1. Who is responsible for your information
Grace Saquing, operating That Curly Mind in the Philippines, is responsible for the personal information processed through thatcurlymind.space and its related account, analysis, reporting, and billing services (the “Service”). This policy applies to visitors, account holders, and people who contact us.
2. Information we collect
Account and profile information
We collect your email address, preferred name, authentication information, and profile details you choose to provide, such as role, organization type, country, time zone, primary use, and product-update preference. Passwords are handled by our authentication provider and are not visible to us.
Plan content and analysis results
We process plan text you paste, text extracted from supported files, project titles, selected methods, processing acknowledgments, generated analyses, and report history. An uploaded file is used for extraction and is not retained as the original file after that process; extracted text may remain in your account until you remove it.
Billing information
We receive limited purchase and entitlement information, such as customer, order, product, subscription, transaction, status, allowance, and renewal identifiers. Payment-card and PayPal credentials are collected by Lemon Squeezy as merchant of record and are not stored by That Curly Mind.
Technical, security, and support information
We and our providers may process essential session data, timestamps, device or browser information, network information, error logs, and usage events needed to authenticate users, maintain security, prevent abuse, diagnose failures, and operate the Service. If you contact support, we process the message and information you provide.
Consent records
We record your user ID, the versions of the policies you accepted, the source of acceptance, and the date and time. We do not collect an IP address or browser fingerprint solely to create this record.
3. Where information comes from
Most information comes directly from you. We may also receive account identity information from a sign-in provider if you choose a third-party sign-in option, and transaction or subscription information from our merchant of record. We do not purchase personal-data lists.
4. Why we process information
- To create and secure accounts and personalize the workspace.
- To receive plan content and provide the analysis you request.
- To save, retrieve, export, and delete your reports and source text.
- To confirm purchases, manage entitlements, prevent duplicate fulfillment, and support billing.
- To send essential account, security, and service messages.
- To provide support, investigate errors, prevent abuse, and improve reliability.
- To comply with law, enforce our policies, and protect legal rights.
- To send optional product updates only when you choose to receive them.
Depending on the context and applicable law, processing is based on your consent, the need to provide the Service you request, compliance with legal obligations, or legitimate interests such as security and service reliability that are balanced against your rights.
5. AI-assisted analysis
Plan content is not sent for AI analysis merely because you save or paste it. Processing begins after you select a method, acknowledge the processing notice, and choose Run analysis. The selected plan content and instructions needed for the method are transmitted securely to our AI processing provider.
Under the provider’s standard business and API data controls, submitted API content is not used to train its models unless the service account affirmatively opts in. The provider may retain limited abuse-monitoring logs for up to 30 days. Background processing can also require temporary response state while the application checks whether a report is ready.
Do not submit unnecessary personal, regulated, legally privileged, or highly confidential information. Remove names, identifiers, and sensitive details when they are not needed for the strategic question.
6. Service providers and disclosures
We disclose information only as needed to the following categories of recipients:
- Supabase: authentication, account records, and private database storage.
- Vercel: secure application hosting and server-side delivery.
- OpenAI: AI processing used to generate the requested analysis.
- ZeptoMail: transactional emails such as confirmation, reset, and security messages.
- Lemon Squeezy: merchant-of-record payment, tax, receipt, refund, dispute, and subscription services.
- Optional sign-in providers: identity information when you choose a supported third-party sign-in method.
- Professional advisers or authorities: only when reasonably necessary to comply with law, address fraud or security, or establish or defend legal rights.
We do not sell your plan content or personal information, and we do not disclose it for cross-context behavioral advertising.
7. International processing
Our service providers operate infrastructure in multiple countries, so information may be processed outside the Philippines. We select established providers, limit data to what is reasonably needed, and use contractual and technical safeguards appropriate to the service and applicable law. We remain accountable for our selection and use of processors.
8. Retention and deletion
- Account and profile information is generally retained while your account remains active.
- Saved plan text and reports remain until you remove them, delete the applicable report, or request account deletion, subject to limited operational and legal retention.
- Original uploaded files are discarded after text extraction; the extracted text can be retained in the project.
- Billing and transaction records may be retained as needed for accounting, tax, fraud, dispute, and legal obligations.
- Security, diagnostic, provider, and backup records are kept for limited periods based on operational need and provider practices.
- Support communications may be retained while a request is active and for a reasonable period afterward.
Removing content deletes it from active application records. Copies can remain temporarily in restricted backups, security logs, or processor systems before routine deletion or where law requires retention.
9. Your choices and data-subject rights
Subject to the Philippine Data Privacy Act and other applicable law, you may have rights to be informed, access personal information, object to or restrict certain processing, correct inaccurate data, request erasure or blocking, obtain portable data where applicable, withdraw consent, complain, and seek damages for unlawful processing.
You can update profile details in the Service and remove source text or individual reports from My Analyses. For account deletion or another privacy request, contact the email shown below from the address linked to your account. We may need to verify your identity and may retain information when required by law or necessary to establish or defend legal claims.
You may also lodge a complaint with the National Privacy Commission of the Philippines. We encourage you to contact us first so we can try to resolve the concern promptly.
10. Cookies and similar technologies
The Service currently uses essential cookies and local browser storage for sign-in, security, session continuity, and necessary application features. We do not currently use advertising cookies. If we introduce optional analytics or advertising technologies, we will update this policy and seek consent where required.
11. Security
We use reasonable administrative, technical, and organizational measures, including encrypted connections, access controls, server-only credentials, database row-level security, signed payment notifications, and account-level isolation. No internet service is completely secure, so we cannot guarantee absolute security. Review our Security & Privacy page for a clearer description of the current data journey and controls.
12. Children
The Service is intended for adults and organizations, not children under 18. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information so we can investigate and take appropriate action.
13. Changes to this policy
We may update this policy when the Service, providers, or legal requirements change. The effective date appears above. If a change materially affects how we use information, we will provide reasonable notice and seek renewed consent where required.