Privacy policy for the app

Curvo B.V. (“Curvo” or “we”) values the privacy of our users and we strive to protect the privacy and the confidentiality of personal data that we use in connection with our mobile app.

This privacy policy describes how we use your personal data (as a data controller). We collect, use, disclose and otherwise process your personal data where this is necessary for the purposes identified in this privacy commitment and only where permitted by the EU General Data Protection Regulation (GDPR) and local data protection laws (the Data Protection Rules).

We treat your personal data with care. If anything is unclear, don't hesitate to reach out to us at [email protected].

Data controller and contact details

Curvo is the data controller in respect of the personal data we receive in connection to our app. Curvo is a private limited liability company and has its registered office address at Minervalaan 64, 1077 PE Amsterdam, Netherlands.

Curvo has appointed a data protection officer which is Yoran Brondsema. In case of any questions in relation to our use of your personal data, you can contact our data protection officer using the following email address: [email protected].

Personal data that we process

We collect and process the following personal data:

Device information: the device that you’re using, including information about its operating system, platform and version.
Push notification token: when you enable push notifications, your device generates a token issued by Apple (iOS) or Google (Android). We store this token so we can deliver notifications to you. It is not your device's advertising identifier and cannot be used to track you across other apps.
Usage details: the date and time you use the Curvo app, the usage patterns, traffic data and logs.
Your identification and individual details: we receive your information from your itsme account. This information is used to conduct the “know your customer” checks. The following is collected:
a. Full name
b. Date of birth
c. Place of birth
d. Gender
e. Nationality
f. Address
g. e-ID information: serial number and validity dates
h. National register number ("rijksregisternummer" or "numéro de registre national")
i. Mobile number
j. Email
The IBAN of your bank account
Other personal information: any other information that you share with us via email or via our in-app chat.
Information on your goals, financial knowledge and experience: this information is required to match you with the investment portfolio that suits you the best. We ask you these questions during the signup process.
Know-your-customer information: we ask specific questions during the signup process in order to comply with the anti-money laundering regulations we are bound to.

How we process your personal data

Let's break down how we process the data mentioned above:

To provide our services to you through the Curvo app.
To communicate with you regarding your investments.
To collect the relevant data about you that is required for opening and maintaining an investment account: it’s vital for compliance to the legal frameworks applicable to investment services that we have all the required information about you.
To conduct customer due diligence and anti-fraud checks: We process your personal data to conduct credit checks and checks to prevent fraud, money laundering, terrorist financing and to establish whether you are a politically exposed person (PEP). If false or inaccurate information is provided and fraud is identified or suspected, details may be passed to the relevant authorities.
For marketing Curvo: we may use your personal data to contact you about our services. We may push notifications through the app or send you an email. You may opt-out at any time from any communication. We will not provide your contact details to any third parties for marketing purposes.
If we change business structure: we may have to disclose your personal data with regards to legal proceedings or investigations from third parties such as public authorities, law enforcement agencies and regulators. We may also provide your personal data to any potential acquirer of or investor in any part of Curvo’s business for the sole purpose of that acquisition or investment.

How we protect your personal data

Curvo has implemented appropriate technical measures to secure the processing of personal data. These safeguards are designed to keep personal data protected from unauthorised access. This includes the encryption of communications via SSL, encryption of information during storage, firewalls and access controls.

All Curvo team members and contractors, who will have access to personal data on our instructions, will be bound to confidentiality and we use access controls to limit access to individuals that require such access for the performance of their responsibilities and tasks.

Curvo stores your personal data on our IT systems located in the European Economic Area (EEA).

How long we retain your personal data

We collect, use, disclose and otherwise process your personal data that is necessary for the purposes identified in this privacy policy or as permitted by the Data Protection Rules. If we require personal data for a purpose inconsistent with the purposes we identified in this privacy policy, we will notify you of the new purpose and, where required, ask for your consent to process personal data for the new purposes.

Our retention periods for personal data are based on business needs and legal requirements. We retain your personal data as long as you access and make use of the Curvo app. We will retain your personal data and keep your profile active until the customer relationship with you ends. After it has ended, we will retain your personal data for a limited period of time.

