Privacy Policy

• Cura helps microfinance teams assess borrowers against their own methodology. Each organization's data belongs to that organization and is not visible to other organizations.
• We do not sell personal data, show advertising, or use analytics or tracking scripts.
• The Chrome extension reads a Kiva borrower page only when you press Analyze, and sends it to Cura. It does nothing in the background and does not read other sites.
• Borrower content in an analysis is sent to an AI model (Google Gemini) to produce the assessment.
• You can ask us to delete your data at any time: adit2011238@gmail.com.

"Cura", "we" and "us" mean the operator of the Cura service at curamodel.com and the Cura Chrome extension. For questions or requests about your data, contact adit2011238@gmail.com.

Account data

Your email address and, if you sign in with Google, the basic profile Google shares (email and name). Passwords are handled by our authentication provider and are never visible to us.

Organization data you or your team add

Organization name, member list and roles, invitations, methodology versions, case studies, reference documents you upload (including their extracted text), and an audit log of administrative actions.

Analyses

When you analyze a borrower, we store the information read from the Kiva page (for example the borrower's first name or group name, country, loan amount and purpose, the story text shown on the page, and the page address), the resulting assessment, and a record of which methodology version, case studies and reference documents were used.

Technical data

Our hosting provider keeps standard server logs (such as IP address, time, requested address and errors) for security and troubleshooting. Extension connections store a hashed token, a label, and when it was last used.

• To provide the service: sign you in, apply your organization's methodology, run and store analyses, and show history to the people allowed to see it.
• To keep the service secure and reliable: access control, abuse limits, debugging and audit trails.
• To communicate with you about your account, such as verification and password-reset emails.

The extension needs these permissions, and uses them only for the purpose shown:

• Access to kiva.org — to read the borrower page you are viewing, only when you press Analyze.
• Access to the Cura website (curamodel.com) — to send the analysis request and to connect your browser after you sign in.
• storage — to remember your connection token and the organization you chose.
• activeTab and scripting — to read the current Kiva tab when you press Analyze.

The extension does not load remote code, does not collect browsing history, and does not run on other websites. The information it sends is used only to provide the analysis you asked for, and is not sold, used for advertising, or used to build profiles. Use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

We use these service providers to run Cura, and only to the extent needed:

• Vercel — website hosting and server logs.
• Supabase — database, authentication and file storage.
• Google (Gemini API) — the AI model that produces assessments. It receives the borrower information from the page, your methodology, and any active case studies and reference documents for that analysis. It is processed under Google's API terms.
• Google sign-in — only if you choose to sign in with Google.
• Resend — only if invitation email is enabled for your deployment.

We may disclose information if required by law. We do not sell personal data.

• Administrators of an organization see all of that organization's analyses, knowledge and audit log, and manage its members.
• Members see their own analyses, the active methodology, and approved knowledge.
• People in other organizations cannot see your organization's data. Removing a member ends their access immediately, including from the Chrome extension.

• Data is encrypted in transit (HTTPS). The database enforces per-organization access rules, and every request is checked on the server for membership and role.
• Extension tokens and invitation links are stored only as hashes, invitations expire and work once, and connections can be revoked at any time from Profile and Security.
• Saved analyses and activated methodology versions are write-protected so their history cannot be altered.
• No system is perfectly secure. If we learn of a breach affecting your data we will tell the affected organization's administrators.

We keep organization data while the organization uses Cura. Administrators can archive documents, case studies and methodology versions, and remove members. Saved analyses are kept as a permanent record of what was assessed. To have specific data, an account or an entire organization deleted, email adit2011238@gmail.com; we will act on verified requests within a reasonable time. Routine backups may keep deleted data for a limited period before it is overwritten.

You can ask to access, correct or delete personal data we hold about you, or to object to or restrict its use, by emailing adit2011238@gmail.com. Depending on where you live, you may also have the right to complain to your data-protection authority. You can disconnect the Chrome extension at any time from Profile and Security, or remove it from Chrome.

Cura uses only what it needs to work: sign-in session cookies set by our authentication provider, and a small local setting remembering which organization you last used. We do not use advertising or analytics cookies.

Analyses contain information about borrowers that is published on Kiva's own pages. Organizations are responsible for using Cura's assessments appropriately and in line with the rules that apply to them. Assessments are decision support and do not replace the judgment of the people using them.

Cura is for professionals and is not directed to children under 16.

If we change this policy in a way that matters, we will update the date above and, where appropriate, notify organization administrators.