Back to Curva.io

Privacy policy

Last updated: 29 October 2026

In short

  • Your file is processed in the memory of our server in the EU and deleted at most 30 minutes after you last use it, or the moment you click “Forget file”. It is never written to disk or to a database.
  • Building charts in the Studio involves no AI at all: everything is calculated on our server.
  • Only if you click “Analyse privately” is a summary of your data (column statistics and at most 3 example rows), together with your description and your question, sent to Privatemode's private AI, encrypted from end to end, to be processed in confidential computing in the EU, with encrypted memory and after remote attestation.
  • We use no cookies, analytics or advertising, and the page loads nothing from third parties.

1. Who is responsible

The controller is Curva.io. You can reach us about anything to do with privacy at hola@curva.io.

2. What we process, and for how long

When you upload a file we temporarily process:

  • the contents of the file (CSV, XLSX or XLS, up to 16 MB), to draw the charts;
  • the description of the data and the question you type in the private-AI panel;
  • the charts you create and the AI's latest answer, so that you can export them.

All of it lives only in the server's memory, linked to a random identifier that only your browser knows. It is deleted automatically 30 minutes after you last use it, as soon as you click “Forget file”, or if the server restarts. It is not written to disk, not stored in a database and not included in backups.

3. Where it is processed

The application runs at visualizar.curva.io, on a server hosted by Railway (Railway Corporation) in its EU West region (Amsterdam, the Netherlands). The “Live verification” section of the home page shows the region the server is actually running in at any given moment. Railway acts as a processor under its data processing agreement.

The curva.io website (the pages that show the application, the chart guide and this policy) is served by our web hosting provider. Your file never passes through that server: it goes straight from your browser to visualizar.curva.io.

4. What is sent to the AI, and how it is protected

Nothing goes to the AI until you click “Analyse privately”. Then this, and only this, is sent:

  • the name, type, number of distinct values and percentage of empty values of each column;
  • statistics for numeric columns (minimum, maximum, mean, median and standard deviation);
  • up to five example values from category, date and yes/no columns (none from free-text columns);
  • at most 3 complete rows of the file, as a sample, with each value cut to 80 characters;
  • the data-quality notes, and what you typed in “What is this data?” and “What do you want to find out?”.

Before sending, you can read exactly that content under “Preview what will be sent”; after the answer, it is shown in full under “Exactly what was sent”. The complete file is never sent to any external service.

The provider: Privatemode

The private AI is Privatemode, by Edgeless Systems GmbH (Bochum, Germany), using the model glm-flash-latest. This is how your request is protected:

  1. Encrypted prompt. Privatemode's encryption proxy runs inside our own container and encrypts the request before it leaves our server. It can only be decrypted inside the verified AI environment.
  2. Remote attestation. Before anything is sent, the proxy checks cryptographic proof issued by the hardware (AMD SEV-SNP and NVIDIA GPU confidential computing) that the service runs exactly the published software. If the check fails, the proxy does not start and nothing is sent. The home page shows the hash of the verified manifest so you can compare it with the one Privatemode publishes.
  3. Confidential computing in the EU. The model runs in EU data centres inside confidential-computing environments whose memory is encrypted while in use. Neither Edgeless Systems, nor the cloud operator, nor Curva.io can read your request or the answer.
  4. Nothing kept. Under Privatemode's terms, requests are neither stored nor used to train models.

If the private AI is switched off or unavailable, Curva.io chooses the chart with rules that run on our own server and sends nothing to anyone. The panel always says whether a recommendation came from the private AI or from the built-in rules.

Processors

ProviderPurposeWhereWhat it receives
Railway CorporationHosting the applicationEU West region (Amsterdam)Your file, in memory, while you use it
Edgeless Systems GmbH (Privatemode)Private AI, only if you click “Analyse privately”Confidential computing in the EUThe encrypted summary described above

5. Cookies and browser storage

Curva.io uses no cookies, analytics, tracking pixels or advertising. Your file's identifier lives in the tab's memory. Only when you switch language are that identifier and the chart settings saved in the tab's sessionStorage, so that the new page can pick them up: they are deleted as soon as they are read, expire after ten minutes and never leave your browser except to our own server. This storage is strictly necessary for the service you ask for.

6. Third-party resources

The pages load nothing from third-party domains: curva.io shows the application from visualizar.curva.io, our own subdomain, and the charting library, its translations, the icons and the sample data are served from our own domains. The fonts are your system's own. No font, icon or CDN provider sees your IP address.

7. Server logs

The server keeps technical logs: date, path, response code, a random request identifier, the duration and, for AI requests, the number of tokens. They never include the contents of your file, what you type or the AI's answers. They are used to diagnose faults and prevent abuse, and are kept for Railway's log-retention period.

When you visit curva.io, the web server of our hosting provider records, like any web server, your IP address, the date, the page requested and your browser. These records are used to serve the pages and prevent abuse, and are kept for the provider's log-retention period.

8. Security

  • Encrypted connection over HTTPS with HSTS.
  • In-memory processing only, with no persistent storage.
  • Strict security headers, including a Content Security Policy that only allows resources from our own domains.
  • The Privatemode API key is used only by the encryption proxy, in a separate process running as a different system user: the web application never holds it.
  • Limits on size, rows and request rate, and dependencies pinned by hash and audited.
  • Error messages never contain internal details of the server.

9. Legal basis

We process your data because it is necessary to provide the service you ask for when you upload a file or request an analysis (Article 6(1)(b) GDPR). Technical logs rely on our legitimate interest in keeping the service secure and running (Article 6(1)(f) GDPR).

10. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. Because we keep neither your files nor your text beyond the session, there will usually be nothing to hand over or delete: every visit starts from a blank page, and “Forget file” deletes everything on the spot. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country.

11. Children

Curva.io is not aimed at children under 14, and we do not knowingly collect information about them.

12. Changes to this policy

If we change anything significant, we will publish it on this page with a new date.

13. Contact

For any question about this policy, write to us at hola@curva.io.