Privacy policy

This policy explains what personal data Curade Mini collects, why, who handles it, where it is stored, how long it is kept and the choices you have, as Malaysia's Personal Data Protection Act 2010 requires. It covers the Curade Mini mobile app and this website, and it is published in English and Bahasa Melayu.

Data controller

Core Consulting and Innovation Sdn Bhd

Address

K03-13-02, Level 13, Tower 3, UOA Business Park, No. 1, Jalan Pengaturcara U1/51A, 40150 Shah Alam, Selangor, Malaysia

Contact person

Product Engineer

Email

platformeng@curade.ai

Phone

+60 3-3005 6966

Covers

The Curade Mini app and this website

Want your account deleted? Deleting your account

Who we are

Core Consulting and Innovation Sdn Bhd ("Core Consulting", "we") makes and runs Curade Mini and decides how the personal data in it is used, which makes us its data controller under the Personal Data Protection Act 2010. Curade Mini accounts are for the engineers and admins who work with Core Consulting's monitoring service.

What we collect

• Account details (required). Your name, email address, username, company, role and the environments you can open, set when your account is created, with who created it, and the date you last signed in.
• Your agreement to this policy and the terms of use. The date you agreed to this policy when you set up your account and each time you agree to it again, with the version and language you read, a digital fingerprint of that version's text and the agreement sentence you were shown, and the version of the terms of use you accepted, with its fingerprint.
• Your permission for CLEO's AI providers. Which AI providers you allowed CLEO to send your messages to, and when. The app asks before your first message to each one.
• Your withdrawal of consent, if you make one. When your account was suspended, whether you asked us to keep it suspended for a while, whether you withdrew in the app or by email and, for an email, whether you have confirmed it yet, and when you restored the account or we lifted its suspension. A withdrawal ends your agreement to this policy, your acceptance of the terms of use and your permissions for CLEO's AI providers, and we keep the time it ended each of them beside it.
• A record of who did what. When your account, or an environment you work in, is created, changed, suspended, has its suspension lifted, is deleted or has its deletion undone, when you are given or lose access to an environment, when a password reset email is sent to you from the app's console, and when a notification is sent or deleted in the console: what happened (for a change, which details changed, never what they were changed to), why where we know it, and who did it: you (for example by changing your own name, or by restoring your account when you sign in), an admin, Core Consulting or our automatic deletion run. Your account and each environment also show who created them and who last changed them (for an environment, also who last changed its AI settings), and each notification sent in the console shows who sent it. We retain the email address on the record of your account's deletion as evidence of how the deletion was handled, so that we can answer any enquiry or complaint about it, whether from you or from Malaysia's Personal Data Protection Commissioner. If you create, change, suspend or delete an account, an environment or a notification in the app's console, the record names you, and it keeps naming you after your own account is deleted.
• Preferences. Your app language and a few in-app settings, such as whether you have seen the app tour.
• Chats with CLEO (optional). What you type to CLEO, its replies, and the files you attach: photos from your photo library, and PDF, CSV, plain text and Markdown files.
• Dashboard setup. The widgets you pin and how you arrange them.
• Monitoring alerts (optional). The alerts you set for yourself (what each one watches and the line that sets it off, the items you chose, its name and whether it is switched on), your alert settings (whether alerts notify you, whether their notifications show readings, and any snooze), and the alerts raised for you, with the items and readings they name. An export of your alerts is a file holding your custom alerts with the names of the items you chose, which goes only where you save or share it; a file you import is checked, and only the alerts added from it are kept.
• Notification history. Which in-app notifications you have read, pinned or removed from your list, and which of them were emailed to you.
• Device details. The push notification token of the device you sign in on, and a random identifier the app creates on that device to protect sign in.
• Activity. The last time your account was active in the app, used to delete accounts nobody has used for 12 months.
• Usage records. Records of failed sign in attempts, which never contain your password; if you are an admin, records of usernames, email addresses and environment details you entered in the app's console that were turned down as already in use, which never contain what you entered in readable form; counts of your CLEO usage; and records of the changes you make to your monitoring alerts. They are used to block password guessing, to stop the console being used to find out which accounts and environments exist, and to enforce rate and spending limits.
• Service logs. Our hosting provider records technical details of each request to the app's servers, such as the IP address and the time.

