Privacy notice

Last updated 9 September 2026. This describes what Cursivia actually stores and who processes it — it is written from the data model, not from a template.

Who is responsible

Cursivia is operated by the Cursivia team (contact: privacy@cursivia.com). We are the data controller for everything below. Write to that address for any request in this notice; you can also exercise the two main ones yourself, see Your data, in the product.

What we store, and why

We hold four kinds of data. Nothing here is inferred from third-party sources — all of it either comes from you or is produced by your use of the product.

1. Account

• Your email address — to identify your account and send sign-in links or codes. This is the only contact detail we hold; there is no password, because sign-in is by emailed link or one-time code.
• The marketing attribution of your first visit (utm_source, utm_medium, utm_campaign) if you arrived from a link that carried one, so we can tell which channels bring people who stay.
• Billing state — your Stripe customer and subscription identifiers, the subscription status and the trial end date. We never see or store your card details: the card is entered on Stripe's own checkout page and stays with Stripe.

2. What you tell us at intake

• The competition you are preparing for, how many weeks you have, how many hours a week, and when your energy is best.
• Whether you have sat an EPSO test before and when.
• Your own ratings of your study habits and strategy.
• Optionally, your CV. The file goes to a private storage bucket, not into our database, and is read through short-lived signed links. It is used once, to extract the professional profile that tunes your plan. You can delete it by deleting your account, which removes the file from storage too.

3. What the product measures about you

This is the core of what Cursivia does, so it is worth being precise: we record every practice and diagnostic answer — which item, which option you chose, whether it was right, and how long you took. From those we derive per-skill scores, per-dimension mastery, and the study-topic progress that decides what you are given next. If you log practice done on another platform, we store what you enter.

This is performance data about you, and it is the reason the product can adapt. It is not shared with anyone and it is not used to build profiles for any purpose other than your own preparation.

4. Product events

A log of what happened in the product — signed up, completed intake, generated a plan, started a trial, finished a session. We use it to fix things and to see whether the product works (how many people who start a trial keep using it). Each entry carries your account id, so it is personal data and it is deleted with your account.

Our lawful basis

• Performance of a contract (Art. 6(1)(b) GDPR) for your account, the intake answers, your CV if you upload one, the performance data and the billing state. These are what the service is — without them there is no adaptive plan to deliver.
• Legitimate interests (Art. 6(1)(f)) for the product event log and the marketing attribution, to keep the service working and understand which channels it reaches people through. You can object at any time by writing to us.
• We do not rely on consent for any of the above, and we do not ask for special-category data. Do not put health, political or similar information into the free-text fields.

Automated decisions

Your plan, your allocation of study time and the questions you are shown are generated automatically, including by a large language model. They are suggestions about how to study: they have no legal effect and no effect on your EPSO application, which is run entirely by EPSO and to which we have no connection. You can change your target competition, regenerate a plan, or ignore it.

Who processes it for us

We do not sell your data and we do not share it for advertising.

Cookies

Two cookies, both strictly necessary, both first-party, neither used for tracking:

• cursivia_session — keeps you signed in. Expires after 90 days or when you log out.
• cursivia_pending_utm — remembers which link brought you, for the few minutes between requesting a sign-in email and clicking it.

We do not use advertising or cross-site tracking cookies, so there is no cookie banner to click. If we ever add analytics that are not strictly necessary, we will ask first.

How long we keep it

For as long as you have an account. When you delete your account we delete your profile, intake answers, CV file, sessions, answers, derived scores and event log, and the sign-in identity itself. Two things deliberately survive, because they are no longer about you: anonymised item statistics (how many people got a question right, with no link to who), and, if you were one of our reviewers, your quality verdicts on questions — with your account id removed.

Your rights

Under the GDPR you can ask for access, correction, deletion, restriction, portability, and to object to processing based on legitimate interests. Write to privacy@cursivia.com; we answer within one month. You can also complain to your national data protection authority.

Your data, in the product

Two of these do not need to go through us at all. On your account page, under “Your data”, you can export everything we hold about you as a file, and delete your account immediately.

Changes

If we change this notice we will update the date at the top and, for anything that materially affects you, tell you by email.