Privacy Policy

Curie is operated by PT Hanya Planet Bumi ("Curie", "we", "us"), a company incorporated in the Republic of Indonesia with its registered office in South Tangerang, Banten, Indonesia. For the purposes of the GDPR we act as the data controller of the personal data described below; under Indonesia's Law No. 27 of 2022 on Personal Data Protection ("UU PDP") we act as the Personal Data Controller (Pengendali Data Pribadi).

This policy applies to the Curie web application, its browser extension, and any related websites and services that link to it (together, the "Service"). It does not apply to third-party websites or academic publishers you may reach through Curie, which operate under their own privacy policies.

Where you use Curie under a licence purchased by your university, department, or employer, that institution may act as controller for certain administrative data; we then process such data on its documented instructions.

• "Personal data" means any information relating to an identified or identifiable natural person, including personal data as defined in Article 1(1) of UU PDP.
• "Processing" means any operation performed on personal data, whether automated or not, including collection, storage, use, disclosure, and erasure.
• "Content" means the documents, outlines, notes, comments, chat messages, uploaded files, and library sources you create, upload, or store in Curie.
• "Sub-processor" means a third party engaged by us to process personal data on our behalf in order to deliver the Service.

3.1 Data you provide to us

• Account data — your name, email address, and a hashed password; or, where you sign in with Google, the basic profile information released by that provider (name, email address, profile picture).
• Content — documents, outlines, comments, chat conversations, uploaded files (such as PDFs and Word documents), extracted references, and library sources.
• Workspace data — the workspaces, projects, and collaborators you create or are invited to, including invitation email addresses.
• Billing data — plan, billing period, invoice records, and transaction references. Card and bank credentials are entered directly with our payment provider and are never received or stored by Curie.
• Correspondence — support requests, feedback, careers or institutional enquiries, and the contents of messages you send us.

3.2 Data collected automatically

• Usage data — features used (AI autocompletes, drafts, reviews, chats, searches), word counts, and event timestamps, used to operate plan limits, detect abuse, and improve the Service.
• Technical and log data — IP address, browser type and version, operating system, device type, referring page, and request timestamps.
• Cookies and local storage — strictly necessary identifiers to keep you signed in, plus preference storage (for example your citation style, language, and interface layout).

We do not intentionally collect special-category or specific personal data (health, biometric, financial account, political or religious data). Please do not upload such material into Curie unless it is a necessary part of your research and you have a lawful basis and any required ethics approval for doing so.

Under the GDPR we must identify a legal basis for each processing purpose; UU PDP Article 20 sets out an equivalent requirement. The table below sets out both.

Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

When you invoke an AI feature — autocomplete, drafting, refinement, review, chat, or extraction — only the portions of your Content necessary to fulfil that specific request are transmitted to our AI model providers over encrypted connections, together with the instructions required to produce the result.

• We do not train any Curie model on your Content, and we operate no model training pipeline of our own.
• We access our AI providers through enterprise API tiers whose terms exclude customer inputs and outputs from provider model training.
• Your Content is not pooled, shared, or made visible to other Curie users, and is not used to generate suggestions for anyone but you.
• We do not sell personal data and we do not use your Content for advertising or profiling.
• AI features are assistive only; no legal or similarly significant decision about you is made solely by automated means.

Some features query public academic infrastructure (for example OpenAlex, Crossref, DOAJ, CORE, Semantic Scholar) or fetch open-access documents on your behalf. Those requests carry your search terms, not your identity or your documents.

We do not sell, rent, or trade personal data. We disclose personal data only to the categories of recipients below, each bound by written confidentiality and data protection obligations.

We may also disclose personal data where required by law, regulation, court order, or an enforceable governmental request; where necessary to establish, exercise, or defend legal claims; or in connection with a merger, acquisition, or asset sale, in which case we will notify you and the acquirer will remain bound by this policy.

Curie's infrastructure and several of our sub-processors are located outside Indonesia, including in the European Union and the United States. Where personal data is transferred across borders we rely on the safeguards required by Article 56 of UU PDP — namely that the receiving country provides an adequate level of protection, or that adequate and binding contractual safeguards are in place — and, for transfers out of the European Economic Area, on the European Commission's Standard Contractual Clauses supplemented where necessary by additional technical measures such as encryption.

We retain personal data only for as long as necessary for the purposes for which it was collected.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2+) and at rest (AES-256), password hashing, per-account data isolation enforced at the database layer, least-privilege internal access, secret management for third-party credentials, and continuous dependency patching. A full description is available on our Security page. No system can be guaranteed absolutely secure, but we review and improve these controls on an ongoing basis.

Subject to the conditions and exemptions in applicable law, you have the right to:

• Be informed about how your personal data is processed (UU PDP Art. 5; GDPR Art. 13–14).
• Access your personal data and obtain a copy (UU PDP Art. 6; GDPR Art. 15).
• Rectify inaccurate or incomplete data (UU PDP Art. 7; GDPR Art. 16).
• Erase your data and have your account permanently deleted (UU PDP Art. 8; GDPR Art. 17).
• Withdraw consent at any time (UU PDP Art. 9; GDPR Art. 7(3)).
• Object to processing based on legitimate interests, and to object to solely automated decision-making (UU PDP Art. 10; GDPR Arts. 21–22).
• Restrict or delay processing in defined circumstances (UU PDP Art. 11; GDPR Art. 18).
• Receive your data in a structured, machine-readable format and transmit it elsewhere (UU PDP Art. 13; GDPR Art. 20).
• Lodge a complaint or claim compensation for a violation (UU PDP Art. 12; GDPR Art. 77).

Many of these rights can be exercised directly in the product: you can update your profile, export documents and references, and permanently delete your account and all associated data from Settings → Account. For anything else, write to us using the details in section 14. We respond to verified requests within 30 days, as required by UU PDP Article 21 and the GDPR.

If you are in the European Economic Area or the United Kingdom you may complain to your local supervisory authority. If you are in Indonesia you may raise a complaint with the competent authority designated under UU PDP.

Curie uses a small number of first-party cookies and browser storage entries. Strictly necessary items keep you signed in, protect against request forgery, and maintain your session; preference items remember settings such as citation style, interface language, and panel layout. We do not use third-party advertising or cross-site tracking cookies. You can clear or block cookies in your browser, but the Service cannot keep you signed in without the strictly necessary ones.

Curie is intended for higher-education and professional research use and is not directed to children under 13, or under the higher minimum age applicable in your jurisdiction (16 in parts of the European Economic Area). Where consent from a parent or guardian is required under UU PDP Article 25, we rely on the account holder's confirmation that they meet the applicable age requirement. If you believe a child has provided us personal data, contact us and we will delete it promptly.

We may update this policy to reflect changes in our practices, technology, or legal requirements. The revised version will be posted on this page with an updated date. Where changes are material we will notify you in the Service or by email before they take effect, and where the law requires it we will seek your renewed consent.

For privacy questions, data subject requests, or complaints, contact our privacy team at hello@curie.id, or write to PT Hanya Planet Bumi, South Tangerang, Banten, Indonesia. Please state the right you wish to exercise and the email address associated with your account so that we can verify your identity.

See also our Terms of Service and Security pages.