This is a translation provided for convenience. If there is any difference between this version and the Spanish version, the Spanish version prevails.
1. Who is responsible for your data
Curvio Agency (“Curvio”, “we”), based in Mexico City, is responsible for processing the personal data described in this notice, in accordance with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, “LFPDPPP”).
For any question or request about your personal data, write to us at hello@curvio.agency.
2. Who this notice applies to
- Curvio clients and their representatives: the businesses that hire a website, Curvio Radar or Curvio Booking, and the people who represent them or sign for them.
- Curvio portal users: the people who sign in to Curvio’s portal at the invitation of a business, from the browser (app.curvio.agency) or from the Curvio Booking app for iPhone.
- Prospects and contacts: those who write to us, book a call or ask for a quote.
- Visitors to curvio.agency.
If you are a customer of one of the businesses that use Curvio (for example, you booked an appointment on their page or got an email asking you for a review), the party responsible for your data is that business, not Curvio. Curvio processes your data only on behalf of that business, as a processor, and the privacy notice that applies to you is the business’s. See section 9.
3. Personal data we process
- Clients and representatives: name, position, email, phone, business name and details, tax details (Mexican tax ID or RFC, legal name, tax regime, postal code, invoice use), and contract and subscription details.
- Portal users: name, email, the business they belong to, role, date and time of access, technical session data (IP address, device, browser) and preferences.
- Prospects: name, email, phone, business and whatever they tell us in their message or when booking a call.
- Anyone who requests the free checkup of their website: the website address and the email we send the result to. To prevent abuse of the form we also keep the IP address the request came from, for up to 7 days.
- Site visitors: technical browsing data (IP address, device type, pages visited), in aggregate form only.
Payment data. Payments are processed by Stripe. Curvio does not receive or store your full card number; we only see limited data such as the brand, the last four digits and the status of payments.
Sensitive data. We do not ask for sensitive personal data.
4. What we use your data for
Necessary purposes (without them we cannot provide the service):
- Preparing quotes and signing contracts and service orders.
- Providing, operating and supporting the contracted services.
- Creating and managing your portal account, sending you sign-in links or codes and controlling permissions.
- If you use the iPhone app and allowed it on your phone, sending you notifications about your business’s appointments (a new appointment, a time change, a cancellation or a confirmation). You can turn them off at any time in the app or in your iPhone settings. For this we store the identifier Apple assigns to your phone for notifications.
- Charging subscriptions, letting you know about failed payments and issuing invoices.
- Sending you notices about the service and about changes to contracts, terms or this notice.
- Running the website checkup you ask us for and emailing you the result.
- Keeping the portal and the forms secure, and preventing misuse.
- Complying with legal and tax obligations and requests from authorities.
Additional purposes (you can say no and the service stays the same):
- Sending you news about Curvio products or updates.
- Writing to you to follow up on your website checkup.
- Mentioning your business as a client or case in our portfolio, when you have authorized it.
- Asking you for feedback or surveys about the service.
If you do not want us to use your data for the additional purposes, write to us at hello@curvio.agency at any time.
5. Who we share your data with
We do not sell your personal data. We use providers that process data on our behalf to operate the services, without using it for their own purposes:
- Supabase: database and authentication.
- Vercel: hosting and aggregate analytics.
- Google Analytics: measuring visits to this site.
- Resend: sending emails.
- Cloudflare: checking that whoever uses the checkup form is a person and not a program.
- Stripe: payments.
- Google: Google Workspace, Analytics, Search Console, Business Profile and, when a business connects its own account, Google Calendar.
- Daily.co: video calls, when the appointment is virtual.
- Apple: delivery of notifications to your phone, only if you use the iPhone app and allowed them.
- Anthropic and OpenAI: artificial intelligence to draft texts, such as replies to reviews.
Some of these providers store data outside Mexico. We only transfer your data without your consent in the cases the LFPDPPP allows, for example to authorities when they require it.
6. Your rights (ARCO)
You have the right to Access your data, Rectify it if it is incorrect, Cancel it when you consider it is no longer needed, and Object to its use for certain purposes. To exercise these rights, send an email to hello@curvio.agency with:
- Your name and an email where we can reply.
- A document that proves your identity or, if you act for someone else, that of your representative and the document that proves it.
- Which right you want to exercise and over which data.
- Anything that helps us find your information.
We will reply within the time limits set by the LFPDPPP.
7. How to withdraw your consent, limit the use of your data or delete your account
You can withdraw your consent or ask us to limit the use of your data through the same procedure as in section 6. There is data we need in order to provide the service or comply with the law, and withdrawing its use may prevent us from continuing to provide it.
To delete your portal user account you can do it yourself in the portal or in the app, under Ajustes > Tu cuenta > Borrar mi cuenta, at app.curvio.agency/borrar-cuenta, or by writing to us at hello@curvio.agency from your account’s email. We delete your user data (name, email, preferences, session data and, if you used the app, your phone’s notification identifier) within 30 calendar days, and keep only what a law requires us to keep. Deleting your account does not delete the information of the business you work for, because that information belongs to the business.
8. How long we keep your data
We keep your data while you have a relationship with Curvio and, after that, only for the time needed to meet legal or tax obligations or to handle possible claims. Then we delete or anonymize it.
9. Data we process on behalf of other businesses
When a business uses Curvio Booking or Curvio Radar, Curvio processes data about its customers on its behalf: for example name, email, phone and appointment details, or the name and email used to ask for a review. In those cases:
- The responsible party is the business, and its privacy notice is the one that applies.
- Curvio only uses that data to provide the service to the business: confirming, reminding, changing or canceling the appointment by email, and generating the video call link when the appointment is virtual.
- If the business connects its own Google Calendar, what is explained below applies.
- Lists used to ask for reviews are deleted 90 days after the last send, and every email carries an unsubscribe link.
- If you write to us to exercise your rights over that data, we will forward your request to the responsible business.
Google Calendar. If the business connects its Google account in Curvio Booking, Curvio uses the permissions Google grants only to: read the events on its calendars (date, time and title) to calculate its availability and show them as busy times in its Curvio schedule; create, update and delete on its calendar the events for appointments booked in Curvio, including the video call link when the appointment is virtual; and store the email of the connected account to show it in Settings. Curvio does not read any other content in that account, does not use that data for advertising or to train artificial intelligence models, does not sell it and does not share it with anyone other than the providers that host the service. Access credentials are stored encrypted. The business can disconnect its account at any time from Settings in the portal or from the security settings of its Google account; when it does, Curvio deletes the credentials and the events it had read.
Curvio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
10. Cookies and similar technologies
The portal uses cookies and browser storage needed to keep your session and its security. This site uses Google Analytics and Vercel Web Analytics to understand its use in aggregate form. Google Analytics uses its own measurement cookies; we do not use advertising cookies or sell that information. You can block these cookies in your browser settings.
The Curvio Booking app for iPhone. The app opens the same portal and stores on your phone what it needs to work: your session and, so you can check your calendar offline, a copy of upcoming appointments, your most recent clients and your business’s services. That copy stays on your phone, is not shared with anyone and is deleted when you sign out. The notification identifier stops being used when you sign out, when you delete your account or when Apple tells us it is no longer valid. The app uses no analytics or advertising tools and does not ask for access to your contacts, photos, location, camera or microphone.
11. Changes to this notice
We may update this notice when the way we process your data changes. The current version is always on this page, with its last-updated date. If the change is significant, we will let you know in the portal or by email. See also our Terms and Conditions.
12. Authority
If you believe your right to the protection of personal data has been affected, you can go to the competent authority on the matter.