Your rights

Under GDPR, you have rights in relation to your personal data:

Right of access: you can obtain confirmation on how your personal data is being processed but also obtain a copy of the personal data we maintain about you.
Rectification: you are free to ask us to change any inaccurate personal data that we process.
‍Erasure: you are free to ask us to delete any personal information that we no longer have a legal ground to process.
Restriction: you can ask us to mark certain personal data as restricted whilst complaints are resolved.
Portability: you can ask us to transmit the personal data that you have provided to us and we still hold about you to a third-party electronically.

If you wish to exercise one of these rights, please contact our data protection officer directly at [email protected]. Simply specify your request and to indicate to which personal data your request relates.

If you’re unhappy with how we respond to you, you have the right to complain to the Dutch Data Protection Authority. You may lodge a complaint through their website.

Third parties that we work with

We engage with various third-party data processors for the processing of your personal data. We have contracts in place with them that they are bound to. They will hold the data securely and retain it for the period that we instruct.

App analytics

Amplitude (Sonalight, Inc.): we collect various information from your device when using Curvo's app. We process trackers and usage data to see how you're using Curvo and improve our service accordingly.

Place of processing: United States 🇺🇸

Hosting and infrastructure

Amazon Web Services (Amazon Web Services, Inc.): we store customer documents and operational files on S3, manage encryption keys via KMS, store credentials in Secrets Manager, and serve files through the CloudFront content delivery network.

Place of processing: Frankfurt (Germany) 🇩🇪

Heroku (Salesforce.com, Inc.): they provide us with a ready-made infrastructure to run the Curvo app. We process all the data listed above.

Place of processing: Europe 🇪🇺

Infrastructure monitoring

Sentry (Functional Software, Inc.): this service allows to monitor the use and behaviour of our components within the app. It helps us with performance, maintenance and troubleshooting with the app.

Place of processing: United States 🇺🇸

Scout APM (Scout APM, LLC): this service monitors the performance of the Curvo backend, helping us track down slow requests and bottlenecks.

Place of processing: Canada 🇨🇦

Help, chat and communication

Crisp Widget (Crisp IM SARL): this service allows us to chat with you within Curvo's app and also to provide a help centre. We collect browsing and usage data within the app. Note that your conversations with us within the app are all logged.

Place of processing: France 🇫🇷

Customer.io (Pearberry Software Inc.): this allows us to communicate with you as a Curvo customer. We collect browsing and usage data within the app. We have the ability to send you notifications through this service and can send you messages and updates through email.

Place of processing: Europe 🇪🇺

Pipedrive (Pipedrive OÜ): we use this service as a customer relationship manager (CRM). This allows us to communicate with you as a Curvo customer. It allows us to phone you and log calls. We also have the ability to send you emails through this service.

Place of processing: Germany 🇩🇪

Fastmail (Fastmail Pty Ltd): we host our [email protected] and team mailboxes on Fastmail. Emails you send us, and our replies, are stored there.

Place of processing: Australia 🇦🇺 (EU data region)

Server logs

Datadog (Datadog, Inc.): we forward server logs from the Curvo backend to Datadog so we can investigate and troubleshoot incidents.

Place of processing: Europe 🇪🇺

Identity verification and authentication

itsme® (Belgian Mobile ID NV): Belgian customers register and authenticate with their itsme® account. itsme® shares verified identity information with us, which we use to open the investment account.

Place of processing: Belgium 🇧🇪

‍Privacy Policy

Onfido (Onfido Ltd): Onfido verifies your identity by checking your ID document and matching it against a live selfie. We rely on Onfido for customers who don't have an itsme® account and for additional residence permit checks.

Place of processing: United Kingdom 🇬🇧

Twilio (Twilio Inc.): we use Twilio to send one-time codes by SMS so we can verify your phone number.

Place of processing: United States 🇺🇸 (EU data region)

Session replays

Microsoft Clarity (Microsoft Corporation): we use Microsoft Clarity to record anonymized session replays of the Curvo app. This helps us identify usability issues. Fields containing financial or personal information are masked, so they are not captured in the replay.

Place of processing: United States 🇺🇸

Changes to the privacy policy

This page may change and evolve. We will update you with the changes and publish it on Curvo’s website.

This page was last updated on May 22, 2026.