Privacy Policy

The controller is Curio Capital AG, Baarermattstr. 8b, 6340 Baar, Switzerland. Contact fernando.verboonen@curioinvest.com or +41 79 907 2839. Fernando Verboonen is the person you can write to about this notice. We have not appointed a separate EU representative. Write to the address above and we will answer.

• We process the email you give us for an account, a digest or a webinar, plus whatever you type into those forms.
• Stripe processes the card. We do not store the card number.
• The only cookie we set ourselves is the sign-in cookie. We do not run third-party advertising cookies.
• We do not sell personal data.
• A digest can be stopped with the unsubscribe link in the email, with no account required.
• You can ask for access, correction or deletion at fernando.verboonen@curioinvest.com.

Account. Email address, a role (owner or guest), and the signed session that proves you are logged in. We do not run a public social profile.

Newsletter. If you subscribe to the digest we store the email, where the signup came from (for example the home page), the time you subscribed, and, if you leave, the time you unsubscribed.

Webinars. A registration stores your name, email, an optional company, the sessions you pick, and a short source tag so we know which page sent you.

Payment. Stripe processes the card payment. We receive and store the email, the Stripe customer and subscription identifiers, the plan, and the billing period. We do not receive or store the full card number or the card security code.

API keys. We store a label, the account email, a prefix, a hash of the key, scopes, and the time it was created, last used or revoked. The raw key is shown once and is not written to the database.

Usage. For signed-in product actions we may store a watchlist, an entity follow, or a similar setting you create. Our server also writes a traffic record: the path, the referrer, the user agent, a country code, a language, and a truncated IP address. IPv4 addresses are cut to a /24 network and IPv6 addresses to a /48. We do not keep the full address in that ledger. Some clicks (a signup or a share, not an ordinary page view) are posted to our own /api/track endpoint as a product event.

People named in public sources. News and filings mention real people. When we extract a public page we may store a name, a role or a company that the source already published. That processing is about the source, not about an account you opened with us.

We do not ask for special-category data, and we do not intend to collect it. Do not send us health data, political opinions or similar material in a form.

Under the FADP we process personal data for stated purposes, and we stop when the purpose is spent. Those purposes are:

• to provide the site, the account, the digest, webinars and the API;
• to take payment and keep the billing record the accounting law requires;
• to protect the service, limit abuse, and understand which pages are used;
• to extract and summarise public pages into signals;
• to answer you and to send a service message you asked for.

If the EU General Data Protection Regulation applies to you, the matching bases are: contract, where we need the data to provide an account, a subscription or a digest you asked for (Article 6(1)(b)); legitimate interests, for security logs, truncated traffic records and product events that are not advertising (Article 6(1)(f)); consent, for a newsletter where consent is what the law requires (Article 6(1)(a)); and legal obligation, for accounting records (Article 6(1)(c)). You may object to processing based on legitimate interests, and you may withdraw a consent without affecting processing that already happened.

Scores rank public market items. They are not a decision about you that produces a legal effect or a similar significant effect. We do not use your personal data for automated decision-making of that kind.

We checked the application rather than listing a generic cookie banner. This is what the code actually does.

Sign-in cookie. Name: curio_signal_session. Set only when you log in. It is HttpOnly, Secure and SameSite=Lax, so a script on the page cannot read it and it is limited to our site. The value is a signed token carrying your email, role, expiry and a revocation id. It lasts eight hours, or until you log out. It is required for signed-in pages. It is not an advertising cookie.

Vercel Web Analytics. Every page loads Vercel’s analytics script. That product does not set a cookie. Vercel uses it to count page views (URL, referrer, a coarse device and a hashed visitor marker) so we can see aggregate traffic. We do not use Vercel Speed Insights.

Our traffic ledger and /api/track. These are server records, not cookies. They are described in section 3.

Google Analytics and PostHog. The repository contains optional hooks for Google Analytics 4 and PostHog. They stay off unless a measurement id or a PostHog key is configured, and the site layout does not load the Google tag or the PostHog library. In the current deployment those tools do not run and do not set cookies. If we turn one on, we will change this notice first and, where the law requires a choice, ask before the cookie is set.

Stripe. Checkout runs on Stripe’s pages. Stripe may set its own cookies there to complete the payment and to prevent fraud. Those cookies are Stripe’s. We do not copy them onto rwaleads.com.

YouTube. A masterclass episode may embed a player from youtube-nocookie.com. That privacy-enhanced player does not set a YouTube cookie until you press play.