The monitoring data the app shows (applications, services, hosts and problems) comes from your organisation's own monitoring platform. It describes your organisation's IT systems rather than you, though problem comments show the name of the person who wrote them. The app reads it on your organisation's behalf, and so does the service itself once Core Consulting has switched monitoring alerts on for an environment, with your organisation's agreement: it checks that environment's monitoring data on a schedule, with the app closed too, against the alerts people set there, and keeps only the latest check of each page an alert watches, encrypted.

What we do not collect

Curade Mini does not collect your location, your contacts or advertising identifiers, does not collect crash reports for us, and contains no advertising or analytics software. The map on the Applications screens shows where an application's users connect from, taken from monitoring data, never where you are. On Android that map is drawn by Google Maps, which collects some technical details for Google itself, as Who receives it explains.

We do not ask for sensitive personal data, such as information about your physical or mental health, your political opinions, your religious or similar beliefs, any offence, or biometric data. Please do not put it in your chats with CLEO or in the files you attach.

This website sets no cookies and uses no analytics or advertising tools. It opens in Bahasa Melayu for visitors in Malaysia and in English elsewhere, using only the country our hosting provider works out from your network address, and keeps no record of it. The language menu switches between the two at any time.

Where it comes from

From Core Consulting or your organisation's admin, when your account is created; from you, as you use the app; from your device, for the push notification token and the sign in identifier; and from your organisation's monitoring platform, for the items and readings in the monitoring alerts raised for you.

Why we use it

• To create your account, sign you in and keep the account secure.
• To show you the environments and modules your role allows.
• To answer your questions in CLEO and keep your chat history. CLEO's replies make no decisions about you.
• To run the monitoring alerts you set: to check your environments' monitoring data against them on a schedule, and to tell you, by notification and in your inbox, when something crosses a line you set and when it is back to normal.
• To send you the notifications meant for you, in your language, and to email you a copy of the ones the app raises itself, such as a welcome or a token expiry warning, apart from your monitoring alerts, which stay in the app.
• To protect the service, with limits on sign in attempts, on console entries turned down as already in use, on CLEO usage, and on changes to monitoring alerts and the notifications they send.
• To keep only what is still in use, by deleting accounts and environments nobody has used for 12 months.
• To keep a record of your agreement to this policy and the terms of use, and of your permission for CLEO's AI providers.
• To answer your requests, including requests to delete your account, to withdraw your consent or to restore your account, to confirm them by email with the address on your account before we act on them, to tell your previous email address when an administrator or Core Consulting changes the address you sign in with, and to email you once your account is deleted, whoever deleted it, unless your email address is invited to the app again before that email has been sent.
• To keep a record of who created, changed, suspended, lifted the suspension of or deleted an account, an environment or a notification, who gave or took away access to an environment and who sent a password reset from the console, when and why, as evidence of how each was handled and so that every change made in the console can be traced to the account that made it.
• To support the service and look into problems or misuse, which can mean Core Consulting staff reading your account details and CLEO chats.
• To enforce our terms of use: we can suspend an account that breaks them, and then delete it unless we lift the suspension.

We do not sell your personal data, and we do not use it for advertising.

Who receives it

We share personal data with:

• a cloud hosting and database provider, which stores the app's data and files and runs its servers;
• the AI service provider chosen for CLEO by Core Consulting or your organisation's administrator, which receives what you type and attach, what is on your screen when you ask, and the monitoring data CLEO looks up, to write the replies, once you have allowed it in the app;
• a push notification delivery service, which delivers notifications to your device through your phone's own push service, monitoring alerts included: an alert's notification carries what the alert says, with the items and readings it names unless you switch readings off;
• an email delivery service, which sends account emails such as invitations and password resets, and the email copies of the app's own notifications;
• a map service, which draws the maps on the Applications screens: Apple Maps on iPhone, and Google Maps on Android, which also collects your device's network address, technical details of your device and of the map, crash reports and an identifier for the map component, and uses them for Google's own purposes under the Google Privacy Policy;
• your organisation's own monitoring platform, which CLEO queries on your behalf when you ask about your environments.

