90 days from submission, to complete generation, handle related support and investigate problems. They are then deleted or irreversibly anonymised unless a specific legal, security or dispute-related reason requires limited preservation. This period concerns source generation records; information that forms part of a purchased final material is governed by clause 7.4.

7.3. Temporary technical records. Routine temporary processing records, generation diagnostics and transient technical logs are normally retained for up to 30 days from creation. Records separately required for a transaction, identified security incident or dispute are not treated as routine temporary records and follow the relevant purpose-specific period below. We do not retain a routine copy of every prompt beyond 90 days merely by labelling it a technical record.

7.4. Purchased materials. Purchased courses, PDFs and AI outputs, together with the information necessary to associate them with your purchase and provide access, are retained for the duration of your applicable access entitlement. Once that entitlement ends, we delete or anonymise the associated personal data when it is no longer needed, subject to the limited preservation described below. This is a retention rule, not a separate promise of lifetime access. A copy you download and keep on your own device is under your control.

7.5. Account and profile data. We retain the data needed to administer an active Account. Following closure, residual account records are normally kept for no longer than 24 months where necessary for unresolved support, fraud prevention or legal claims. Information with a shorter applicable period, such as ordinary generation inputs, follows that shorter period unless a specific exception applies.

7.6. Payments and accounting. Relevant purchase, payment, Usage Unit, invoice and refund records are retained for the applicable accounting, tax and legal periods, normally up to six years where necessary for those purposes. These records do not require us to retain the full text of unrelated prompts for the same period.

7.7. Security and disputes. Necessary incident, fraud-prevention and dispute records may be kept beyond the routine 30-day technical period, normally for 6–24 months depending on the purpose and risk. Where a specific claim, payment dispute, legal hold or statutory obligation requires longer preservation, the relevant limited records may be retained for the duration needed to resolve it or meet the legal requirement, including up to six years where appropriate for a legal claim. Longer retention must have a specific justification and is not applied automatically to all generation data.

7.8. Support and communications. We retain correspondence for as long as reasonably needed to resolve the matter and document the outcome. Where a message is evidence for an Order, complaint or claim, the relevant transaction or dispute period applies. Optional marketing records are retained while the lawful marketing purpose continues, with limited suppression records kept where necessary to honour an opt-out.

7.9. Backups and exceptions. Data removed from active systems may remain in protected backups until those copies are replaced or expire under the applicable backup cycle. Such copies are restricted to recovery, security and legal purposes and are not used as a separate active archive. If restoration occurs, applicable deletion requirements are reapplied. We preserve only what is necessary where law, an active dispute or a substantiated security matter justifies an exception.

7.10. Provider-side records. These periods describe records under Cur Nova's control. OpenAI and other providers may have separate retention obligations or feature-specific storage, subject to their role, contractual arrangements and applicable law. OpenAI's API processing is further explained in section 4.

8.1. Depending on the applicable law and relevant conditions, you may have the right to:

• Obtain confirmation of processing and access to your personal data.
• Correct inaccurate or incomplete information.
• Request deletion where there is no lawful reason for continued retention.
• Restrict processing in relevant circumstances.
• Receive certain data in a portable format and request its transfer where the legal requirements are met.
• Object to processing based on legitimate interests, including related profiling, on grounds relating to your situation.
• Object to direct marketing at any time.
• Withdraw consent where processing relies on consent.
• Receive information, review or other safeguards for automated decision-making where the law provides them.

8.2. To exercise a right, email info@cur-nova.com. Using your registered email helps us identify your Account, but we will consider another reasonable verification method if you cannot use it. We ask only for identification information reasonably necessary to protect your data.

8.3. We respond within the period required by applicable law, normally one month. Where a lawful extension or other permitted adjustment applies, we explain it and any steps you need to take. We do not use unnecessary information requests to delay a response.

8.4. Requests are normally free. A charge or refusal is considered only where the law permits it, and we explain the reason and available complaint rights.

8.5. Deletion is not absolute. For example, necessary transaction or claim records may need to be retained after account closure. We will explain a relevant exception rather than treating closure as a waiver of your rights.

9.1. We use technical and organisational measures appropriate to the nature and risks of processing. These include appropriate access controls, secure transmission, protection of authentication information, backup and recovery measures and procedures for handling security incidents.

9.2. Access to customer information is limited to people and providers who need it for an authorised purpose. We assess relevant providers and apply appropriate confidentiality and processing obligations.

9.3. No online service can guarantee absolute security. If a personal data breach occurs, we investigate, take appropriate action and notify affected people and authorities where required by law.

9.4. Protect your login details and avoid submitting unnecessary personal or sensitive information. Contact us promptly if you suspect an account or privacy incident.

10.1. The Service is intended for adults aged 18 and over. We do not knowingly seek personal data from children for use of the Service.

10.2. If you believe a child has supplied personal data, contact info@cur-nova.com. We will investigate and take appropriate action, including deletion or account closure where required, while retaining only records that must lawfully be preserved.

11.1. We may revise this Policy to reflect changes in the Service, providers, processing or applicable law. The current version states its effective date.

11.2. We communicate material changes through an appropriate notice, such as email or a prominent website or Dashboard message. If a new activity requires consent or another legal step, a policy update alone does not replace that requirement.

11.3. A revision does not retrospectively create consent or legitimise an incompatible use of previously collected information.

Please contact us if you have questions or concerns about personal data. You also have the right to complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or to another supervisory authority available under applicable law, including your relevant EU authority where applicable. You do not need our permission or have to complete our internal process before exercising a statutory right to complain to a regulator.