We do not use a cookie wall, and we do not drop optional marketing cookies. The sign-in cookie is exempt from a consent banner because the page you asked for cannot stay signed in without it.

We use the following processors. Each handles data only so we can run RWA Leads:

• Vercel — hosting, and the cookieless Web Analytics described above. Vercel is in the United States.
• Supabase — the database for subscribers, API-key hashes, subscriptions and similar records. The project is hosted in AWS eu-west-1 (Ireland).
• Stripe — payments. Stripe processes the card. We store the subscription record, not the card.
• Resend — sending the digest and other email when an API key is configured. Resend is in the United States. If email is not configured, a message stays on our server and is not handed to Resend.
• MiniMax — extraction and summarisation of public pages. Calls go to api.minimax.io through an Anthropic-compatible client. We send the public text we want summarised. We do not send your password, your card or your newsletter list. This codebase does not call Anthropic’s own API.
• Exa — the search API (api.exa.ai) we use to find public news, filings and websites. Queries are search phrases, not your account profile.
• Telegram — only as an operator channel. If a bot token is configured, we post a daily brief of public signals, and an alert if the ingest pipeline stalls, to our own chat. There is no Telegram login and we do not send visitor profiles to Telegram.

We may also disclose data if the law requires it, or to a buyer of the business if the service is transferred, in which case this notice still applies or the buyer will tell you of a change. We do not sell personal data and we do not share it with advertising networks.

We are in Switzerland. Supabase stores the database in the EU (eu-west-1). The EU and the EEA provide adequate protection for a transfer from Switzerland.

Vercel, Stripe, Resend and Exa process data in the United States. A transfer to the United States rests on the Swiss-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on standard contractual clauses or another safeguard recognised by Article 16 of the FADP. If the GDPR applies to you, the same transfer uses an adequacy decision or the safeguards in Chapter V, including standard contractual clauses.

MiniMax processes public source text outside Switzerland. China is not the subject of a Swiss or EU adequacy decision. We rely on a contract with the provider and, where the law requires it, clauses of the kind Article 16 FADP and GDPR Chapter V recognise. Public articles can still contain names. We do not send account or payment data on that path. You can ask us not to run a particular source through the model by writing to us; we will remove the derived signal where the request is justified.

The sign-in cookie lasts eight hours. A revocation id is kept so a logged-out token stays invalid at least until it would have expired. A newsletter email is kept until you unsubscribe. After that we keep the address and the unsubscribe time so a later import does not sign you up again. Webinar details are kept so we can admit you and show who registered, and we delete them on request unless an email we already sent must be retained.

Invoices and the subscription record are kept for the life of the account and then for the period Swiss accounting law requires, generally ten years (Article 958f of the Code of Obligations). An API-key row is kept until you revoke it, and the revoked row is kept so the hash cannot be reused. We never store the raw key. Traffic records are capped as the store rotates (the local overlay keeps at most 50,000 rows) and are not given a separate expiry job. Ask us if you want records that identify you deleted sooner. MiniMax’s own retention of a prompt is governed by that provider. We do not use those prompts to build an advertising profile of you.

The digest is optional. Every email contains an unsubscribe link. You can also open /api/unsubscribe?email= followed by your address. No login is required. Unsubscribing stops further digest mail. We keep the suppression record described above.

Under the FADP you can ask whether we process data about you, and you can ask for a copy (access, Article 25). You can ask us to correct inaccurate data, and to delete data we no longer need for the purpose we collected it for. Where Article 28 applies — automated processing based on your consent or on a contract — you can ask for the data you gave us in a portable form. We answer an access request within 30 days, or we tell you why we need longer.

If the GDPR applies to you, you also have the rights of rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You will not be subject to a solely automated decision that produces a legal effect, because we do not make those decisions.

Write to fernando.verboonen@curioinvest.com. We may ask for enough information to be sure we are writing to the right person. We will not charge you for an ordinary request. These rights have limits: we can refuse where a request is manifestly unfounded, or where we must keep a record for the law.

You can complain to the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, Switzerland, https://www.edoeb.admin.ch. If the GDPR applies to you, you can also complain to the supervisory authority in the country where you live or work. We would like the chance to fix a problem first. You do not have to write to us before you complain.

RWA Leads is a professional research tool. It is not aimed at children. If you believe we have personal data of a child, email us and we will delete it.

If we change this notice, we will update the date at the top. A material change to a newsletter or to a new tracking tool will be mentioned on this page, and by email where we have your address and the law expects it.