Inside the app, the admins of your environments can see your account details and read the CLEO chats in the environments they manage, and copy them into their own account. Core Consulting staff who run the service can also see your account details and read your CLEO chats, private ones included, and copy them into their own account, to support the service and look into problems or misuse. Other people in an environment see a chat only when its owner shares it, and can then copy it into their own account. Your monitoring alerts, and the alerts raised for you, are seen in the app by you alone. We also disclose personal data where the law requires it.

Where it is stored and sent

The app's database and files are stored by our cloud hosting provider in Singapore.

Some of the services that run the app work from outside Malaysia: what you send CLEO (what you type and attach, what is on your screen when you ask, and the monitoring data it looks up) goes to the AI provider selected for your environment (Anthropic, OpenAI or Google, as Core Consulting or your organisation's administrator chooses), which may process it in the United States or another country; notifications, monitoring alerts included, and emails pass through their delivery services' servers abroad; and on Android, Google Maps sends what it collects to Google's servers abroad. Storing your personal data in Singapore and sending it to these services abroad is part of running the app. When you set up your account, the sentence you agree to names storing your personal data and sending it to services outside Malaysia, and we keep a record of your agreement. CLEO also asks for your permission, naming the provider, before your first message goes to each AI provider.

How long we keep it

Activity means using Curade Mini. For your account, that is signing in, or opening the app while you are signed in. For an environment, it is one of its engineers or admins opening the app on that environment, asking CLEO a question in it, or being added to it. Using one environment does not count as using another, and receiving emails or notifications is not activity. Before anything is deleted for lack of activity, we send a warning by email and in the app 30 days before, again 7 days before and a last time 1 day before: to the account itself, or to everyone in the environment. Using it again before then cancels the deletion, and we email the same people to say so. Once it is deleted, we email them again to confirm it, unless an account's email address is invited to the app again before that email has been sent. An account whose setup was never finished is deleted without a warning, within 14 days of its latest invitation or its last activity.

How we protect it

We protect your personal data with encryption, both in transit and when stored, and with access controls that let each account see only what its role and environments allow. Your password is never stored in readable form, and the credentials the app uses to connect to other services are kept encrypted.

Your choices and rights

Under the Personal Data Protection Act 2010 you can:

• ask whether we hold personal data about you, and for a copy of it, free of charge;
• ask us to correct it (you can change your username and full name yourself in Settings);
• ask us, by email, to send your personal data to another organisation you choose, where that is technically possible and the data format is compatible;
• withdraw your consent.

You can also ask for your account and its data to be deleted at any time: see Deleting your account.

You can also limit how we process your data, as choices we offer: chats and attachments are optional, since CLEO receives only what you choose to send it, and its AI provider only once you have allowed it; push notifications can be turned off for the app in your device's settings; monitoring alerts are optional, each one can be switched off or deleted, and in Settings you can stop their notifications (Monitoring alerts) or leave their readings out of them (Show readings in notifications); if a chat or a file you attached holds personal data about you or someone else, you can delete the message or the whole chat in CLEO, which deletes its files too; and you can ask us by email to remove that data or to limit any other processing.

The app cannot work without your account details, so withdrawing your consent closes your account. You can withdraw it in the app, from Settings > Withdraw consent, or by email. Your account is suspended as soon as your withdrawal reaches us: you are signed out of it everywhere, any session already open ends within the hour, the account cannot be used unless you restore it, and the app sends you nothing more apart from the emails about it. The chats you started are hidden from everyone at the same time. You also choose what happens to what you wrote in chats other people started, and in copies of them: hidden from everyone straight away and deleted with your account, or left there as a former member's, without your name. Choose in the app or say in your email; if your email does not say, it is hidden the same way while we ask, and it is deleted with your account unless you tell us to leave it. The account and the rest of its data are then deleted at our next daily deletion run. A withdrawal sent by email is deleted only once you confirm it: we email your account's address to ask, since an email can be made to look like it came from you. If you would rather we keep it suspended for 14 days first, in case you change your mind, choose that in the app or say so in your email: it is then deleted no later than 14 days after the suspension. Until your account is deleted, you can restore it: sign in to the app with your email address and password and confirm, or write to us and we lift the suspension once your account's address confirms it. Restoring it takes back your withdrawal: the app asks you to agree to this policy and accept the terms of use again, and the account stays closed until you do; if you have not by 14 days after restoring it, it is deleted. Once you agree, what you wrote in other people's chats is shown there again, and CLEO asks again before your next message goes to its AI provider. We email you to confirm the suspension, and again once the account is restored, or once it is deleted, unless your email address is invited to the app again before that email has been sent.

Send any request or complaint to our Product Engineer at platformeng@curade.ai or +60 3-3005 6966. The law asks for a request to see, correct or move your data, or to withdraw your consent, to be made in writing, so send those by email, or withdraw your consent in the app. Because an email can be made to look like it came from someone else, we confirm a request sent by email with the email address on your account before we act on it, and we answer a request for a copy or a correction within 21 days. Your CLEO chats, with the files in them, and your monitoring alerts hold your organisation's monitoring data, so a copy of them, or sending them to another organisation, needs written approval from the representative your organisation has named for that environment, sent to us from their own email address; Core Consulting staff who work in your organisation's environments cannot give it. We send the rest of your data without waiting for that approval, and tell you in writing which parts we are holding back and why. You can also complain directly to Malaysia's Personal Data Protection Commissioner, through pdp.gov.my.

Required or optional

Your name, email address, username, company and role are required: without them an account cannot be created or used. Agreeing to how we use your data, and to storing it in Singapore and sending it abroad as this policy describes, is also required to set up an account, since the app cannot run without either. Your device details, activity, usage records, service logs and the record of who did what are collected automatically as you use the app, which cannot work or stay secure without them. Anything you type or attach in CLEO is optional, and so is allowing its AI provider. Monitoring alerts are optional too: none of yours runs until you switch it on.

Deleting your account

You can ask for your account and its data to be deleted from Settings > Delete account in the app, or by email. Core Consulting completes it within 30 days and emails you when it is done.

An account nobody has used for 12 months is deleted automatically, after a warning by email and in the app 30 days before, again 7 days before and a last time 1 day before. Whoever deletes your account, you, your organisation's admin, Core Consulting or our automatic deletion run, we email you once it is deleted, unless you never finished setting it up, or your email address is invited to the app again before that email has been sent.

If your organisation's admin or Core Consulting deletes your account in the app's console, it closes at once: you are signed out of it everywhere, and any session already open ends within the hour. It stays closed for at least 24 hours, in case the deletion was a mistake or you change your mind. Until then, whoever could make the deletion can undo it, and when it is a deletion you asked for, you can keep your account yourself by signing in to the app with your password and confirming. Our next daily deletion run after that deletes it, and we email you once you keep it, or once it is deleted, unless your email address is invited to the app again before that email has been sent.

If you break the terms of use, Core Consulting can suspend your account: you are signed out of it everywhere, any session already open ends within the hour, signing in does not restore it, and the chats you started are hidden from everyone. It is deleted no later than 14 days after the suspension unless we lift the suspension first. We email you when it is suspended, and again once the suspension is lifted, or once it is deleted, unless your email address is invited to the app again before that email has been sent. If we lift it, the app asks you to read and accept the terms of use and this policy again before you carry on: the account stays closed until you do, and is deleted if you have not by 14 days after the lift.

Your account keeps working until a deletion request is done. To stop us using your data straight away, withdraw your consent instead, as Your choices and rights explains.

Some of what you add to CLEO stays after your account is deleted. Messages and files, photos included, that you added to a chat someone else started stay in it without your name, and a copy someone made of a chat in their own account keeps what you wrote and attached in it. A message or file that shows your name or a photo of you is still your personal data, so where you can, leave both out of your chats and attachments. To have any of them removed, email us at platformeng@curade.ai. If you withdraw your consent instead, you choose whether they are deleted too.

How deletion works

Children

Curade Mini is a work tool for adults at client organisations. It is not directed at children, and we do not knowingly collect children's personal data.

Changes to this policy

When this policy changes, the new version is published here with the date it takes effect. Until that date the app tells you the change is coming and lets you read it; from that date it shows you a short summary of what changed since you last agreed, with a link to the whole policy, where the sections that changed are marked, and you agree to it before you carry on using the app. If your version of the app is too old to show the new policy, it asks you to update the app first. If you would rather not agree, you can sign out and come back to it later, or withdraw your consent from the same screen, which suspends your account straight away and then deletes it, as Your choices and rights explains.